34 lines
801 B
Bash
Executable File
34 lines
801 B
Bash
Executable File
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
|
|
repo_root=$(cd "$(dirname "$0")/.." && pwd -P)
|
|
pattern='thtdwh_v1\.[A-Za-z0-9_-]{16}\.[A-Za-z0-9_-]{43}'
|
|
scan_root=$repo_root
|
|
|
|
if [[ $# -ne 0 ]]; then
|
|
[[ $# -eq 2 && $1 == --root && $2 == /* && -d $2 && ! -L $2 ]] || {
|
|
printf '%s\n' 'dwh-auth credential literal scan failed (invalid root)' >&2
|
|
exit 2
|
|
}
|
|
scan_root=$(cd "$2" && pwd -P)
|
|
fi
|
|
|
|
set +e
|
|
rg --quiet --hidden --glob '!.git/**' -P -- "$pattern" "$scan_root"
|
|
scan_status=$?
|
|
set -e
|
|
|
|
case "$scan_status" in
|
|
0)
|
|
printf '%s\n' 'dwh-auth credential literal scan failed' >&2
|
|
exit 1
|
|
;;
|
|
1)
|
|
printf '%s\n' 'dwh-auth credential literal scan passed'
|
|
;;
|
|
*)
|
|
printf '%s\n' "dwh-auth credential literal scan failed (rg status $scan_status)" >&2
|
|
exit "$scan_status"
|
|
;;
|
|
esac
|