d24095971c
* feat: add pre-commit secret scanner and CI secret detection Add a comprehensive secret scanning system to prevent accidental credential leaks in commits and pull requests: - scripts/secret-scan.sh: ERE-based scanner (macOS/Linux compatible) that detects AWS keys, API tokens, private keys, database URLs, GitHub/GitLab/Slack/Stripe/Google/npm tokens, and hardcoded passwords - scripts/install-hooks.sh: one-command git pre-commit hook installer - .secretscanignore: allowlist for known false positives (test fixtures, env var references, placeholder values) - CI job: secret-scan step in ci.yml scans PR diffs against origin/main - npm scripts: test:secret-scan, secret-scan, secret-scan:install-hook - 17 tests covering detection, non-detection, binary skipping, CI mode * fix: exclude secret-scan test file from CI scanning The test file contains intentional fake secrets as test inputs. Add it to .secretscanignore so CI doesn't flag them. * fix: skip secret-scan tests on Windows (requires bash/POSIX grep)
34 lines
1 KiB
Bash
Executable file
34 lines
1 KiB
Bash
Executable file
#!/usr/bin/env bash
|
|
# Installs the git pre-commit hook for secret scanning.
|
|
# Safe to run multiple times — only installs if not already present.
|
|
|
|
set -euo pipefail
|
|
|
|
HOOK_DIR="$(git rev-parse --git-dir)/hooks"
|
|
HOOK_FILE="$HOOK_DIR/pre-commit"
|
|
MARKER="# gsd-secret-scan"
|
|
|
|
mkdir -p "$HOOK_DIR"
|
|
|
|
# Check if our hook is already installed
|
|
if [[ -f "$HOOK_FILE" ]] && grep -q "$MARKER" "$HOOK_FILE" 2>/dev/null; then
|
|
echo "secret-scan pre-commit hook already installed."
|
|
exit 0
|
|
fi
|
|
|
|
# If a pre-commit hook already exists, append; otherwise create
|
|
if [[ -f "$HOOK_FILE" ]]; then
|
|
echo "" >> "$HOOK_FILE"
|
|
echo "$MARKER" >> "$HOOK_FILE"
|
|
echo 'bash "$(git rev-parse --show-toplevel)/scripts/secret-scan.sh"' >> "$HOOK_FILE"
|
|
echo "secret-scan appended to existing pre-commit hook."
|
|
else
|
|
cat > "$HOOK_FILE" << 'EOF'
|
|
#!/usr/bin/env bash
|
|
# gsd-secret-scan
|
|
# Pre-commit hook: scan staged files for hardcoded secrets
|
|
bash "$(git rev-parse --show-toplevel)/scripts/secret-scan.sh"
|
|
EOF
|
|
chmod +x "$HOOK_FILE"
|
|
echo "secret-scan pre-commit hook installed."
|
|
fi
|