dc
c033032e26
Follow-ups from the review of #414. The credential guard now checks each staged .npmrc rather than only the client one: the root and sas/ files are tracked policy as well, so a token pasted into either was equally one `git add -A` away. Verified by staging a token in sas/.npmrc - the hook exits 1. $RUNNER_TEMP/npmrc is removed at the end of each job that writes it, with `if: always()` so a failed job cleans up too. The root `install` script is gone: the root .npmrc sets ignore-scripts, so npm never ran it. CONTRIBUTING already spells out the per-project commands, and is now the single source. The release workflows build the published client from the same tree, so they run `check:archiver` like build.yaml does.
59 lines
2.3 KiB
Bash
Executable File
59 lines
2.3 KiB
Bash
Executable File
#!/bin/sh
|
|
|
|
# Using `--silent` helps for showing any errs in the first line of the response
|
|
# The first line is picked up by the VS Code GIT UI popup when rc is not 0
|
|
|
|
# Scan staged changes for secrets before anything else runs.
|
|
# The binary is pinned by the @nogoo9/gitleaks devDependency and lands
|
|
# in node_modules/.bin after npm i. Commits are blocked until it is
|
|
# installed so no clone silently skips the secrets scan.
|
|
gitleaks_bin=node_modules/.bin/gitleaks
|
|
|
|
if [ ! -x "$gitleaks_bin" ]; then
|
|
echo "❌ gitleaks not found - run 'npm i' to install it"
|
|
exit 1
|
|
fi
|
|
|
|
if ! "$gitleaks_bin" protect --staged --redact; then
|
|
echo "❌ gitleaks detected a potential secret in your staged changes"
|
|
echo "Remove the secret, or add a .gitleaksignore entry if it is a false positive"
|
|
exit 1
|
|
fi
|
|
|
|
# Every tracked .npmrc is a policy file - root, sas/ and client/ - so a registry
|
|
# credential pasted into any of them is one `git add -A` from being committed.
|
|
# Each staged one is checked, not just the client.
|
|
for npmrc in $(git diff --cached --name-only --diff-filter=ACMR | grep -E '(^|/)\.npmrc$'); do
|
|
if git show ":$npmrc" | grep -Eq '(_authToken|_auth[^a-z]|_password|:_auth)'; then
|
|
echo "ERROR: $npmrc holds a registry credential - keep it in ~/.npmrc instead"
|
|
exit 1
|
|
fi
|
|
done
|
|
|
|
## Avoid large commits
|
|
# https://www.backblaze.com/blog/how-many-bytes-are-in-a-megabyte-really/
|
|
size_limit=$((2 * 1024 * 1024)) # 2MB
|
|
# Sum the sizes of the blobs this commit would introduce: the staged
|
|
# added/copied/modified/renamed/typechanged entries in the index.
|
|
# https://git-scm.com/docs/git-cat-file#Documentation/git-cat-file.txt---batch-check
|
|
# Renames are treated as add+delete (--no-renames) and pure mode changes
|
|
# (same blob, different permissions) add no new blob, so both are safe.
|
|
commit_size=$(git diff --cached --raw --no-renames --diff-filter=ACMRT |
|
|
awk '$3 != $4 { print $4 }' |
|
|
git cat-file --batch-check='%(objectsize)' |
|
|
awk '{ s += $1 } END { print s + 0 }')
|
|
|
|
if [ "$commit_size" -ge "$size_limit" ]; then
|
|
echo "Commit size is too large: $commit_size > $size_limit"
|
|
echo "Force commit using --no-verify"
|
|
exit 1
|
|
fi
|
|
|
|
if npm run --silent lint:check:silent ; then
|
|
exit 0
|
|
else
|
|
npm run --silent lint:fix:silent
|
|
echo "❌ Prettier check failed! We ran lint:fix for you. Please add & commit again."
|
|
exit 1
|
|
fi
|