ITWorx Pulse release export
bd774932d5
Public source validation / validate (push) Failing after 3m8s
43 lines
1.4 KiB
Python
43 lines
1.4 KiB
Python
"""Fail on high-confidence committed secret material or private keys."""
|
|
|
|
from __future__ import annotations
|
|
|
|
import pathlib
|
|
import re
|
|
import subprocess
|
|
import sys
|
|
|
|
SKIP_PARTS = {".git", "node_modules", "dist", "bin", "artifacts"}
|
|
PRIVATE_KEY = re.compile(r"-----BEGIN (?:RSA |EC |OPENSSH )?PRIVATE KEY-----")
|
|
TOKEN_MARKERS = re.compile(r"(?:ghp_|github_pat_|sk-[A-Za-z0-9]{12,}|xox[baprs]-[A-Za-z0-9-]{12,})")
|
|
|
|
|
|
def main() -> int:
|
|
root = pathlib.Path(__file__).resolve().parents[1]
|
|
files = subprocess.check_output(["git", "ls-files", "-z"], cwd=root).decode().split("\0")
|
|
findings: list[str] = []
|
|
for name in files:
|
|
if not name:
|
|
continue
|
|
path = root / name
|
|
if any(part in SKIP_PARTS for part in path.parts) or path.name in {".env.example", "check_secrets.py"} or path.name.endswith("_test.go"):
|
|
continue
|
|
try:
|
|
content = path.read_text(encoding="utf-8")
|
|
except (UnicodeDecodeError, OSError):
|
|
continue
|
|
if PRIVATE_KEY.search(content):
|
|
findings.append(f"private key marker: {name}")
|
|
if TOKEN_MARKERS.search(content):
|
|
findings.append(f"token marker: {name}")
|
|
if findings:
|
|
print("SECRET CHECK: FAIL")
|
|
print("\n".join(findings))
|
|
return 1
|
|
print("SECRET CHECK: PASS")
|
|
return 0
|
|
|
|
|
|
if __name__ == "__main__":
|
|
sys.exit(main())
|