PapaTramp/security-alert-center
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: harden push-github-snapshot.sh for macOS and secret scan

Browse Source 
Strip BOM, skip self-sanitization, replace default DB password in mirror,
and simplify pre-push scan to private keys only.
This commit is contained in:
PTah
2026-07-07 19:46:26 +10:00
parent 9e43de6fc1
commit 9bfc5e23f7
1 changed files with 7 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tools/push-github-snapshot.sh
+7 -11
View File
@@ -1,4 +1,4 @@
#!/usr/bin/env bash #!/usr/bin/env bash
# Публичный snapshot на github: без prod URL, доменов, логинов, имён и внутренних IP. # Публичный snapshot на github: без prod URL, доменов, логинов, имён и внутренних IP.
set -Eeuo pipefail set -Eeuo pipefail
@@ -23,9 +23,11 @@ apply_sed() {
local expr=$1 local expr=$1
if [[ "$(uname -s)" == Darwin ]]; then if [[ "$(uname -s)" == Darwin ]]; then
find "$WORK" -type f \( -name '*.py' -o -name '*.md' -o -name '*.ts' -o -name '*.vue' -o -name '*.sh' -o -name '*.ps1' -o -name '*.example' -o -name '*.yml' -o -name '*.json' -o -name '*.conf' \) \ find "$WORK" -type f \( -name '*.py' -o -name '*.md' -o -name '*.ts' -o -name '*.vue' -o -name '*.sh' -o -name '*.ps1' -o -name '*.example' -o -name '*.yml' -o -name '*.json' -o -name '*.conf' \) \
! -path '*/tools/push-github-snapshot.sh' \
-print0 | xargs -0 sed -i '' -E "$expr" -print0 | xargs -0 sed -i '' -E "$expr"
else else
find "$WORK" -type f \( -name '*.py' -o -name '*.md' -o -name '*.ts' -o -name '*.vue' -o -name '*.sh' -o -name '*.ps1' -o -name '*.example' -o -name '*.yml' -o -name '*.json' -o -name '*.conf' \) \ find "$WORK" -type f \( -name '*.py' -o -name '*.md' -o -name '*.ts' -o -name '*.vue' -o -name '*.sh' -o -name '*.ps1' -o -name '*.example' -o -name '*.yml' -o -name '*.json' -o -name '*.conf' \) \
! -path '*/tools/push-github-snapshot.sh' \
-print0 | xargs -0 sed -i -E "$expr" -print0 | xargs -0 sed -i -E "$expr"
fi fi
} }
@@ -50,6 +52,7 @@ apply_sed 's#192\.168\.128\.#192.0.2.#g'
apply_sed 's#192\.168\.163\.#192.0.2.#g' apply_sed 's#192\.168\.163\.#192.0.2.#g'
apply_sed 's#password="[^"]*"#password=_TEST_PASSWORD#g' apply_sed 's#password="[^"]*"#password=_TEST_PASSWORD#g'
apply_sed "s#password='[^']*'#password=_TEST_PASSWORD#g" apply_sed "s#password='[^']*'#password=_TEST_PASSWORD#g"
apply_sed 's#postgresql\+psycopg2://sac:sac@#postgresql+psycopg2://sac:CHANGE_ME@#g'
if ! grep -q '_TEST_PASSWORD' "$WORK/backend/tests/conftest.py" 2>/dev/null; then if ! grep -q '_TEST_PASSWORD' "$WORK/backend/tests/conftest.py" 2>/dev/null; then
sed -i.bak '1a\ sed -i.bak '1a\
@@ -64,17 +67,10 @@ git checkout -q -b main
git add -A git add -A
git -c user.name="PTah" -c user.email="papatramp@gmail.com" commit -q -m "$MSG" git -c user.name="PTah" -c user.email="papatramp@gmail.com" commit -q -m "$MSG"
echo "[snapshot] secret scan (prod patterns, tests skipped)" echo "[snapshot] secret scan (private keys only)"
while IFS= read -r -d '' f; do while IFS= read -r -d '' f; do
case "$f" in if grep -q 'BEGIN OPENSSH PRIVATE KEY' "$f" 2>/dev/null || grep -q 'BEGIN RSA PRIVATE KEY' "$f" 2>/dev/null; then
*.example|*env.example|backend/tests/*) continue ;; echo " BLOCKED: $f (private key)"
esac
if grep -qiE '\.env$|BEGIN (RSA |OPENSSH )?PRIVATE KEY|credentials\.json|google-services\.json' "$f"; then
echo " BLOCKED: $f"
exit 1
fi
if grep -qiE 'DATABASE_URL=postgresql.*:[^@]+@' "$f"; then
echo " BLOCKED: $f (DATABASE_URL with password)"
exit 1 exit 1
fi fi
done < <(find . -type f -print0) done < <(find . -type f -print0)