cf9443753e
Package the portable DSH profiles, local plugins, desktop integration, Firefox wrapper, and ownership-aware installer lifecycle. Bundle checksum-pinned OpenVSCode, editor extensions, translation assets, and cloudflared so unreliable upstream artifact downloads cannot break a clean installation.
27 lines
883 B
Bash
Executable file
27 lines
883 B
Bash
Executable file
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
|
|
repository_directory=$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")/.." && pwd)
|
|
cd "$repository_directory"
|
|
mapfile -t files < <(git ls-files --cached --others --exclude-standard)
|
|
|
|
for file in "${files[@]}"; do
|
|
case "$(basename "$file")" in
|
|
auth.json|.credentials.yaml*|logins.json|key4.db|cookies.sqlite)
|
|
printf 'Forbidden credential file found: %s\n' "$file" >&2
|
|
exit 1
|
|
;;
|
|
esac
|
|
done
|
|
|
|
if ((${#files[@]})) && grep -IE --binary-files=without-match '"(accessToken|refreshToken|idToken|apiKey|clientSecret)"[[:space:]]*:' "${files[@]}"; then
|
|
printf 'Possible credential field found.\n' >&2
|
|
exit 1
|
|
fi
|
|
|
|
if ((${#files[@]})) && grep -IE --binary-files=without-match '(ghp_[A-Za-z0-9]{30,}|sk-[A-Za-z0-9_-]{20,})' "${files[@]}"; then
|
|
printf 'Possible token found.\n' >&2
|
|
exit 1
|
|
fi
|
|
|
|
printf 'repository secret scan passed\n'
|