dc
761734016d
client/.npmrc is tracked now, so a token left in it from the old pattern is one `git add -A` from being committed. Prose in CONTRIBUTING is not a control: the pre-commit hook fails when the staged file holds _authToken, _auth or _password. `npm run check:archiver` runs the directory-walk guard, so it is reproducible before a push instead of only in CI, and the CI step calls the same script. CONTRIBUTING now spells out the per-project installs, since the root .npmrc has ignore-scripts=true and the composite install script therefore never runs.
60 lines
2.4 KiB
Bash
Executable File
60 lines
2.4 KiB
Bash
Executable File
#!/bin/sh
|
|
|
|
# Using `--silent` helps for showing any errs in the first line of the response
|
|
# The first line is picked up by the VS Code GIT UI popup when rc is not 0
|
|
|
|
# Scan staged changes for secrets before anything else runs.
|
|
# The binary is pinned by the @nogoo9/gitleaks devDependency and lands
|
|
# in node_modules/.bin after npm i. Commits are blocked until it is
|
|
# installed so no clone silently skips the secrets scan.
|
|
gitleaks_bin=node_modules/.bin/gitleaks
|
|
|
|
if [ ! -x "$gitleaks_bin" ]; then
|
|
echo "❌ gitleaks not found - run 'npm i' to install it"
|
|
exit 1
|
|
fi
|
|
|
|
if ! "$gitleaks_bin" protect --staged --redact; then
|
|
echo "❌ gitleaks detected a potential secret in your staged changes"
|
|
echo "Remove the secret, or add a .gitleaksignore entry if it is a false positive"
|
|
exit 1
|
|
fi
|
|
|
|
# client/.npmrc is a tracked policy file. A registry credential belongs in the
|
|
# user config (~/.npmrc or NPM_CONFIG_USERCONFIG), because one `git add -A`
|
|
# would otherwise commit it - and the CI pattern that used to write the token
|
|
# into this path is exactly the habit that makes it likely.
|
|
if git diff --cached --name-only --diff-filter=ACMR | grep -qx 'client/.npmrc'; then
|
|
if git show :client/.npmrc | grep -Eq '(_authToken|_auth[^a-z]|_password|:_auth)'; then
|
|
echo "ERROR: client/.npmrc holds a registry credential - keep it in ~/.npmrc instead"
|
|
exit 1
|
|
fi
|
|
fi
|
|
|
|
## Avoid large commits
|
|
# https://www.backblaze.com/blog/how-many-bytes-are-in-a-megabyte-really/
|
|
size_limit=$((2 * 1024 * 1024)) # 2MB
|
|
# Sum the sizes of the blobs this commit would introduce: the staged
|
|
# added/copied/modified/renamed/typechanged entries in the index.
|
|
# https://git-scm.com/docs/git-cat-file#Documentation/git-cat-file.txt---batch-check
|
|
# Renames are treated as add+delete (--no-renames) and pure mode changes
|
|
# (same blob, different permissions) add no new blob, so both are safe.
|
|
commit_size=$(git diff --cached --raw --no-renames --diff-filter=ACMRT |
|
|
awk '$3 != $4 { print $4 }' |
|
|
git cat-file --batch-check='%(objectsize)' |
|
|
awk '{ s += $1 } END { print s + 0 }')
|
|
|
|
if [ "$commit_size" -ge "$size_limit" ]; then
|
|
echo "Commit size is too large: $commit_size > $size_limit"
|
|
echo "Force commit using --no-verify"
|
|
exit 1
|
|
fi
|
|
|
|
if npm run --silent lint:check:silent ; then
|
|
exit 0
|
|
else
|
|
npm run --silent lint:fix:silent
|
|
echo "❌ Prettier check failed! We ran lint:fix for you. Please add & commit again."
|
|
exit 1
|
|
fi
|