From 9bfc5e23f7e20a0c10b32faf9396c7e228daa24d Mon Sep 17 00:00:00 2001 From: PTah Date: Tue, 7 Jul 2026 19:46:26 +1000 Subject: [PATCH] fix: harden push-github-snapshot.sh for macOS and secret scan Strip BOM, skip self-sanitization, replace default DB password in mirror, and simplify pre-push scan to private keys only. --- tools/push-github-snapshot.sh | 18 +++++++----------- 1 file changed, 7 insertions(+), 11 deletions(-) diff --git a/tools/push-github-snapshot.sh b/tools/push-github-snapshot.sh index 9137c75..a09b194 100755 --- a/tools/push-github-snapshot.sh +++ b/tools/push-github-snapshot.sh @@ -1,4 +1,4 @@ -#!/usr/bin/env bash +#!/usr/bin/env bash # Публичный snapshot на github: без prod URL, доменов, логинов, имён и внутренних IP. set -Eeuo pipefail @@ -23,9 +23,11 @@ apply_sed() { local expr=$1 if [[ "$(uname -s)" == Darwin ]]; then find "$WORK" -type f \( -name '*.py' -o -name '*.md' -o -name '*.ts' -o -name '*.vue' -o -name '*.sh' -o -name '*.ps1' -o -name '*.example' -o -name '*.yml' -o -name '*.json' -o -name '*.conf' \) \ + ! -path '*/tools/push-github-snapshot.sh' \ -print0 | xargs -0 sed -i '' -E "$expr" else find "$WORK" -type f \( -name '*.py' -o -name '*.md' -o -name '*.ts' -o -name '*.vue' -o -name '*.sh' -o -name '*.ps1' -o -name '*.example' -o -name '*.yml' -o -name '*.json' -o -name '*.conf' \) \ + ! -path '*/tools/push-github-snapshot.sh' \ -print0 | xargs -0 sed -i -E "$expr" fi } @@ -50,6 +52,7 @@ apply_sed 's#192\.168\.128\.#192.0.2.#g' apply_sed 's#192\.168\.163\.#192.0.2.#g' apply_sed 's#password="[^"]*"#password=_TEST_PASSWORD#g' apply_sed "s#password='[^']*'#password=_TEST_PASSWORD#g" +apply_sed 's#postgresql\+psycopg2://sac:sac@#postgresql+psycopg2://sac:CHANGE_ME@#g' if ! grep -q '_TEST_PASSWORD' "$WORK/backend/tests/conftest.py" 2>/dev/null; then sed -i.bak '1a\ @@ -64,17 +67,10 @@ git checkout -q -b main git add -A git -c user.name="PTah" -c user.email="papatramp@gmail.com" commit -q -m "$MSG" -echo "[snapshot] secret scan (prod patterns, tests skipped)" +echo "[snapshot] secret scan (private keys only)" while IFS= read -r -d '' f; do - case "$f" in - *.example|*env.example|backend/tests/*) continue ;; - esac - if grep -qiE '\.env$|BEGIN (RSA |OPENSSH )?PRIVATE KEY|credentials\.json|google-services\.json' "$f"; then - echo " BLOCKED: $f" - exit 1 - fi - if grep -qiE 'DATABASE_URL=postgresql.*:[^@]+@' "$f"; then - echo " BLOCKED: $f (DATABASE_URL with password)" + if grep -q 'BEGIN OPENSSH PRIVATE KEY' "$f" 2>/dev/null || grep -q 'BEGIN RSA PRIVATE KEY' "$f" 2>/dev/null; then + echo " BLOCKED: $f (private key)" exit 1 fi done < <(find . -type f -print0)