95 lines
2.8 KiB
Bash
Executable File
95 lines
2.8 KiB
Bash
Executable File
#!/bin/bash
|
|
# secret-incident.sh - Helper script for handling gitleaks incidents
|
|
# Usage: ./scripts/security/secret-incident.sh
|
|
|
|
REPORT_FILE=".git/gitleaks/report.json"
|
|
CONFIG_FILE="config/gitleaks.toml"
|
|
|
|
echo "========================================"
|
|
echo "🛡️ Git Secret Incident Response Helper"
|
|
echo "========================================"
|
|
|
|
if [ ! -f "$REPORT_FILE" ]; then
|
|
echo "✅ No active report found at $REPORT_FILE."
|
|
echo "Running gitleaks to check for issues..."
|
|
./scripts/hooks/run-gitleaks.sh full
|
|
if [ $? -eq 0 ]; then
|
|
echo "No secrets detected. You are safe."
|
|
exit 0
|
|
fi
|
|
fi
|
|
|
|
echo ""
|
|
echo "⚠️ Secrets detected! parsing report..."
|
|
echo ""
|
|
|
|
# Check dependencies
|
|
if ! command -v jq &> /dev/null; then
|
|
echo "Error: 'jq' is not installed. Please install it to parse JSON reports."
|
|
# Fallback to simple cat
|
|
cat "$REPORT_FILE"
|
|
exit 1
|
|
fi
|
|
|
|
# Summary
|
|
COUNT=$(jq length "$REPORT_FILE")
|
|
echo "Found $COUNT potential secret(s)."
|
|
|
|
# List items
|
|
jq -r '.[] | "----------------------------------------\nType: \(.Description)\nFile: \(.File)\nLine: \(.StartLine)\nCommit: \(.Commit)\nSecret: \(.Secret | .[0:4])..."' "$REPORT_FILE"
|
|
|
|
echo "----------------------------------------"
|
|
echo ""
|
|
echo "Select an action:"
|
|
echo "1) 🩹 Fix: I will remove the secret and rotate it (Standard Procedure)"
|
|
echo "2) 🧹 History: I pushed it and need to clean git history (Dangerous)"
|
|
echo "3) ✅ Allow: This is a false positive (Add to whitelist)"
|
|
echo "4) ❌ Exit"
|
|
|
|
read -p "Enter choice [1-4]: " CHOICE
|
|
|
|
case "$CHOICE" in
|
|
1)
|
|
echo ""
|
|
echo ">>> ACTION: FIX & ROTATE"
|
|
echo "1. Revoke the exposed secret IMMEDIATELY."
|
|
echo "2. Remove the secret from the file."
|
|
echo "3. Run 'git restore --staged <file>' if it was just staged."
|
|
echo "4. Verify with './scripts/hooks/run-gitleaks.sh staged'"
|
|
;;
|
|
2)
|
|
echo ""
|
|
echo ">>> ACTION: CLEAN HISTORY"
|
|
echo "WARNING: This rewrites history. Notify your team!"
|
|
echo ""
|
|
echo "Recommended command (install git-filter-repo first):"
|
|
echo "git filter-repo --path <path/to/file> --invert-paths --force"
|
|
echo ""
|
|
echo "Then force push:"
|
|
echo "git push --force --all"
|
|
;;
|
|
3)
|
|
echo ""
|
|
echo ">>> ACTION: ALLOWLIST"
|
|
echo "Editing $CONFIG_FILE..."
|
|
echo "Add the file path or regex to the [[allowlist]] section."
|
|
echo ""
|
|
echo "Example path:"
|
|
echo "paths = ['''path/to/false/positive.file''']"
|
|
echo ""
|
|
echo "Opening config file..."
|
|
# Try to open with default editor
|
|
${EDITOR:-nano} "$CONFIG_FILE"
|
|
;;
|
|
4)
|
|
echo "Exiting."
|
|
exit 0
|
|
;;
|
|
*)
|
|
echo "Invalid choice."
|
|
;;
|
|
esac
|
|
|
|
echo ""
|
|
echo "For more details, read: skills/git.secret-incident-response.v1.md"
|