Skip to content
This repository has been archived by the owner on Nov 4, 2024. It is now read-only.

Commit

Permalink
Merge pull request #36 from galasa-dev/issue-1884-detect-secrets
Browse files Browse the repository at this point in the history
added .pre-commit-config.yaml file to trigger detect-secrets
  • Loading branch information
KirbyKatcher authored Jun 6, 2024
2 parents 67642dc + 36fdb28 commit f9f2525
Show file tree
Hide file tree
Showing 3 changed files with 126 additions and 1 deletion.
6 changes: 6 additions & 0 deletions .pre-commit-config.yaml
Original file line number Diff line number Diff line change
@@ -0,0 +1,6 @@
repos:
- repo: https://github.com/ibm/detect-secrets
rev: 0.13.1+ibm.62.dss
hooks:
- id: detect-secrets # pragma: whitelist secret
args: [--baseline, .secrets.baseline, --use-all-plugins, --fail-on-unaudited]
84 changes: 84 additions & 0 deletions .secrets.baseline
Original file line number Diff line number Diff line change
@@ -0,0 +1,84 @@
{
"exclude": {
"files": "^.secrets.baseline$",
"lines": null
},
"plugins_used": [
{
"name": "AWSKeyDetector"
},
{
"name": "ArtifactoryDetector"
},
{
"name": "AzureStorageKeyDetector"
},
{
"base64_limit": 4.5,
"name": "Base64HighEntropyString"
},
{
"name": "BasicAuthDetector"
},
{
"name": "BoxDetector"
},
{
"name": "CloudantDetector"
},
{
"ghe_instance": "github.ibm.com",
"name": "GheDetector"
},
{
"name": "GitHubTokenDetector"
},
{
"hex_limit": 3,
"name": "HexHighEntropyString"
},
{
"name": "IbmCloudIamDetector"
},
{
"name": "IbmCosHmacDetector"
},
{
"name": "JwtTokenDetector"
},
{
"keyword_exclude": null,
"name": "KeywordDetector"
},
{
"name": "MailchimpDetector"
},
{
"name": "NpmDetector"
},
{
"name": "PrivateKeyDetector"
},
{
"name": "SlackDetector"
},
{
"name": "SoftlayerDetector"
},
{
"name": "SquareOAuthDetector"
},
{
"name": "StripeDetector"
},
{
"name": "TwilioKeyDetector"
}
],
"results": {},
"version": "0.13.1+ibm.62.dss",
"word_list": {
"file": null,
"hash": null
}
}
37 changes: 36 additions & 1 deletion build-locally.sh
Original file line number Diff line number Diff line change
Expand Up @@ -118,6 +118,39 @@ CONSOLE_FLAG=--console=plain
log_file=${LOGS_DIR}/${project}.txt
info "Log will be placed at ${log_file}"

function check_exit_code () {
# This function takes 2 parameters in the form:
# $1 an integer value of the returned exit code
# $2 an error message to display if $1 is not equal to 0
if [[ "$1" != "0" ]]; then
error "$2"
exit 1
fi
}

function check_secrets {
h2 "updating secrets baseline"
cd ${BASEDIR}
detect-secrets scan --update .secrets.baseline
rc=$?
check_exit_code $rc "Failed to run detect-secrets. Please check it is installed properly"
success "updated secrets file"

h2 "running audit for secrets"
detect-secrets audit .secrets.baseline
rc=$?
check_exit_code $rc "Failed to audit detect-secrets."

#Check all secrets have been audited
secrets=$(grep -c hashed_secret .secrets.baseline)
audits=$(grep -c is_secret .secrets.baseline)
if [[ "$secrets" != "$audits" ]]; then
error "Not all secrets found have been audited"
exit 1
fi
sed -i '' '/[ ]*"generated_at": ".*",/d' .secrets.baseline
success "secrets audit complete"
}

function build_gradle_plugin() {
h1 "Building ${project}"
Expand Down Expand Up @@ -158,4 +191,6 @@ function clean_up_m2 {

clean_up_m2

build_gradle_plugin
build_gradle_plugin

check_secrets

0 comments on commit f9f2525

Please sign in to comment.