WEBDIENSTE/ECC
1
0
Fork 0
mirror of https://github.com/affaan-m/ECC.git synced 2026-10-14 04:05:29 +02:00
Code Issues Packages Projects Releases Wiki Activity

Merge PR #3478: fail closed on unavailable secret scanning

Browse Source 
Also reject scanner errors, terminate regex options, match actual private-key headers, and verify actual rg invocation and findings.
This commit is contained in:
haelyra
2026-10-10 17:41:38 -04:00
parent ecf2f31cb7 9f9ea5e35b
commit fb1429a08c
2 changed files with 94 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
scripts/codex-git-hooks/pre-commit
+13 -2
View File
@@ -36,10 +36,21 @@ scan_added_lines() {
return 0
fi
if hits="$(printf '%s\n' "$added_lines" | rg -n --pcre2 "$regex" 2>/dev/null)"; then
if ! command -v rg >/dev/null 2>&1; then
printf '[ECC pre-commit] ripgrep (rg) is required for secret scanning; install it and ensure it is on PATH when Git runs the hook.\n' >&2
exit 1
fi
if hits="$(printf '%s\n' "$added_lines" | rg -n --pcre2 -- "$regex" 2>/dev/null)"; then
printf '\n[ECC pre-commit] Potential secret detected (%s) in %s\n' "$name" "$file" >&2
printf '%s\n' "$hits" | head -n 3 >&2
has_findings=1
else
local scan_status=$?
if [[ "$scan_status" -ne 1 ]]; then
printf '[ECC pre-commit] Secret scanner failed (rg exit %s) for %s; commit blocked because scanning could not complete.\n' "$scan_status" "$file" >&2
exit 1
fi
fi
}
@@ -56,7 +67,7 @@ while IFS= read -r file; do
scan_added_lines "$file" "GitHub classic token" 'ghp_[A-Za-z0-9]{36}'
scan_added_lines "$file" "GitHub fine-grained token" 'github_pat_[A-Za-z0-9_]{20,}'
scan_added_lines "$file" "AWS access key" 'AKIA[0-9A-Z]{16}'
scan_added_lines "$file" "private key block" '-----BEGIN (RSA|EC|OPENSSH|DSA|PRIVATE) KEY-----'
scan_added_lines "$file" "private key block" '-----BEGIN (RSA |EC |OPENSSH |DSA |ENCRYPTED )?PRIVATE KEY-----'
scan_added_lines "$file" "generic credential assignment" "(?i)\\b(api[_-]?key|secret|password|token)\\b\\s*[:=]\\s*['\\\"][^'\\\"]{12,}['\\\"]"
done <<< "$staged_files"