tanshu
2aab1aec1e
gitleaks runs before each commit and in CI, with known values in a redacted baseline. The layout check rejects empty readmes and main.yml role entrypoints. --changed lints only the YAML files that differ from HEAD.
36 lines
1.1 KiB
Bash
Executable File
36 lines
1.1 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# Scan for secrets. Known values are listed in the redacted baseline.
|
|
# Usage: scripts/check-secrets.sh [--staged]
|
|
set -euo pipefail
|
|
|
|
cd "$(dirname "${BASH_SOURCE[0]}")/.."
|
|
|
|
version="8.30.1"
|
|
bin="$PWD/.scratch/bin/gitleaks"
|
|
|
|
if ! command -v gitleaks >/dev/null 2>&1; then
|
|
if [ ! -x "$bin" ]; then
|
|
case "$(uname -m)" in
|
|
x86_64|amd64) arch=x64 ;;
|
|
aarch64|arm64) arch=arm64 ;;
|
|
*)
|
|
echo "unsupported architecture: $(uname -m)" >&2
|
|
exit 1
|
|
;;
|
|
esac
|
|
echo "installing gitleaks $version into .scratch/bin" >&2
|
|
mkdir -p .scratch/bin
|
|
curl -fsSL -o .scratch/bin/gitleaks.tar.gz \
|
|
"https://github.com/gitleaks/gitleaks/releases/download/v${version}/gitleaks_${version}_linux_${arch}.tar.gz"
|
|
tar -xzf .scratch/bin/gitleaks.tar.gz -C .scratch/bin gitleaks
|
|
fi
|
|
PATH="$PWD/.scratch/bin:$PATH"
|
|
fi
|
|
|
|
if [ "${1:-}" = "--staged" ]; then
|
|
gitleaks git --pre-commit --staged --redact --verbose \
|
|
--baseline-path .gitleaks-baseline.json
|
|
else
|
|
gitleaks git --baseline-path .gitleaks-baseline.json --redact --no-banner
|
|
fi
|