spb/sp-calendar

1import { execSync } from "node:child_process";2import { readFileSync } from "node:fs";34/** Fails if a tracked (or about-to-be-tracked) file looks like it contains a credential. */5const files = execSync("git ls-files --cached --others --exclude-standard", { encoding: "utf8" }).split("\n").filter(Boolean);6const patterns: [string, RegExp][] = [7  ["Resend key", /\bre_[A-Za-z0-9_]{20,}\b/],8  ["private key", /-----BEGIN (?:RSA |EC |OPENSSH )?PRIVATE KEY-----/],9  ["postgres URL with password", /postgres(?:ql)?:\/\/[^:\s/]+:(?!CHANGE_ME|password\b)[^@\s]{6,}@/],10  ["APP_SECRET value", /^APP_SECRET=[A-Za-z0-9+/=_-]{32,}\s*$/m],11  ["generic API key", /\b(?:sk|pk)-[A-Za-z0-9_-]{24,}\b/],12];13let bad = 0;14for (const f of files) {15  if (/\.(png|ico|jpg|webp|lock)$|pnpm-lock\.yaml$/.test(f) || f === ".env") continue;16  let text: string;17  try { text = readFileSync(f, "utf8"); } catch { continue; }18  for (const [name, re] of patterns) if (re.test(text)) { console.error(`SECRET? ${name} in ${f}`); bad++; }19}20if (files.includes(".env") && execSync("git ls-files .env", { encoding: "utf8" }).trim()) { console.error(".env is tracked by git"); bad++; }21if (bad) process.exit(1);22console.log(`secrets scan ok (${files.length} files)`);23