@smbcloud / pepakbasajawa-web
Code Commits Issues Pulls Cloud Agent CI/CD
development
copilot/add-i18n-support-for-english dependabot/npm_and_yarn/astro-5.16.4 dependabot/npm_and_yarn/katex-0.16.27 dependabot/npm_and_yarn/prettier-3.7.4 dependabot/npm_and_yarn/tailwindcss-4.1.16 dependabot/npm_and_yarn/tailwindcss/vite-4.1.16 dependabot/npm_and_yarn/typescript-eslint-8.46.2 dependabot/npm_and_yarn/typescript-eslint/parser-8.46.2 development main
example 109 lines 4.41 KB
Raw
1 #!/bin/sh
2 #
3 # Pre-commit hook to prevent accidental credential leaks
4 #
5 # To enable this hook:
6 # 1. Copy this file: cp .githooks/pre-commit.example .git/hooks/pre-commit
7 # 2. Make it executable: chmod +x .git/hooks/pre-commit
8 #
9 # Or configure git to use this hooks directory:
10 # git config core.hooksPath .githooks
11 # chmod +x .githooks/pre-commit.example
12 # mv .githooks/pre-commit.example .githooks/pre-commit
13
14 echo "🔒 Running security checks..."
15
16 # Colors for output
17 RED='\033[0;31m'
18 YELLOW='\033[1;33m'
19 GREEN='\033[0;32m'
20 NC='\033[0m' # No Color
21
22 # Flag to track if we found issues
23 FOUND_ISSUES=0
24
25 # Check 1: Prevent committing .env files
26 echo "Checking for .env files..."
27 if git diff --cached --name-only | grep -E "^\.env$|^\.env\..*$" > /dev/null; then
28 echo "${RED}❌ ERROR: Attempting to commit .env file!${NC}"
29 echo "${YELLOW} .env files should never be committed to the repository.${NC}"
30 echo "${YELLOW} Add them to .gitignore instead.${NC}"
31 FOUND_ISSUES=1
32 fi
33
34 # Check 2: Look for GitHub token patterns
35 echo "Checking for GitHub tokens..."
36 if git diff --cached | grep -E "ghp_[a-zA-Z0-9]{36}|github_pat_[a-zA-Z0-9]{22}_[a-zA-Z0-9]{59}" > /dev/null; then
37 echo "${RED}❌ ERROR: Possible GitHub token detected in commit!${NC}"
38 echo "${YELLOW} Found pattern matching GitHub personal access token.${NC}"
39 echo "${YELLOW} Make sure you're not committing actual tokens.${NC}"
40 echo "${YELLOW} Use placeholders like 'ghp_your_token_here' instead.${NC}"
41 FOUND_ISSUES=1
42 fi
43
44 # Check 3: Look for common secret patterns
45 echo "Checking for other credentials..."
46 if git diff --cached | grep -E "sk_live_[a-zA-Z0-9]{24,}|pk_live_[a-zA-Z0-9]{24,}|sk_test_[a-zA-Z0-9]{24,}" > /dev/null; then
47 echo "${RED}❌ ERROR: Possible API key detected in commit!${NC}"
48 echo "${YELLOW} Found pattern matching Stripe or other API keys.${NC}"
49 echo "${YELLOW} Never commit actual API keys to the repository.${NC}"
50 FOUND_ISSUES=1
51 fi
52
53 # Check 4: Look for AWS credentials
54 echo "Checking for AWS credentials..."
55 if git diff --cached | grep -E "AKIA[0-9A-Z]{16}|aws_access_key_id|aws_secret_access_key" > /dev/null; then
56 echo "${RED}❌ ERROR: Possible AWS credentials detected!${NC}"
57 echo "${YELLOW} Never commit AWS credentials to the repository.${NC}"
58 FOUND_ISSUES=1
59 fi
60
61 # Check 5: Look for private keys
62 echo "Checking for private keys..."
63 if git diff --cached | grep -E "BEGIN (RSA|DSA|EC|OPENSSH) PRIVATE KEY" > /dev/null; then
64 echo "${RED}❌ ERROR: Private key detected in commit!${NC}"
65 echo "${YELLOW} Never commit private keys to the repository.${NC}"
66 FOUND_ISSUES=1
67 fi
68
69 # Check 6: Look for hardcoded passwords
70 echo "Checking for hardcoded passwords..."
71 if git diff --cached | grep -E "password\s*=\s*['\"][^'\"]{8,}['\"]|PASSWORD\s*=\s*['\"][^'\"]{8,}['\"]" > /dev/null; then
72 echo "${YELLOW}⚠️ WARNING: Possible hardcoded password detected!${NC}"
73 echo "${YELLOW} Review your commit to ensure no actual passwords are included.${NC}"
74 echo "${YELLOW} Use environment variables for sensitive data.${NC}"
75 # Don't block commit, just warn
76 fi
77
78 # Check 7: Verify .gitignore includes .env
79 echo "Verifying .gitignore configuration..."
80 if [ -f .gitignore ]; then
81 if ! grep -q "^\.env" .gitignore; then
82 echo "${YELLOW}⚠️ WARNING: .env not found in .gitignore${NC}"
83 echo "${YELLOW} Consider adding .env files to .gitignore${NC}"
84 fi
85 else
86 echo "${YELLOW}⚠️ WARNING: No .gitignore file found${NC}"
87 fi
88
89 # Final result
90 if [ $FOUND_ISSUES -eq 1 ]; then
91 echo ""
92 echo "${RED}━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━${NC}"
93 echo "${RED}❌ COMMIT BLOCKED: Security issues detected!${NC}"
94 echo "${RED}━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━${NC}"
95 echo ""
96 echo "${YELLOW}What to do:${NC}"
97 echo " 1. Remove sensitive data from your staged files"
98 echo " 2. Use environment variables instead: import.meta.env.GITHUB_TOKEN"
99 echo " 3. Use placeholders in documentation: ghp_your_token_here"
100 echo " 4. Add .env files to .gitignore"
101 echo ""
102 echo "${YELLOW}To bypass this hook (NOT RECOMMENDED):${NC}"
103 echo " git commit --no-verify"
104 echo ""
105 exit 1
106 fi
107
108 echo "${GREEN}✅ All security checks passed!${NC}"
109 exit 0