42 lines
1.4 KiB
YAML
42 lines
1.4 KiB
YAML
# Throwaway secrets scan (card 74). Prints only file names / redacted findings.
|
|
name: scan
|
|
on: [push]
|
|
|
|
jobs:
|
|
scan:
|
|
runs-on: nixos
|
|
env:
|
|
GIT_PAGER: cat
|
|
PAGER: cat
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
with:
|
|
fetch-depth: 0
|
|
- name: all branches
|
|
run: git fetch origin '+refs/heads/*:refs/remotes/origin/*' && git branch -a && git rev-list --all | wc -l
|
|
- name: pattern scan (file names only)
|
|
run: |
|
|
scan() {
|
|
echo "== $1"
|
|
git rev-list --all | xargs -n 20 git grep -lIE "$1" | cut -d: -f2 | sort | uniq -c || true
|
|
}
|
|
scan 'BEGIN [A-Z ]*PRIVATE KEY'
|
|
scan 'sk-[A-Za-z0-9_-]{16,}'
|
|
scan 'syt_[A-Za-z0-9]+|mct_[A-Za-z0-9]+'
|
|
scan 'gh[pousr]_[A-Za-z0-9]{20,}'
|
|
scan '[Bb]earer [A-Za-z0-9._-]{16,}'
|
|
scan '(^|[^0-9a-f])[0-9a-f]{40}([^0-9a-f]|$)'
|
|
scan '[Aa]ccess_?[Tt]oken'
|
|
scan '[Pp]assw(or)?d'
|
|
scan '[Aa][Pp][Ii][_-]?[Kk][Ee][Yy]'
|
|
scan '[Tt]oken["'"'"' ]*[:=] *["'"'"'][A-Za-z0-9._-]{12,}'
|
|
scan '10\.0\.0\.'
|
|
scan 'nip\.io'
|
|
scan 'surma\.technology'
|
|
scan 'vpn\.'
|
|
scan 'containeruser'
|
|
scan 'vendors\.llm'
|
|
scan 'citadel|nexus'
|
|
echo "== all files ever"
|
|
git rev-list --all | xargs -n 1 git ls-tree -r --name-only | sort -u
|