[INS-334] Octopus Deploy detector (#4787)

* added octopus deploy detector

* chore: feature flag gating, regen protos

* chore: add SecretParts, fix integration test

* chore: refactors tests, updated http client and fix redacted token length for more visibility

main.go

@@ -550,6 +550,7 @@ func run(state overseer.State, logSync func() error) {
 	feature.BraintrustDetectorEnabled.Store(true)
 	feature.PgAnalyzeReadKeyDetectorEnabled.Store(true)
 	feature.RedHatPyxisDetectorEnabled.Store(true)
+	feature.OctopusDeployDetectorEnabled.Store(true)
 
 	conf := &config.Config{}
 	if *configFilename != "" {

pkg/detectors/octopusdeploy/octopusdeploy.go

@@ -0,0 +1,154 @@
+package octopusdeploy
+
+import (
+	"context"
+	"fmt"
+	"io"
+	"net/http"
+	"net/url"
+
+	regexp "github.com/wasilibs/go-re2"
+
+	"github.com/trufflesecurity/trufflehog/v3/pkg/detectors"
+	"github.com/trufflesecurity/trufflehog/v3/pkg/pb/detector_typepb"
+)
+
+type Scanner struct {
+	client *http.Client
+	detectors.DefaultMultiPartCredentialProvider
+}
+
+// Compile-time interface check
+var _ detectors.Detector = (*Scanner)(nil)
+
+var (
+	defaultClient = detectors.NewClientWithDedup(detectors.DetectorHttpClientWithNoLocalAddresses)
+
+	// Octopus Deploy API keys:
+	// Format: API- followed by 29–34 uppercase letters or digits
+	octopusTokenPat = regexp.MustCompile(
+		`\b(API-[A-Z0-9]{29,34})\b`,
+	)
+
+	urlPat = regexp.MustCompile(`\b([a-z0-9-]+\.octopus\.app)\b`)
+)
+
+// Keywords used for fast pre-filtering
+func (s Scanner) Keywords() []string {
+	return []string{"octopus"}
+}
+
+func (s Scanner) getClient() *http.Client {
+	if s.client != nil {
+		return s.client
+	}
+	return defaultClient
+}
+
+// FromData scans for Octopus API tokens and optionally verifies them
+func (s Scanner) FromData(
+	ctx context.Context,
+	verify bool,
+	data []byte,
+) (results []detectors.Result, err error) {
+
+	dataStr := string(data)
+
+	uniqueTokens := make(map[string]struct{})
+	uniqueUrls := make(map[string]struct{})
+
+	for _, urlMatch := range urlPat.FindAllStringSubmatch(dataStr, -1) {
+		uniqueUrls[urlMatch[1]] = struct{}{}
+	}
+	for _, match := range octopusTokenPat.FindAllStringSubmatch(dataStr, -1) {
+		uniqueTokens[match[1]] = struct{}{}
+	}
+
+	for url := range uniqueUrls {
+		for token := range uniqueTokens {
+			result := detectors.Result{
+				DetectorType: detector_typepb.DetectorType_OctopusDeploy,
+				Raw:          []byte(token),
+				RawV2:        []byte(fmt.Sprintf("%s:%s", url, token)),
+				Redacted:     token[:8] + "...",
+				SecretParts: map[string]string{
+					"key": token,
+					"url": url,
+				},
+			}
+
+			if verify {
+				verified, verificationErr := verifyOctopusToken(
+					ctx,
+					s.getClient(),
+					url,
+					token,
+				)
+				result.SetVerificationError(verificationErr, token)
+				result.Verified = verified
+			}
+
+			results = append(results, result)
+		}
+	}
+
+	return
+}
+
+func verifyOctopusToken(
+	ctx context.Context,
+	client *http.Client,
+	baseUrl string,
+	token string,
+) (bool, error) {
+	// API REFERENCE: https://trufflesec.octopus.app/api
+	// DOCS: https://octopus.com/docs/octopus-rest-api
+	url := &url.URL{
+		Scheme: "https",
+		Host:   baseUrl,
+		Path:   "/api/users/me",
+	}
+	req, err := http.NewRequestWithContext(
+		ctx,
+		http.MethodGet,
+		url.String(),
+		http.NoBody,
+	)
+	if err != nil {
+		return false, err
+	}
+
+	req.Header.Set("X-Octopus-ApiKey", token)
+
+	res, err := detectors.DoWithDedup(client, detector_typepb.DetectorType_OctopusDeploy, fmt.Sprintf("%s:%s", baseUrl, token), req)
+	if err != nil {
+		return false, err
+	}
+	defer func() {
+		_, _ = io.Copy(io.Discard, res.Body)
+		_ = res.Body.Close()
+	}()
+
+	switch res.StatusCode {
+	case http.StatusOK, http.StatusForbidden:
+		return true, nil
+
+	case http.StatusUnauthorized:
+		// Invalid or revoked key
+		return false, nil
+
+	default:
+		return false, fmt.Errorf(
+			"unexpected HTTP response status %d",
+			res.StatusCode,
+		)
+	}
+}
+
+func (s Scanner) Type() detector_typepb.DetectorType {
+	return detector_typepb.DetectorType_OctopusDeploy
+}
+
+func (s Scanner) Description() string {
+	return "Octopus Deploy is a DevOps deployment automation platform. Octopus Deploy API keys can be used to automate deployments, manage projects, environments, and infrastructure resources."
+}

pkg/detectors/octopusdeploy/octopusdeploy_integration_test.go

@@ -0,0 +1,206 @@
+//go:build detectors
+// +build detectors
+
+package octopusdeploy
+
+import (
+	"context"
+	"fmt"
+	"testing"
+	"time"
+
+	"github.com/google/go-cmp/cmp"
+	"github.com/google/go-cmp/cmp/cmpopts"
+
+	"github.com/trufflesecurity/trufflehog/v3/pkg/common"
+	"github.com/trufflesecurity/trufflehog/v3/pkg/detectors"
+	"github.com/trufflesecurity/trufflehog/v3/pkg/pb/detector_typepb"
+)
+
+func TestOctopusDeploy_FromData(t *testing.T) {
+	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
+	defer cancel()
+
+	// Expect secrets structured like:
+	// OCTOPUS_CLOUD_URL = acme.octopus.app
+	// OCTOPUS_API_KEY = API-XXXXXXXXXXXXXXXXXXXXXXXXXXXX
+	testSecrets, err := common.GetSecret(ctx, "trufflehog-testing", "detectors6")
+	if err != nil {
+		t.Fatalf("could not get test secrets from GCP: %s", err)
+	}
+
+	baseURL := testSecrets.MustGetField("OCTOPUS_CLOUD_URL")
+	activeToken := testSecrets.MustGetField("OCTOPUS_API_KEY")
+
+	inactiveToken := "API-AAAAAAAAAAAAAAAAAAAAAAAAAAAAA"
+
+	type args struct {
+		ctx    context.Context
+		data   []byte
+		verify bool
+	}
+
+	tests := []struct {
+		name                string
+		s                   Scanner
+		args                args
+		want                []detectors.Result
+		wantErr             bool
+		wantVerificationErr bool
+	}{
+		{
+			name: "found, verified",
+			s:    Scanner{},
+			args: args{
+				ctx: context.Background(),
+				data: fmt.Appendf(
+					[]byte{},
+					"Server %s using key %s",
+					baseURL,
+					activeToken,
+				),
+				verify: true,
+			},
+			want: []detectors.Result{
+				{
+					DetectorType: detector_typepb.DetectorType_OctopusDeploy,
+					Verified:     true,
+					Raw:          []byte(activeToken),
+					RawV2:        []byte(fmt.Sprintf("%s:%s", baseURL, activeToken)),
+				},
+			},
+		},
+		{
+			name: "found, real token, verification timeout",
+			s:    Scanner{client: common.SaneHttpClientTimeOut(1 * time.Microsecond)},
+			args: args{
+				ctx: context.Background(),
+				data: fmt.Appendf(
+					[]byte{},
+					"%s %s",
+					baseURL,
+					activeToken,
+				),
+				verify: true,
+			},
+			want: []detectors.Result{
+				{
+					DetectorType: detector_typepb.DetectorType_OctopusDeploy,
+					Verified:     false,
+					Raw:          []byte(activeToken),
+					RawV2:        []byte(fmt.Sprintf("%s:%s", baseURL, activeToken)),
+				},
+			},
+			wantVerificationErr: true,
+		},
+		{
+			name: "found, real token, unexpected api response",
+			s:    Scanner{client: common.ConstantResponseHttpClient(500, "{}")},
+			args: args{
+				ctx: context.Background(),
+				data: fmt.Appendf(
+					[]byte{},
+					"%s %s",
+					baseURL,
+					activeToken,
+				),
+				verify: true,
+			},
+			want: []detectors.Result{
+				{
+					DetectorType: detector_typepb.DetectorType_OctopusDeploy,
+					Verified:     false,
+					Raw:          []byte(activeToken),
+					RawV2:        []byte(fmt.Sprintf("%s:%s", baseURL, activeToken)),
+				},
+			},
+			wantVerificationErr: true,
+		},
+		{
+			name: "found, unverified (inactive token)",
+			s:    Scanner{},
+			args: args{
+				ctx: context.Background(),
+				data: fmt.Appendf(
+					[]byte{},
+					"%s %s",
+					baseURL,
+					inactiveToken,
+				),
+				verify: true,
+			},
+			want: []detectors.Result{
+				{
+					DetectorType: detector_typepb.DetectorType_OctopusDeploy,
+					Verified:     false,
+					Raw:          []byte(inactiveToken),
+					RawV2:        []byte(fmt.Sprintf("%s:%s", baseURL, inactiveToken)),
+				},
+			},
+		},
+		{
+			name: "not found",
+			s:    Scanner{},
+			args: args{
+				ctx:    context.Background(),
+				data:   []byte("no secrets here"),
+				verify: true,
+			},
+			want: nil,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got, err := tt.s.FromData(tt.args.ctx, tt.args.verify, tt.args.data)
+			if (err != nil) != tt.wantErr {
+				t.Fatalf("OctopusDeploy.FromData() error = %v, wantErr %v", err, tt.wantErr)
+			}
+
+			for i := range got {
+				if len(got[i].Raw) == 0 {
+					t.Fatal("no raw secret present")
+				}
+				if (got[i].VerificationError() != nil) != tt.wantVerificationErr {
+					t.Fatalf(
+						"wantVerificationError = %v, verification error = %v",
+						tt.wantVerificationErr,
+						got[i].VerificationError(),
+					)
+				}
+			}
+
+			ignoreOpts := cmpopts.IgnoreFields(
+				detectors.Result{},
+				"ExtraData",
+				"verificationError",
+				"primarySecret",
+				"Redacted",
+				"chunkOffset",
+				"chunkOffsetSet",
+				"SecretParts",
+			)
+
+			if diff := cmp.Diff(got, tt.want, ignoreOpts); diff != "" {
+				t.Errorf("OctopusDeploy.FromData() %s diff: (-got +want)\n%s", tt.name, diff)
+			}
+		})
+	}
+}
+
+func BenchmarkOctopusDeploy_FromData(b *testing.B) {
+	ctx := context.Background()
+	s := Scanner{}
+
+	for name, data := range detectors.MustGetBenchmarkData() {
+		b.Run(name, func(b *testing.B) {
+			b.ResetTimer()
+			for n := 0; n < b.N; n++ {
+				_, err := s.FromData(ctx, false, data)
+				if err != nil {
+					b.Fatal(err)
+				}
+			}
+		})
+	}
+}

pkg/detectors/octopusdeploy/octopusdeploy_test.go

@@ -0,0 +1,192 @@
+package octopusdeploy
+
+import (
+	"context"
+	"testing"
+
+	"github.com/google/go-cmp/cmp"
+	"github.com/stretchr/testify/require"
+
+	"github.com/trufflesecurity/trufflehog/v3/pkg/detectors"
+	"github.com/trufflesecurity/trufflehog/v3/pkg/engine/ahocorasick"
+)
+
+func TestOctopusDeploy_Pattern(t *testing.T) {
+	d := Scanner{}
+	ahoCorasickCore := ahocorasick.NewAhoCorasickCore([]detectors.Detector{d})
+
+	tests := []struct {
+		name  string
+		input string
+		want  []string
+	}{
+		{
+			name: "valid pattern",
+			input: `
+				func setupOctopusClient() (*http.Client, error) {
+					baseUrl := &url.URL{Scheme: "https", Host: "acme.octopus.app", Path: "/api/users/me"}
+
+					// Create a new request with the API key as a header
+					req, err := http.NewRequest("GET", baseUrl.String(), http.NoBody)
+					if err != nil {
+						return nil, err
+					}
+					req.Header.Set("X-Octopus-ApiKey", "API-1234567890ABCDEFGHIJKLMNO1234")
+
+					client := &http.Client{}
+					resp, _ := client.Do(req)
+					defer func() { _ = resp.Body.Close() }()
+
+					return client, nil
+				}
+				`,
+			want: []string{
+				"acme.octopus.app:API-1234567890ABCDEFGHIJKLMNO1234",
+			},
+		},
+		{
+			name: "valid pattern - env file",
+			input: `
+				# .env.production
+				APP_NAME=deploy-bot
+				OCTOPUS_URL=prod.octopus.app
+				OCTOPUS_API_KEY=API-AAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+				LOG_LEVEL=info
+				`,
+			want: []string{
+				"prod.octopus.app:API-AAAAAAAAAAAAAAAAAAAAAAAAAAAAA",
+			},
+		},
+		{
+			name: "valid pattern - multiple tokens",
+			input: `
+				func loadOctopusKeys() []string {
+					// Rotated keys retained during the grace period
+					return []string{
+						"API-11111111111111111111111111111",
+						"API-22222222222222222222222222222",
+					}
+				}
+
+				// deployments run against dev.octopus.app
+				`,
+			want: []string{
+				"dev.octopus.app:API-11111111111111111111111111111",
+				"dev.octopus.app:API-22222222222222222222222222222",
+			},
+		},
+		{
+			name: "valid pattern - multiple urls and tokens",
+			input: `
+				environments:
+					- name: staging
+						url: acme.octopus.app
+					- name: production
+						url: prod.octopus.app
+
+				# shared deployment key used across environments
+				api_key: API-AAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+				`,
+			want: []string{
+				"acme.octopus.app:API-AAAAAAAAAAAAAAAAAAAAAAAAAAAAA",
+				"prod.octopus.app:API-AAAAAAAAAAAAAAAAAAAAAAAAAAAAA",
+			},
+		},
+		{
+			name: "invalid pattern - lowercase token",
+			input: `
+				func setupOctopusClient() {
+					baseUrl := "acme.octopus.app"
+					// Key was accidentally lowercased during a config export
+					apiKey := "API-abcdefghijklmnopqrstuvwxyz1234"
+					client.SetApiKey(baseUrl, apiKey)
+				}
+				`,
+			want: nil,
+		},
+		{
+			name: "invalid pattern - too short",
+			input: `
+				func setupOctopusClient() {
+					baseUrl := "acme.octopus.app"
+					// Truncated key accidentally committed
+					apiKey := "API-1234"
+					client.SetApiKey(baseUrl, apiKey)
+				}
+				`,
+			want: nil,
+		},
+		{
+			name: "invalid pattern - too long",
+			input: `
+				func setupOctopusClient() {
+					baseUrl := "acme.octopus.app"
+					// Extra characters appended by a bad find-and-replace
+					apiKey := "API-ABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890"
+					client.SetApiKey(baseUrl, apiKey)
+				}
+				`,
+			want: nil,
+		},
+		{
+			name: "invalid pattern - url only",
+			input: `
+				func octopusHealthCheck() error {
+					resp, err := http.Get("https://acme.octopus.app/api/status")
+					if err != nil {
+						return err
+					}
+					defer func() { _ = resp.Body.Close() }()
+					return nil
+				}
+				`,
+			want: nil,
+		},
+		{
+			name: "invalid pattern - token only",
+			input: `
+				// TODO: load the real key instead of octopus_token env var
+				func isOctopusToken(s string) bool {
+					return strings.HasPrefix(s, "API-AAAAAAAAAAAAAAAAAAAAAAAAAAAAA")
+				}
+				`,
+			want: nil,
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			matchedDetectors := ahoCorasickCore.FindDetectorMatches([]byte(test.input))
+			if len(matchedDetectors) == 0 {
+				t.Errorf("test %q failed: expected keywords %v to be found in the input", test.name, d.Keywords())
+				return
+			}
+
+			results, err := d.FromData(context.Background(), false, []byte(test.input))
+			require.NoError(t, err)
+
+			if len(results) != len(test.want) {
+				t.Errorf(
+					"mismatch in result count: expected %d, got %d",
+					len(test.want),
+					len(results),
+				)
+				return
+			}
+
+			actual := make(map[string]struct{}, len(results))
+			for _, r := range results {
+				actual[string(r.RawV2)] = struct{}{}
+			}
+
+			expected := make(map[string]struct{}, len(test.want))
+			for _, v := range test.want {
+				expected[v] = struct{}{}
+			}
+
+			if diff := cmp.Diff(expected, actual); diff != "" {
+				t.Errorf("%s diff: (-want +got)\n%s", test.name, diff)
+			}
+		})
+	}
+}

pkg/engine/defaults/defaults.go

@@ -523,6 +523,7 @@ import (
 	"github.com/trufflesecurity/trufflehog/v3/pkg/detectors/nvapi"
 	"github.com/trufflesecurity/trufflehog/v3/pkg/detectors/nylas"
 	"github.com/trufflesecurity/trufflehog/v3/pkg/detectors/oanda"
+	"github.com/trufflesecurity/trufflehog/v3/pkg/detectors/octopusdeploy"
 	"github.com/trufflesecurity/trufflehog/v3/pkg/detectors/okta"
 	"github.com/trufflesecurity/trufflehog/v3/pkg/detectors/omnisend"
 	"github.com/trufflesecurity/trufflehog/v3/pkg/detectors/onedesk"
@@ -1423,6 +1424,7 @@ func buildDetectorList() []detectors.Detector {
 		&nvapi.Scanner{},
 		&nylas.Scanner{},
 		&oanda.Scanner{},
+		&octopusdeploy.Scanner{},
 		&okta.Scanner{},
 		&omnisend.Scanner{},
 		&onedesk.Scanner{},
@@ -1812,6 +1814,8 @@ func buildDetectorList() []detectors.Detector {
 			return !feature.PgAnalyzeReadKeyDetectorEnabled.Load()
 		case *redhatpyxis.Scanner:
 			return !feature.RedHatPyxisDetectorEnabled.Load()
+		case *octopusdeploy.Scanner:
+			return !feature.OctopusDeployDetectorEnabled.Load()
 		default:
 			return false
 		}

pkg/engine/defaults/defaults_test.go

@@ -137,6 +137,7 @@ var excludedFromDefaultList = map[detector_typepb.DetectorType]struct{}{
 	detector_typepb.DetectorType_BrainTrustApiKey: {},
 	detector_typepb.DetectorType_PgAnalyzeReadKey: {},
 	detector_typepb.DetectorType_RedHatPyxis:      {},
+	detector_typepb.DetectorType_OctopusDeploy:    {},
 
 	// Reserved / special types.
 	detector_typepb.DetectorType_CustomRegex: {}, // added dynamically via engine config, not via buildDetectorList()

pkg/feature/feature.go

@@ -28,7 +28,11 @@ var (
 	BraintrustDetectorEnabled       atomic.Bool
 	PgAnalyzeReadKeyDetectorEnabled atomic.Bool
 	RedHatPyxisDetectorEnabled      atomic.Bool
+<<<<<<< oct-deploy-detector
+	OctopusDeployDetectorEnabled    atomic.Bool
+=======
   DropUnverifiedJWTResults        atomic.Bool
+>>>>>>> main
 )
 
 type AtomicString struct {

pkg/pb/detector_typepb/detector_type.pb.go

@@ -1109,6 +1109,7 @@ const (
 	DetectorType_BrainTrustApiKey                        DetectorType = 1053
 	DetectorType_PgAnalyzeReadKey                        DetectorType = 1054
 	DetectorType_RedHatPyxis                             DetectorType = 1055
+	DetectorType_OctopusDeploy                           DetectorType = 1056
 )
 
 // Enum value maps for DetectorType.
@@ -2166,6 +2167,7 @@ var (
 		1053: "BrainTrustApiKey",
 		1054: "PgAnalyzeReadKey",
 		1055: "RedHatPyxis",
+		1056: "OctopusDeploy",
 	}
 	DetectorType_value = map[string]int32{
 		"Alibaba":                               0,
@@ -3220,6 +3222,7 @@ var (
 		"BrainTrustApiKey":                  1053,
 		"PgAnalyzeReadKey":                  1054,
 		"RedHatPyxis":                       1055,
+		"OctopusDeploy":                     1056,
 	}
 )
 
@@ -3255,7 +3258,7 @@ var File_detector_type_proto protoreflect.FileDescriptor
 var file_detector_type_proto_rawDesc = []byte{
 	0x0a, 0x13, 0x64, 0x65, 0x74, 0x65, 0x63, 0x74, 0x6f, 0x72, 0x5f, 0x74, 0x79, 0x70, 0x65, 0x2e,
 	0x70, 0x72, 0x6f, 0x74, 0x6f, 0x12, 0x0d, 0x64, 0x65, 0x74, 0x65, 0x63, 0x74, 0x6f, 0x72, 0x5f,
-	0x74, 0x79, 0x70, 0x65, 0x2a, 0xa2, 0x89, 0x01, 0x0a, 0x0c, 0x44, 0x65, 0x74, 0x65, 0x63, 0x74,
+	0x74, 0x79, 0x70, 0x65, 0x2a, 0xb6, 0x89, 0x01, 0x0a, 0x0c, 0x44, 0x65, 0x74, 0x65, 0x63, 0x74,
 	0x6f, 0x72, 0x54, 0x79, 0x70, 0x65, 0x12, 0x0b, 0x0a, 0x07, 0x41, 0x6c, 0x69, 0x62, 0x61, 0x62,
 	0x61, 0x10, 0x00, 0x12, 0x08, 0x0a, 0x04, 0x41, 0x4d, 0x51, 0x50, 0x10, 0x01, 0x12, 0x07, 0x0a,
 	0x03, 0x41, 0x57, 0x53, 0x10, 0x02, 0x12, 0x09, 0x0a, 0x05, 0x41, 0x7a, 0x75, 0x72, 0x65, 0x10,
@@ -4353,12 +4356,13 @@ var file_detector_type_proto_rawDesc = []byte{
 	0x61, 0x69, 0x6e, 0x54, 0x72, 0x75, 0x73, 0x74, 0x41, 0x70, 0x69, 0x4b, 0x65, 0x79, 0x10, 0x9d,
 	0x08, 0x12, 0x15, 0x0a, 0x10, 0x50, 0x67, 0x41, 0x6e, 0x61, 0x6c, 0x79, 0x7a, 0x65, 0x52, 0x65,
 	0x61, 0x64, 0x4b, 0x65, 0x79, 0x10, 0x9e, 0x08, 0x12, 0x10, 0x0a, 0x0b, 0x52, 0x65, 0x64, 0x48,
-	0x61, 0x74, 0x50, 0x79, 0x78, 0x69, 0x73, 0x10, 0x9f, 0x08, 0x42, 0x41, 0x5a, 0x3f, 0x67, 0x69,
-	0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x74, 0x72, 0x75, 0x66, 0x66, 0x6c, 0x65,
-	0x73, 0x65, 0x63, 0x75, 0x72, 0x69, 0x74, 0x79, 0x2f, 0x74, 0x72, 0x75, 0x66, 0x66, 0x6c, 0x65,
-	0x68, 0x6f, 0x67, 0x2f, 0x76, 0x33, 0x2f, 0x70, 0x6b, 0x67, 0x2f, 0x70, 0x62, 0x2f, 0x64, 0x65,
-	0x74, 0x65, 0x63, 0x74, 0x6f, 0x72, 0x5f, 0x74, 0x79, 0x70, 0x65, 0x70, 0x62, 0x62, 0x06, 0x70,
-	0x72, 0x6f, 0x74, 0x6f, 0x33,
+	0x61, 0x74, 0x50, 0x79, 0x78, 0x69, 0x73, 0x10, 0x9f, 0x08, 0x12, 0x12, 0x0a, 0x0d, 0x4f, 0x63,
+	0x74, 0x6f, 0x70, 0x75, 0x73, 0x44, 0x65, 0x70, 0x6c, 0x6f, 0x79, 0x10, 0xa0, 0x08, 0x42, 0x41,
+	0x5a, 0x3f, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x74, 0x72, 0x75,
+	0x66, 0x66, 0x6c, 0x65, 0x73, 0x65, 0x63, 0x75, 0x72, 0x69, 0x74, 0x79, 0x2f, 0x74, 0x72, 0x75,
+	0x66, 0x66, 0x6c, 0x65, 0x68, 0x6f, 0x67, 0x2f, 0x76, 0x33, 0x2f, 0x70, 0x6b, 0x67, 0x2f, 0x70,
+	0x62, 0x2f, 0x64, 0x65, 0x74, 0x65, 0x63, 0x74, 0x6f, 0x72, 0x5f, 0x74, 0x79, 0x70, 0x65, 0x70,
+	0x62, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
 }
 
 var (

proto/detector_type.proto

@@ -1057,4 +1057,5 @@ enum DetectorType {
   BrainTrustApiKey = 1053;
   PgAnalyzeReadKey = 1054;
   RedHatPyxis = 1055;
+  OctopusDeploy = 1056;
 }