53 lines
1.2 KiB
Bash
Executable File
53 lines
1.2 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
|
|
SRC_DIR="${SRC_DIR:-src}"
|
|
|
|
json_escape() {
|
|
python3 -c 'import json,sys; print(json.dumps(sys.argv[1]))' "$1"
|
|
}
|
|
|
|
[ -d "${SRC_DIR}" ] || {
|
|
printf '{"status":"fail","error":%s}
|
|
' "$(json_escape "src directory missing")"
|
|
exit 1
|
|
}
|
|
|
|
# High-signal patterns only. Any match is a hard fail.
|
|
patterns=(
|
|
'-----BEGIN (RSA|DSA|EC|OPENSSH) PRIVATE KEY-----'
|
|
'PuTTY-User-Key-File-'
|
|
'AKIA[0-9A-Z]{16}'
|
|
'ASIA[0-9A-Z]{16}'
|
|
'ghp_[A-Za-z0-9]{36}'
|
|
'gho_[A-Za-z0-9]{36}'
|
|
'github_pat_[A-Za-z0-9_]{20,}'
|
|
'xox[baprs]-[0-9A-Za-z-]{10,48}'
|
|
'sk_live_[0-9a-zA-Z]{20,}'
|
|
)
|
|
|
|
regex="$(IFS='|'; echo "${patterns[*]}")"
|
|
|
|
set +e
|
|
hits=$(grep -RInE --exclude-dir=vendor --exclude-dir=node_modules --exclude-dir=dist "${regex}" "${SRC_DIR}" 2>/dev/null)
|
|
set -e
|
|
|
|
if [ -n "${hits}" ]; then
|
|
{
|
|
echo '{"status":"fail","error":"secret_pattern_detected","hits":['
|
|
echo "${hits}" | head -n 50 | python3 - <<'PY'
|
|
import json,sys
|
|
lines=[l.rstrip('
|
|
') for l in sys.stdin.readlines() if l.strip()]
|
|
print("
|
|
".join([json.dumps({"hit":l})+"," for l in lines]).rstrip(','))
|
|
PY
|
|
echo ']}'
|
|
}
|
|
exit 1
|
|
fi
|
|
|
|
printf '{"status":"ok","src_dir":%s}
|
|
' "$(json_escape "${SRC_DIR}")"
|
|
echo "no_secrets: ok"
|