20 lines
794 B
Plaintext
20 lines
794 B
Plaintext
|
#!/usr/bin/env bash
|
||
|
|
#
|
||
|
|
# Credentials in the tracked tree.
|
||
|
|
#
|
||
|
|
# `scripts/secrets.sh` runs on the staged diff from the pre-commit hook, which
|
||
|
|
# is the cheap moment. This is the whole-tree version, run as part of verify so
|
||
|
|
# that something looks at what is ALREADY committed rather than only at what is
|
||
|
|
# arriving.
|
||
|
|
#
|
||
|
|
# The distinction earned itself here: the Zoho WebToLead tokens sat in four
|
||
|
|
# commits of a then-public repository for a month, and a staged-diff scan
|
||
|
|
# installed afterwards would never have mentioned them.
|
||
|
|
#
|
||
|
|
# Exit 0 clean, 1 findings, 2 the scanner could not run.
|
||
|
|
set -uo pipefail
|
||
|
|
cd "$(git rev-parse --show-toplevel)" || exit 1
|
||
|
|
|
||
|
|
[ -f scripts/secrets.sh ] || { echo "secrets: scripts/secrets.sh is missing — nothing was scanned." >&2; exit 2; }
|
||
|
|
bash scripts/secrets.sh --tracked
|