34 lines
869 B
Bash
34 lines
869 B
Bash
|
#!/usr/bin/env bash
|
||
|
|
set -euo pipefail
|
||
|
|
|
||
|
|
fail=0
|
||
|
|
scan() {
|
||
|
|
local name="$1" pattern="$2"
|
||
|
|
shift 2
|
||
|
|
if git grep -nIE "$pattern" -- "$@"; then
|
||
|
|
echo "::error::Potential $name leak detected" >&2
|
||
|
|
fail=1
|
||
|
|
fi
|
||
|
|
}
|
||
|
|
|
||
|
|
common_excludes=(
|
||
|
|
':!.git'
|
||
|
|
':!node_modules'
|
||
|
|
':!package-lock.json'
|
||
|
|
':!README.md'
|
||
|
|
':!README.en.md'
|
||
|
|
':!CHANGELOG.md'
|
||
|
|
':!scripts/security-scan.sh'
|
||
|
|
':!.github/workflows/ci.yml'
|
||
|
|
)
|
||
|
|
|
||
|
|
scan 'private key' 'BEGIN (RSA |OPENSSH |EC |DSA |)PRIVATE KEY' . "${common_excludes[@]}"
|
||
|
|
scan 'Telegram bot token' '[0-9]{8,}:[A-Za-z0-9_-]{30,}' . "${common_excludes[@]}"
|
||
|
|
scan 'environment secret assignment' '(BOT_TOKEN|CF_API_TOKEN|GITHUB_TOKEN|GH_TOKEN|API_KEY|SECRET|PASSWORD|PASSWD)=([A-Za-z0-9_./+-]{12,})' . "${common_excludes[@]}" ':!.env.example' ':!*.example' ':!servers.example.json'
|
||
|
|
|
||
|
|
if [ "$fail" -ne 0 ]; then
|
||
|
|
exit 1
|
||
|
|
fi
|
||
|
|
|
||
|
|
echo "security scan passed"
|