test: prove DWH credential leak detection

2026-08-21 05:34:49 +02:00
parent 09290a0fe7
commit 6499d24892
3 changed files with 69 additions and 1 deletions
@@ -3,9 +3,18 @@ set -euo pipefail

 repo_root=$(cd "$(dirname "$0")/.." && pwd -P)
 pattern='thtdwh_v1\.[A-Za-z0-9_-]{16}\.[A-Za-z0-9_-]{43}'
+scan_root=$repo_root
+
+if [[ $# -ne 0 ]]; then
+  [[ $# -eq 2 && $1 == --root && $2 == /* && -d $2 && ! -L $2 ]] || {
+    printf '%s\n' 'dwh-auth credential literal scan failed (invalid root)' >&2
+    exit 2
+  }
+  scan_root=$(cd "$2" && pwd -P)
+fi

 set +e
-rg --quiet --hidden --glob '!.git/**' -P -- "$pattern" "$repo_root"
+rg --quiet --hidden --glob '!.git/**' -P -- "$pattern" "$scan_root"
 scan_status=$?
 set -e