Sho'Nuff
d4e3777959
Replaces the archived master-apps-services.md (Jul 16, 2026) which listed 10+ defunct servers and stale specs (Mattermost, wphost01, standalone hudu, etc.). This is the new single source of truth. Cross-references deployment docs being created in org-audit.
86 lines
2.9 KiB
Bash
Executable File
86 lines
2.9 KiB
Bash
Executable File
#!/bin/bash
|
|
# Pre-commit secret scanner for itpp-infrastructure
|
|
# Scans staged changes for credential patterns before allowing commit.
|
|
# Blocks commits containing API keys, tokens, or passwords.
|
|
|
|
set -euo pipefail
|
|
|
|
RED='\033[0;31m'
|
|
NC='\033[0m'
|
|
|
|
# Patterns that indicate secrets
|
|
PATTERNS=(
|
|
# API key formats
|
|
'sk-[a-zA-Z0-9]{32,}'
|
|
'sk-litellm-[a-zA-Z0-9]{32,}'
|
|
'Bearer [a-zA-Z0-9_-]{20,}'
|
|
'x-api-key: [a-zA-Z0-9]{20,}'
|
|
'api_key.*=.*[a-zA-Z0-9_-]{20,}'
|
|
'api-key: [a-zA-Z0-9_-]{20,}'
|
|
# SyncroMSP token patterns
|
|
'T[0-9a-f]{8}[a-zA-Z0-9_-]{24,}'
|
|
# Generic secret patterns
|
|
'passwor[d][[:space:]]*=[[:space:]]*[^[:space:]]{8,}'
|
|
'secret[[:space:]]*=[[:space:]]*[^[:space:]]{16,}'
|
|
'token[[:space:]]*=[[:space:]]*[^[:space:]]{16,}'
|
|
# AWS key patterns
|
|
'AKIA[0-9A-Z]{16}'
|
|
'aws_access_key_id[[:space:]]*=[[:space:]]*[A-Z0-9]{16,}'
|
|
# Private key patterns
|
|
'-----BEGIN (RSA|OPENSSH|EC) PRIVATE KEY-----'
|
|
# JWT/stripe patterns
|
|
'eyJ[a-zA-Z0-9_-]{20,}\.[a-zA-Z0-9_-]{20,}'
|
|
'sk_live_[0-9a-zA-Z]{24,}'
|
|
'pk_live_[0-9a-zA-Z]{24,}'
|
|
)
|
|
|
|
# Files to skip
|
|
SKIP_GLOB="*.lock|*.png|*.jpg|*.gif|*.svg|*.ico|*.woff*|*.ttf|*.eot|*.min.js|*.min.css|*.map|package-lock.json|yarn.lock|pnpm-lock.yaml|go.sum|Cargo.lock|*.pb.go|*.gen.go|*.generated.*|.gitignore"
|
|
|
|
FOUND_SECRET=0
|
|
CHANGED_FILES=$(git diff --cached --name-only --diff-filter=ACM)
|
|
|
|
if [ -z "$CHANGED_FILES" ]; then
|
|
exit 0
|
|
fi
|
|
|
|
# Create temp file with staged content
|
|
STAGED_DIR=$(mktemp -d)
|
|
trap "rm -rf $STAGED_DIR" EXIT
|
|
|
|
for file in $CHANGED_FILES; do
|
|
# Skip binary/lock files
|
|
if echo "$file" | grep -qE "$SKIP_GLOB"; then
|
|
continue
|
|
fi
|
|
|
|
# Get staged content
|
|
mkdir -p "$(dirname "$STAGED_DIR/$file")"
|
|
git show ":$file" > "$STAGED_DIR/$file" 2>/dev/null || continue
|
|
|
|
for pattern in "${PATTERNS[@]}"; do
|
|
if grep -qE "$pattern" "$STAGED_DIR/$file" 2>/dev/null; then
|
|
if [ $FOUND_SECRET -eq 0 ]; then
|
|
echo ""
|
|
echo -e "${RED}╔══════════════════════════════════════════════╗${NC}"
|
|
echo -e "${RED}║ SECRET DETECTED — COMMIT BLOCKED ║${NC}"
|
|
echo -e "${RED}╚══════════════════════════════════════════════╝${NC}"
|
|
echo ""
|
|
fi
|
|
FOUND_SECRET=1
|
|
echo -e "${RED}[BLOCKED]${NC} $file — matches pattern: $pattern"
|
|
echo " → $(grep -nE "$pattern" "$STAGED_DIR/$file" | head -1 | cut -c1-120)"
|
|
fi
|
|
done
|
|
done
|
|
|
|
if [ $FOUND_SECRET -eq 1 ]; then
|
|
echo ""
|
|
echo -e "${RED}Commit aborted. Remove the secrets above and try again.${NC}"
|
|
echo "If this is a false positive, add the file to SKIP_GLOB in .git/hooks/pre-commit"
|
|
echo "or use: git commit --no-verify"
|
|
exit 1
|
|
fi
|
|
|
|
exit 0
|