Skip to content

Commit 18e60a0

Browse files
saptarshimandal1saptarshimandal1
authored
Merge pull request #546 from NHSDigital/APM-6189
Enabling secret scanning
2 parents 261dcf4 + 5496de4 commit 18e60a0

File tree

5 files changed

+183
-0
lines changed

5 files changed

+183
-0
lines changed

‎.github/actions/scan-secrets/action.yaml‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
name: "Scan secrets"
2+
description: "Scan secrets"
3+
runs:
4+
using: "composite"
5+
steps:
6+
- name: "Scan secrets"
7+
shell: bash
8+
run: |
9+
# Please do not change this `check=whole-history` setting, as new patterns may be added or history may be rewritten.
10+
check=whole-history ./scripts/githooks/scan-secrets.sh

‎.gitleaksignore‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
# SEE: https://github.com/gitleaks/gitleaks/blob/master/README.md#gitleaksignore
2+
3+
cd9c0efec38c5d63053dd865e5d4e207c0760d91:docs/guides/Perform_static_analysis.md:generic-api-key:37

‎scripts/config/gitleaks.toml‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
# SEE: https://github.com/gitleaks/gitleaks/#configuration
2+
3+
[extend]
4+
useDefault = true # SEE: https://github.com/gitleaks/gitleaks/blob/master/config/gitleaks.toml
5+
6+
[[rules]]
7+
description = "IPv4"
8+
id = "ipv4"
9+
regex = '''[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}'''
10+
11+
[rules.allowlist]
12+
regexTarget = "match"
13+
regexes = [
14+
# Exclude the private network IPv4 addresses as well as the DNS servers for Google and OpenDNS
15+
'''(127\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}|10\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}|172\.(1[6-9]|2[0-9]|3[0-1])\.[0-9]{1,3}\.[0-9]{1,3}|192\.168\.[0-9]{1,3}\.[0-9]{1,3}|0\.0\.0\.0|255\.255\.255\.255|8\.8\.8\.8|8\.8\.4\.4|208\.67\.222\.222|208\.67\.220\.220)''',
16+
]
17+
18+
[allowlist]
19+
paths = ['''.terraform.lock.hcl''', '''poetry.lock''', '''yarn.lock''']

‎scripts/config/pre-commit.yaml‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
repos:
2+
- repo: local
3+
hooks:
4+
- id: scan-secrets
5+
name: Scan secrets
6+
entry: ./scripts/githooks/scan-secrets.sh
7+
args: ["check=staged-changes"]
8+
language: script
9+
pass_filenames: false
10+
- repo: local
11+
hooks:
12+
- id: check-file-format
13+
name: Check file format
14+
entry: ./scripts/githooks/check-file-format.sh
15+
args: ["check=staged-changes"]
16+
language: script
17+
pass_filenames: false
18+
- repo: local
19+
hooks:
20+
- id: check-markdown-format
21+
name: Check Markdown format
22+
entry: ./scripts/githooks/check-markdown-format.sh
23+
args: ["check=staged-changes"]
24+
language: script
25+
pass_filenames: false
26+
- repo: local
27+
hooks:
28+
- id: check-english-usage
29+
name: Check English usage
30+
entry: ./scripts/githooks/check-english-usage.sh
31+
args: ["check=staged-changes"]
32+
language: script
33+
pass_filenames: false
34+
- repo: local
35+
hooks:
36+
- id: lint-terraform
37+
name: Lint Terraform
38+
entry: ./scripts/githooks/check-terraform-format.sh
39+
language: script
40+
pass_filenames: false

‎scripts/githooks/scan-secrets.sh‎

Lines changed: 111 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,111 @@
1+
#!/bin/bash
2+
3+
# WARNING: Please, DO NOT edit this file! It is maintained in the Repository Template (https://github.com/nhs-england-tools/repository-template). Raise a PR instead.
4+
5+
set -euo pipefail
6+
7+
# Pre-commit git hook to scan for secrets hard-coded in the codebase. This is a
8+
# gitleaks command wrapper. It will run gitleaks natively if it is installed,
9+
# otherwise it will run it in a Docker container.
10+
#
11+
# Usage:
12+
# $ [options] ./scan-secrets.sh
13+
#
14+
# Options:
15+
# check={whole-history,last-commit,staged-changes} # Type of the check to run, default is 'staged-changes'
16+
# FORCE_USE_DOCKER=true # If set to true the command is run in a Docker container, default is 'false'
17+
# VERBOSE=true # Show all the executed commands, default is 'false'
18+
#
19+
# Exit codes:
20+
# 0 - No leaks present
21+
# 1 - Leaks or error encountered
22+
# 126 - Unknown flag
23+
24+
# ==============================================================================
25+
26+
function main() {
27+
28+
cd "$(git rev-parse --show-toplevel)"
29+
30+
if command -v gitleaks > /dev/null 2>&1 && ! is-arg-true "${FORCE_USE_DOCKER:-false}"; then
31+
dir="$PWD"
32+
cmd="$(get-cmd-to-run)" run-gitleaks-natively
33+
else
34+
dir="/workdir"
35+
cmd="$(get-cmd-to-run)" run-gitleaks-in-docker
36+
fi
37+
}
38+
39+
# Get Gitleaks command to execute and configuration.
40+
# Arguments (provided as environment variables):
41+
# dir=[project's top-level directory]
42+
function get-cmd-to-run() {
43+
44+
check=${check:-staged-changes}
45+
case $check in
46+
"whole-history")
47+
cmd="detect --source $dir --verbose --redact"
48+
;;
49+
"last-commit")
50+
cmd="detect --source $dir --verbose --redact --log-opts -1"
51+
;;
52+
"staged-changes")
53+
cmd="protect --source $dir --verbose --staged"
54+
;;
55+
esac
56+
# Include base line file if it exists
57+
if [ -f "$dir/scripts/config/.gitleaks-baseline.json" ]; then
58+
cmd="$cmd --baseline-path $dir/scripts/config/.gitleaks-baseline.json"
59+
fi
60+
# Include the config file
61+
cmd="$cmd --config $dir/scripts/config/gitleaks.toml"
62+
63+
echo "$cmd"
64+
}
65+
66+
# Run Gitleaks natively.
67+
# Arguments (provided as environment variables):
68+
# cmd=[command to run]
69+
function run-gitleaks-natively() {
70+
71+
# shellcheck disable=SC2086
72+
gitleaks $cmd
73+
}
74+
75+
# Run Gitleaks in a Docker container.
76+
# Arguments (provided as environment variables):
77+
# cmd=[command to run]
78+
# dir=[directory to mount as a volume]
79+
function run-gitleaks-in-docker() {
80+
81+
# shellcheck disable=SC1091
82+
source ./scripts/docker/docker.lib.sh
83+
84+
# shellcheck disable=SC2155
85+
local image=$(name=ghcr.io/gitleaks/gitleaks docker-get-image-version-and-pull)
86+
# shellcheck disable=SC2086
87+
docker run --rm --platform linux/amd64 \
88+
--volume "$PWD:$dir" \
89+
--workdir $dir \
90+
"$image" \
91+
$cmd
92+
}
93+
94+
# ==============================================================================
95+
96+
function is-arg-true() {
97+
98+
if [[ "$1" =~ ^(true|yes|y|on|1|TRUE|YES|Y|ON)$ ]]; then
99+
return 0
100+
else
101+
return 1
102+
fi
103+
}
104+
105+
# ==============================================================================
106+
107+
is-arg-true "${VERBOSE:-false}" && set -x
108+
109+
main "$@"
110+
111+
exit 0

0 commit comments

Comments
 (0)