check-secrets.sh

scripts/check-secrets.sh

1. #!/usr/bin/env bash
2. # Nothing that looks like a real credential is committed. Keys live in the
3. # OS keychain; tests use the stand-in and fake keys ("good-key", "bad-key").
4. set -euo pipefail
5. cd "$(dirname "$0")/.."
6. patterns=(
7. 'sk-[A-Za-z0-9_-]{20,}'
8. 'hf_[A-Za-z0-9]{30,}'
9. 'ghp_[A-Za-z0-9]{30,}'
10. 'github_pat_[A-Za-z0-9_]{40,}'
11. 'AKIA[0-9A-Z]{16}'
12. '-----BEGIN [A-Z ]*PRIVATE KEY-----'
13. '[Bb]earer [A-Za-z0-9._-]{32,}'
14. )
15. hit=0
16. for p in "${patterns[@]}"; do
17. if git ls-files -z | grep -zv 'package-lock.json\|Cargo.lock' | xargs -0 grep -nIE -e "$p" -- 2>/dev/null; then hit=1; fi
18. done
19. if git ls-files | grep -E '(^|/)\.env($|\.)' ; then hit=1; fi
20. [ "$hit" = 0 ] && echo "no secrets" || { echo "Possible secrets above." >&2; exit 1; }