55 lines
1.4 KiB
JavaScript
Executable File
55 lines
1.4 KiB
JavaScript
Executable File
#!/usr/bin/env node
|
|
/*
|
|
* Guard against putting secrets in Gitea step env/with blocks.
|
|
* Gitea/act_runner logs may render those blocks before masking is effective.
|
|
*/
|
|
|
|
const fs = require("fs");
|
|
const path = require("path");
|
|
|
|
const root = path.resolve(__dirname, "../..");
|
|
const workflowDir = path.join(root, ".gitea", "workflows");
|
|
const violations = [];
|
|
|
|
for (const fileName of fs.readdirSync(workflowDir).sort()) {
|
|
if (!fileName.endsWith(".yml") && !fileName.endsWith(".yaml")) {
|
|
continue;
|
|
}
|
|
|
|
const filePath = path.join(workflowDir, fileName);
|
|
const lines = fs.readFileSync(filePath, "utf8").split(/\r?\n/);
|
|
let block = null;
|
|
|
|
lines.forEach((line, index) => {
|
|
const indent = line.match(/^\s*/)[0].length;
|
|
const trimmed = line.trim();
|
|
|
|
if (block && trimmed && indent <= block.indent) {
|
|
block = null;
|
|
}
|
|
|
|
const blockMatch = line.match(/^(\s*)(env|with):\s*$/);
|
|
if (blockMatch) {
|
|
block = {
|
|
indent: blockMatch[1].length,
|
|
section: blockMatch[2],
|
|
};
|
|
return;
|
|
}
|
|
|
|
if (block && line.includes("${{ secrets.")) {
|
|
violations.push(`${filePath}:${index + 1}:${block.section}`);
|
|
}
|
|
});
|
|
}
|
|
|
|
if (violations.length > 0) {
|
|
console.error("Gitea workflow exposes secrets through step env/with:");
|
|
for (const violation of violations) {
|
|
console.error(` - ${violation}`);
|
|
}
|
|
process.exit(1);
|
|
}
|
|
|
|
console.log("no Gitea step env/with secrets");
|