Repository: pre-commit/pre-commit-hooks

Issue:
detect-aws-credentials fails when no credentials are set
As part of our developer setup, each person installs the pre-commit and inherits the project's hooks, but not everyone has aws credentials set up, so `detect-aws-credentials` will product a failure when the individual hasn't set any keys file or has any exported to their env.

https://github.com/pre-commit/pre-commit-hooks/blob/20f04626a1ee7eb34955d775a37aa9a56a0a7448/pre_commit_hooks/detect_aws_credentials.py#L112

I'm not sure of the best way to handle this within the current logic - I'd rather exit 0 with a passing warning than fail, since this then forces the individual to go and set up a credentials file, even if they don't use one.

I guess the "simple" workaround is to `export AWS_SECRET_ACCESS_KEY="RANDOMSTRINGTHATNEVERTEXISTSINMYCODE!!"` before running the pre-commit hooks, but this seems wrong.

Discussion:

Patch:
diff --git a/pre_commit_hooks/detect_aws_credentials.py b/pre_commit_hooks/detect_aws_credentials.py
index b0826ca..42758f0 100644
--- a/pre_commit_hooks/detect_aws_credentials.py
+++ b/pre_commit_hooks/detect_aws_credentials.py
@@ -95,6 +95,12 @@ def main(argv=None):
             'secret keys from'
         )
     )
+    parser.add_argument(
+        '--allow-missing-credentials',
+        dest='allow_missing_credentials',
+        action='store_true',
+        help='Allow hook to pass when no credentials are detected.'
+    )
     args = parser.parse_args(argv)
 
     credential_files = set(args.credential_files)
@@ -111,6 +117,9 @@ def main(argv=None):
     # the set of keys.
     keys |= get_aws_secrets_from_env()
 
+    if not keys and args.allow_missing_credentials:
+        return 0
+
     if not keys:
         print(
             'No AWS keys were found in the configured credential files and '


Test patch:
diff --git a/tests/detect_aws_credentials_test.py b/tests/detect_aws_credentials_test.py
index 9c2fda7..943a3f8 100644
--- a/tests/detect_aws_credentials_test.py
+++ b/tests/detect_aws_credentials_test.py
@@ -130,3 +130,17 @@ def test_non_existent_credentials(mock_secrets_env, mock_secrets_file, capsys):
         'and environment variables.\nPlease ensure you have the '
         'correct setting for --credentials-file\n'
     )
+
+
+@patch('pre_commit_hooks.detect_aws_credentials.get_aws_secrets_from_file')
+@patch('pre_commit_hooks.detect_aws_credentials.get_aws_secrets_from_env')
+def test_non_existent_credentials_with_allow_flag(mock_secrets_env, mock_secrets_file):
+    """Test behavior with no configured AWS secrets and flag to allow when missing."""
+    mock_secrets_env.return_value = set()
+    mock_secrets_file.return_value = set()
+    ret = main((
+        get_resource_path('aws_config_without_secrets.ini'),
+        "--credentials-file=testing/resources/credentailsfilethatdoesntexist",
+        "--allow-missing-credentials"
+    ))
+    assert ret == 0