54 lines
2.5 KiB
Bash
54 lines
2.5 KiB
Bash
#!/usr/bin/env bash
|
||
set -euo pipefail
|
||
|
||
BASE="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
|
||
cd "$BASE"
|
||
|
||
mode="${1:---staged}"
|
||
case "$mode" in
|
||
--staged) revision="--cached" ;;
|
||
--worktree) revision="" ;;
|
||
--history) revision="--history" ;;
|
||
*) echo "Usage: $0 [--staged|--worktree|--history]" >&2; exit 2 ;;
|
||
esac
|
||
|
||
sensitive_names='(^|/)(\.env($|\.)|\.envrc$|\.netrc$|\.npmrc$|\.pypirc$|authorized_keys$|known_hosts$|id_(rsa|dsa|ecdsa|ed25519)(\.|$)|credentials([.-].*)?\.json$|service[-_]account.*\.json$|client[-_]secret.*\.json$|terraform\.tfstate|terraform\.tfvars)|\.(pem|key|p8|p12|pfx|jks|keystore|kdbx|age|gpg|sqlite3?|db|tfstate)(\.|$)'
|
||
secret_content='AKIA[0-9A-Z]{16}|ASIA[0-9A-Z]{16}|gh[pousr]_[A-Za-z0-9_]{20,}|github_pat_[A-Za-z0-9_]{20,}|glpat-[A-Za-z0-9_-]{20,}|sk-[A-Za-z0-9_-]{20,}|AIza[0-9A-Za-z_-]{30,}|xox[baprs]-[A-Za-z0-9-]{20,}|tail[0-9a-f]{6,}\.ts\.net|-----BEGIN ([A-Z0-9 ]+ )?PRIVATE KEY-----'
|
||
|
||
tracked_files() {
|
||
if [[ "$mode" == "--staged" ]]; then
|
||
git diff --cached --name-only --diff-filter=ACMR
|
||
elif [[ "$mode" == "--worktree" ]]; then
|
||
git ls-files --cached --others --exclude-standard
|
||
else
|
||
git log --all --pretty=format: --name-only
|
||
fi
|
||
}
|
||
|
||
name_hits="$(tracked_files | sed '/^$/d' | sort -u | grep -E "$sensitive_names" | grep -Ev '(^|/)\.env\.example$' || true)"
|
||
content_hits=""
|
||
if [[ "$mode" == "--history" ]]; then
|
||
while IFS= read -r commit; do
|
||
hits="$(git grep -IlE -e "$secret_content" "$commit" -- . ':!tests/**' ':!scripts/check-secrets.sh' ':!frontend/package-lock.json' 2>/dev/null || true)"
|
||
[[ -z "$hits" ]] || content_hits+="${hits}"$'\n'
|
||
done < <(git rev-list --all)
|
||
else
|
||
grep_args=()
|
||
if [[ "$mode" == "--worktree" ]]; then
|
||
grep_args+=("--untracked" "--exclude-standard")
|
||
elif [[ -n "$revision" ]]; then
|
||
grep_args+=("$revision")
|
||
fi
|
||
content_hits="$(git grep "${grep_args[@]}" -IlE -e "$secret_content" -- . ':!tests/**' ':!scripts/check-secrets.sh' ':!frontend/package-lock.json' 2>/dev/null || true)"
|
||
fi
|
||
|
||
if [[ -n "$name_hits" || -n "$content_hits" ]]; then
|
||
echo "ERREUR: contenu potentiellement confidentiel détecté dans Git." >&2
|
||
[[ -z "$name_hits" ]] || { echo "Fichiers au nom sensible:" >&2; printf '%s\n' "$name_hits" >&2; }
|
||
[[ -z "$content_hits" ]] || { echo "Fichiers au contenu sensible:" >&2; printf '%s\n' "$content_hits" | sort -u >&2; }
|
||
echo "Aucune valeur secrète n’a été affichée. Retirez le fichier de Git et révoquez toute clé réellement exposée." >&2
|
||
exit 1
|
||
fi
|
||
|
||
echo "Contrôle des secrets réussi (${mode#--})."
|