5 ms·
I wish I could set this up to block pushes proactively instead of reacting to pushed secrets.
by fiddlerwoaroof 4y ago
I wish I could set this up to block pushes proactively instead of reacting to pushed secrets.
- kadoban 4y agoYou could set up something like https://github.com/godaddy/tartufo https://github.com/godaddy/tartufo in a pre-commit hook. Not sure if github has a way to hook into the push hooks on server side, they might though.
- fiddlerwoaroof 4y agoYeah, the issue with pre-commit hooks is you have to remember to set them up client-side. I tend to push to GitHub through a gitolite mirror, though, so I could probably put this in the hooks in my gitolite middlebox.
- mypalmike 4y agoWhat do you have to set up client side? They can be committed with the project. Or do I misunderstand?
- kadoban 4y agoPre-commit hooks can't be automatically set up on the client side. If they could, this would mean that any repo you clone could run arbitrary code on your machine. It can be as simple as a script you have to run once, but it can't be automatic. Which also means you can't really trust contributors to do it, even if they're well-meaning some will forget.
- iancarroll 4y agoThis exists on GitHub but is not free. https://docs.github.com/en/enterprise-cloud@latest/code-security/secret-scanning/protecting-pushes-with-secret-scanning#using-secret-scanning-as-a-push-protection-from-the-command-line https://docs.github.com/en/enterprise-cloud@latest/code-secu...
- neuronexmachina 4y agoYelp has a "detect-secrets" project that can detect potential secrets and can be used as a pre-commit hook: https://github.com/Yelp/detect-secrets https://github.com/Yelp/detect-secrets
- JoeMattiello 4y agohttps://github.com/awslabs/git-secrets https://github.com/awslabs/git-secrets
- cwinq 4y agoyou can try ggshield - https://github.com/GitGuardian/ggshield https://github.com/GitGuardian/ggshield -