maurice/snix
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Remove --add-provider step from briefcase lint

Browse source 
So it turns out that I was wrong and that .git/config is stateful. Multiple
calls to --add-provider will append the same provider each time...

Instead I'm defining secret-patterns.txt and version-controlling it.

Then:
- dev-side: I'm adding `providers = cat ci/secret-patterns.txt` to .git/config
- ci-side:  I'm adding `providers = cat ci/secret-patterns.txt` to .git/config

Unfortunately this is ad-hoc configuration ci-side, which I would like to
avoid. The good news is that my pre-commit hooks and failures from git-secrets
should now align with my CI, since they're both reading from
secret-patterns.txt. One step backwards... two steps forwards?
This commit is contained in:
William Carroll 2020-08-21 18:25:09 +01:00
parent 92fa785e75
commit 3f9352b118
2 changed files with 10 additions and 18 deletions
Download patch file Download diff file Expand all files Collapse all files

19
ci/pipelines/briefcase.nix
View file

@ -3,24 +3,7 @@
let
pipeline.steps = [
{
command = let
# Regexes to detect sensitive information
patterns = pkgs.writeText "secrets.txt" ''
(A3T[A-Z0-9]|AKIA|AGPA|AIDA|AROA|AIPA|ANPA|ANVA|ASIA)[A-Z0-9]{16}
("|')?(AWS|aws|Aws)?_?(SECRET|secret|Secret)?_?(ACCESS|access|Access)?_?(KEY|key|Key)("|')?\s*(:|=>|=)\s*("|')?[A-Za-z0-9/\+=]{40}("|')?
("|')?(AWS|aws|Aws)?_?(ACCOUNT|account|Account)_?(ID|id|Id)?("|')?\s*(:|=>|=)\s*("|')?[0-9]{4}\-?[0-9]{4}\-?[0-9]{4}("|')?
AIza[0-9A-Za-z_-]{35}
[0-9]+-[0-9A-Za-z_]{32}\.apps\.googleusercontent\.com
(^|[^0-9A-Za-z/+])1/[0-9A-Za-z_-]{43}
(^|[^0-9A-Za-z/+])1/[0-9A-Za-z_-]{64}
ya29\.[0-9A-Za-z_-]+
(sk|pk)_(test|live)_[a-zA-Z0-9]{99}
'';
in ''
cat .git/config
${pkgs.git-secrets}/bin/git-secrets --add-provider -- cat ${patterns}
${pkgs.git-secrets}/bin/git-secrets --scan-history
'';
command = "${pkgs.git-secrets}/bin/git-secrets --scan-history";
label = ":broom: lint";
}
{

9
ci/secret-patterns.txt Normal file
View file

@ -0,0 +1,9 @@
(A3T[A-Z0-9]|AKIA|AGPA|AIDA|AROA|AIPA|ANPA|ANVA|ASIA)[A-Z0-9]{16}
("|')?(AWS|aws|Aws)?_?(SECRET|secret|Secret)?_?(ACCESS|access|Access)?_?(KEY|key|Key)("|')?\s*(:|=>|=)\s*("|')?[A-Za-z0-9/\+=]{40}("|')?
("|')?(AWS|aws|Aws)?_?(ACCOUNT|account|Account)_?(ID|id|Id)?("|')?\s*(:|=>|=)\s*("|')?[0-9]{4}\-?[0-9]{4}\-?[0-9]{4}("|')?
AIza[0-9A-Za-z_-]{35}
[0-9]+-[0-9A-Za-z_]{32}\.apps\.googleusercontent\.com
(^|[^0-9A-Za-z/+])1/[0-9A-Za-z_-]{43}
(^|[^0-9A-Za-z/+])1/[0-9A-Za-z_-]{64}
ya29\.[0-9A-Za-z_-]+
(sk|pk)_(test|live)_[a-zA-Z0-9]{99}