BlockchainEngineer
6ff89f26ac
- Remove devnet/validator-keys/*/key and nodes-summary.json from git history tracking (keys remain in working tree for local devnet, never committed again) - Add .pre-commit-secret-scan.sh to block 64+ hex strings from being committed - Update .gitignore to ignore nodes-summary.json and all devnet validator key files Co-Authored-By: Paperclip <noreply@paperclip.ing>
41 lines
1007 B
Bash
Executable File
41 lines
1007 B
Bash
Executable File
#!/usr/bin/env bash
|
|
# .pre-commit-secret-scan.sh — lightweight secret scanner for JCC repo
|
|
# Run this as a pre-commit hook or in CI to prevent private-key leakage.
|
|
# Usage: ./.pre-commit-secret-scan.sh [file-list...]
|
|
|
|
set -euo pipefail
|
|
|
|
EXIT_CODE=0
|
|
|
|
# Patterns that indicate high-confidence secrets
|
|
PATTERNS=(
|
|
# 64+ hex digits on a line (private key, seed)
|
|
'[0-9a-fA-F]{64,}'
|
|
)
|
|
|
|
FILES="${@:-$(git diff --cached --name-only --diff-filter=ACM)}"
|
|
|
|
for file in $FILES; do
|
|
# Skip binary files
|
|
if file "$file" | grep -q 'binary'; then
|
|
continue
|
|
fi
|
|
# Skip files in allowed directories (documentation only)
|
|
case "$file" in
|
|
docs/*|README*|*.md)
|
|
continue
|
|
;;
|
|
esac
|
|
# Check for hex private key pattern
|
|
if grep -nEi '[0-9a-f]{64,}' "$file" 2>/dev/null; then
|
|
echo "ERROR: Potential secret detected in $file (64+ hex string)."
|
|
EXIT_CODE=1
|
|
fi
|
|
done
|
|
|
|
if [ "$EXIT_CODE" -ne 0 ]; then
|
|
echo "Commit blocked. Remove secrets or add to .gitignore if safe."
|
|
fi
|
|
|
|
exit "$EXIT_CODE"
|