PTah
48 lines
1.5 KiB
PowerShell
48 lines
1.5 KiB
PowerShell
# Fail if tracked text still contains production-only markers (run before GitHub push).
|
|
$ErrorActionPreference = 'Stop'
|
|
$Root = Split-Path -Parent $PSScriptRoot
|
|
Set-Location $Root
|
|
|
|
$patterns = @(
|
|
'8239219522',
|
|
'sac_UkOsAT',
|
|
'2843230',
|
|
'sac\.kalinamall\.ru',
|
|
'\\\\b26\\',
|
|
'K6A-DC3',
|
|
'fifth\.kalinamall',
|
|
'192\.168\.160\.57',
|
|
'kalinamall\.ru',
|
|
'git\.kalinamall\.ru',
|
|
'git\.papatramp\.ru',
|
|
'\d{8,12}:[A-Za-z0-9_-]{20,}'
|
|
)
|
|
|
|
$extensions = @('*.md', '*.ps1', '*.example', '*.txt', '*.json', '*.yml', '*.yaml')
|
|
$files = git ls-files $extensions 2>$null | Where-Object { $_ -and (Test-Path $_) }
|
|
|
|
$hits = @()
|
|
foreach ($file in $files) {
|
|
if ($file -like 'scripts/Rewrite-GitHostUrls.ps1') { continue }
|
|
if ($file -like 'scripts/Push-PrivateMirror.ps1') { continue }
|
|
if ($file -like 'scripts/Sanitize-ForGitHub.ps1') { continue }
|
|
if ($file -like 'scripts/Test-NoSecretsForGitHub.ps1') { continue }
|
|
if ($file -like 'scripts/Push-GitHubMirror.ps1') { continue }
|
|
if ($file -like 'scripts/Push-Mirror.ps1') { continue }
|
|
|
|
$text = Get-Content -LiteralPath $file -Raw -ErrorAction SilentlyContinue
|
|
if ([string]::IsNullOrEmpty($text)) { continue }
|
|
|
|
foreach ($pat in $patterns) {
|
|
if ($text -match $pat) {
|
|
$hits += "${file}: matches /$pat/"
|
|
}
|
|
}
|
|
}
|
|
|
|
if ($hits.Count -gt 0) {
|
|
Write-Error ("GitHub secret scan failed:`n" + ($hits -join "`n"))
|
|
}
|
|
|
|
Write-Output "GitHub secret scan: OK ($($files.Count) files)"
|