diff options
| author | William Carroll <wpcarro@gmail.com> | 2020-08-21T17·25+0100 |
|---|---|---|
| committer | William Carroll <wpcarro@gmail.com> | 2020-08-22T22·27+0100 |
| commit | 3f9352b11848a88a677b51f0b42cd66eca5a9122 (patch) | |
| tree | 820e7cab5d5bfd5ace6d682656ae8d68a05d5db3 | |
| parent | 92fa785e755aa71ffeb7da3c43b201db019112fc (diff) | |
Remove --add-provider step from briefcase lint
So it turns out that I was wrong and that .git/config is stateful. Multiple calls to --add-provider will append the same provider each time... Instead I'm defining secret-patterns.txt and version-controlling it. Then: - dev-side: I'm adding `providers = cat ci/secret-patterns.txt` to .git/config - ci-side: I'm adding `providers = cat ci/secret-patterns.txt` to .git/config Unfortunately this is ad-hoc configuration ci-side, which I would like to avoid. The good news is that my pre-commit hooks and failures from git-secrets should now align with my CI, since they're both reading from secret-patterns.txt. One step backwards... two steps forwards?
| -rw-r--r-- | ci/pipelines/briefcase.nix | 19 | ||||
| -rw-r--r-- | ci/secret-patterns.txt | 9 |
2 files changed, 10 insertions, 18 deletions
diff --git a/ci/pipelines/briefcase.nix b/ci/pipelines/briefcase.nix index 03ede2b9c72a..b01e9f93cb9f 100644 --- a/ci/pipelines/briefcase.nix +++ b/ci/pipelines/briefcase.nix @@ -3,24 +3,7 @@ let pipeline.steps = [ { - command = let - # Regexes to detect sensitive information - patterns = pkgs.writeText "secrets.txt" '' - (A3T[A-Z0-9]|AKIA|AGPA|AIDA|AROA|AIPA|ANPA|ANVA|ASIA)[A-Z0-9]{16} - ("|')?(AWS|aws|Aws)?_?(SECRET|secret|Secret)?_?(ACCESS|access|Access)?_?(KEY|key|Key)("|')?\s*(:|=>|=)\s*("|')?[A-Za-z0-9/\+=]{40}("|')? - ("|')?(AWS|aws|Aws)?_?(ACCOUNT|account|Account)_?(ID|id|Id)?("|')?\s*(:|=>|=)\s*("|')?[0-9]{4}\-?[0-9]{4}\-?[0-9]{4}("|')? - AIza[0-9A-Za-z_-]{35} - [0-9]+-[0-9A-Za-z_]{32}\.apps\.googleusercontent\.com - (^|[^0-9A-Za-z/+])1/[0-9A-Za-z_-]{43} - (^|[^0-9A-Za-z/+])1/[0-9A-Za-z_-]{64} - ya29\.[0-9A-Za-z_-]+ - (sk|pk)_(test|live)_[a-zA-Z0-9]{99} - ''; - in '' - cat .git/config - ${pkgs.git-secrets}/bin/git-secrets --add-provider -- cat ${patterns} - ${pkgs.git-secrets}/bin/git-secrets --scan-history - ''; + command = "${pkgs.git-secrets}/bin/git-secrets --scan-history"; label = ":broom: lint"; } { diff --git a/ci/secret-patterns.txt b/ci/secret-patterns.txt new file mode 100644 index 000000000000..cbf58a1e744b --- /dev/null +++ b/ci/secret-patterns.txt @@ -0,0 +1,9 @@ +(A3T[A-Z0-9]|AKIA|AGPA|AIDA|AROA|AIPA|ANPA|ANVA|ASIA)[A-Z0-9]{16} +("|')?(AWS|aws|Aws)?_?(SECRET|secret|Secret)?_?(ACCESS|access|Access)?_?(KEY|key|Key)("|')?\s*(:|=>|=)\s*("|')?[A-Za-z0-9/\+=]{40}("|')? +("|')?(AWS|aws|Aws)?_?(ACCOUNT|account|Account)_?(ID|id|Id)?("|')?\s*(:|=>|=)\s*("|')?[0-9]{4}\-?[0-9]{4}\-?[0-9]{4}("|')? +AIza[0-9A-Za-z_-]{35} +[0-9]+-[0-9A-Za-z_]{32}\.apps\.googleusercontent\.com +(^|[^0-9A-Za-z/+])1/[0-9A-Za-z_-]{43} +(^|[^0-9A-Za-z/+])1/[0-9A-Za-z_-]{64} +ya29\.[0-9A-Za-z_-]+ +(sk|pk)_(test|live)_[a-zA-Z0-9]{99} |