|
| 1 | +#!/usr/bin/env bash |
| 2 | +# Secrets detection using Gitleaks via Docker or Podman. |
| 3 | +# Usage: |
| 4 | +# scripts/secrets-check.sh # scan staged files |
| 5 | +# scripts/secrets-check.sh --git # scan full git history |
| 6 | + |
| 7 | +GITLEAKS_IMAGE="ghcr.io/gitleaks/gitleaks:v8.30.1" |
| 8 | +CONTAINER_ENGINE=$(command -v docker 2>/dev/null || command -v podman 2>/dev/null) |
| 9 | + |
| 10 | +if [[ -z "$CONTAINER_ENGINE" ]]; then |
| 11 | + echo "No suitable container engine found - skipping secrets detection" |
| 12 | + echo "Install Docker to enable local secrets scanning" |
| 13 | + exit 1 |
| 14 | +fi |
| 15 | + |
| 16 | +if ! $CONTAINER_ENGINE info >/dev/null 2>&1; then |
| 17 | + if command -v colima >/dev/null 2>&1; then |
| 18 | + echo "Docker daemon not running - Colima is installed" |
| 19 | + echo "Run 'colima start' to enable secrets detection locally" |
| 20 | + elif command -v podman >/dev/null 2>&1; then |
| 21 | + echo "Docker daemon not running - Podman is installed" |
| 22 | + echo "Run 'podman machine start' to enable secrets detection locally" |
| 23 | + elif command -v orbstack >/dev/null 2>&1; then |
| 24 | + echo "Docker daemon not running - OrbStack is installed" |
| 25 | + echo "Start OrbStack to enable secrets detection locally" |
| 26 | + else |
| 27 | + echo "Container engine found but daemon is not running" |
| 28 | + fi |
| 29 | + exit 1 |
| 30 | +fi |
| 31 | + |
| 32 | +echo "Checking for secrets with Gitleaks..." |
| 33 | + |
| 34 | +if [[ "$1" == "--git" ]]; then |
| 35 | + $CONTAINER_ENGINE run --rm -v "$(pwd):/path" "$GITLEAKS_IMAGE" git --no-banner --verbose /path |
| 36 | +else |
| 37 | + $CONTAINER_ENGINE run --rm -v "$(pwd):/path" "$GITLEAKS_IMAGE" dir --no-banner --verbose /path |
| 38 | +fi |
| 39 | + |
| 40 | +if [[ $? -ne 0 ]]; then |
| 41 | + echo "Secrets detected! Please remove sensitive data before committing." |
| 42 | + exit 1 |
| 43 | +fi |
0 commit comments