已合并
feat: Added gitleaks for sensitive information detection #4843
wujinyuan1创建于 7月23日
feat: Added gitleaks for sensitive information detection #4843
已合并
共 2 个文件变更+105-8
| @@ -7,7 +7,7 @@ ci: | |||
| 7 | autoupdate_schedule: monthly | 7 | autoupdate_schedule: monthly |
| 8 | 8 | ||
| 9 | repos: | 9 | repos: |
| 10 | - # pre-commit 基础检查 | 10 | + # pre-commit basic checks |
| 11 | - repo: https://gitcode.com/pre-commit/pre-commit-hooks | 11 | - repo: https://gitcode.com/pre-commit/pre-commit-hooks |
| 12 | rev: v4.6.0 | 12 | rev: v4.6.0 |
| 13 | hooks: | 13 | hooks: |
| @@ -20,8 +20,8 @@ repos: | |||
| 20 | - id: detect-private-key | 20 | - id: detect-private-key |
| 21 | - id: check-json | 21 | - id: check-json |
| 22 | 22 | ||
| 23 | - # -------------------------- Python 核心检查 -------------------------- | 23 | + # -------------------------- Python Core Checks -------------------------- |
| 24 | - # Ruff：指定读取 pre-commit/pyproject.toml | 24 | + # Ruff: load configuration from pre-commit/pyproject.toml |
| 25 | - repo: https://gitcode.com/gh_mirrors/ru/ruff-pre-commit | 25 | - repo: https://gitcode.com/gh_mirrors/ru/ruff-pre-commit |
| 26 | rev: v0.14.14 | 26 | rev: v0.14.14 |
| 27 | hooks: | 27 | hooks: |
| @@ -44,7 +44,7 @@ repos: | |||
| 44 | "*.toml,*.py,*.cpp,*.hpp,*.c,*.h", | 44 | "*.toml,*.py,*.cpp,*.hpp,*.c,*.h", |
| 45 | ] | 45 | ] |
| 46 | 46 | ||
| 47 | - # pylint：指定 pre-commit/pyproject.toml | 47 | + # pylint: load configuration from pre-commit/pyproject.toml |
| 48 | - repo: https://gitcode.com/gh_mirrors/pyl/pylint | 48 | - repo: https://gitcode.com/gh_mirrors/pyl/pylint |
| 49 | rev: v4.0.5 | 49 | rev: v4.0.5 |
| 50 | hooks: | 50 | hooks: |
| @@ -54,12 +54,12 @@ repos: | |||
| 54 | args: ["--rcfile=pre-commit/pyproject.toml"] | 54 | args: ["--rcfile=pre-commit/pyproject.toml"] |
| 55 | verbose: false | 55 | verbose: false |
| 56 | 56 | ||
| 57 | - # Bandit：指定 pre-commit/pyproject.toml | 57 | + # Bandit: load configuration from pre-commit/pyproject.toml |
| 58 | - repo: https://gitcode.com/gh_mirrors/ba/bandit | 58 | - repo: https://gitcode.com/gh_mirrors/ba/bandit |
| 59 | rev: 1.9.4 | 59 | rev: 1.9.4 |
| 60 | hooks: | 60 | hooks: |
| 61 | - id: bandit | 61 | - id: bandit |
| 62 | - name: bandit (Python 安全漏洞检查) | 62 | + name: bandit (Python security vulnerability scan) |
| 63 | types: [python] | 63 | types: [python] |
| 64 | args: [ | 64 | args: [ |
| 65 | "--config=pre-commit/pyproject.toml", | 65 | "--config=pre-commit/pyproject.toml", |
| @@ -73,13 +73,27 @@ repos: | |||
| 73 | - id: typos | 73 | - id: typos |
| 74 | args: ["--force-exclude", "--config", "pre-commit/typos.toml"] | 74 | args: ["--force-exclude", "--config", "pre-commit/typos.toml"] |
| 75 | 75 | ||
| 76 | - #--------------- C++ 核心检查 --------------------------------------------- | 76 | + #--------------- C++ Core Checks --------------------------------------------- |
| 77 | - repo: https://gitcode.com/pre-commit-clang/mirrors-clang-format | 77 | - repo: https://gitcode.com/pre-commit-clang/mirrors-clang-format |
| 78 | rev: v18.1.8 | 78 | rev: v18.1.8 |
| 79 | hooks: | 79 | hooks: |
| 80 | - id: clang-format | 80 | - id: clang-format |
| 81 | files: \.(c|h|cpp|hpp|cc|hh|cxx|hxx)$ | 81 | files: \.(c|h|cpp|hpp|cc|hh|cxx|hxx)$ |
| 82 | args: | 82 | args: |
| 83 | - - "--style=file" # 读取 .clang-format 文件 | 83 | + - "--style=file" # Load .clang-format configuration file |
| 84 | - "--verbose" | 84 | - "--verbose" |
| 85 | - "-i" | 85 | - "-i" |
| 86 | +# -------------------------- Gitleaks Local Offline Binary Scan -------------------------- | ||
| 87 | + - repo: local | ||
| 88 | + hooks: | ||
| 89 | + - id: gitleaks-offline-scan | ||
| 90 | + name: Gitleaks Secret Scan(Local Binary) | ||
| 91 | + entry: ./gitleaks | ||
 | |||
| 92 | + language: system | ||
| 93 | + pass_filenames: true | ||
| 94 | + args: | ||
| 95 | + - protect | ||
| 96 | + - --verbose | ||
| 97 | + - --redact | ||
| 98 | + - --config=pre-commit/.gitleaks.toml | ||
| 99 | + stages: [pre-commit] | ||
| @@ -0,0 +1,83 @@ | |||
| 1 | +# ============================================== | ||
| 2 | +# Gitleaks Custom Configuration File | ||
| 3 | +# Path: pre-commit/.gitleaks.toml | ||
| 4 | +# Current Status: Inherit all official built-in default rules, no additional rules and no rules suppressed | ||
| 5 | +# Standard inheritance syntax: [extend] useDefault = true (Officially recommended, compatible with general offline binaries) | ||
| 6 | +# ============================================== | ||
| 7 | +title = "pre-commit secret scan config" | ||
| 8 | + | ||
| 9 | +# 【Standard inheritance of built-in default rules】 | ||
| 10 | +# useDefault=true: Load all built-in secret detection rules (AWS/Git/SSH/OBS, etc.) | ||
| 11 | +# Note: useDefault and path are mutually exclusive and cannot be used simultaneously | ||
| 12 | +[extend] | ||
| 13 | +useDefault = true | ||
| 14 | +# disabledRules = ["generic-api-key","generic-password"] | ||
| 15 | +# ↑ Uncomment to globally disable specified built-in rules in batch, fill in rule ID array | ||
| 16 | + | ||
| 17 | +# ============================================================================== | ||
| 18 | +# 1. Two syntax for globally disabling built-in rules (commented examples, not enabled currently) | ||
| 19 | +# ============================================================================== | ||
| 20 | +# Syntax A (Recommended for new versions, batch disable via array, placed inside [extend]) | ||
| 21 | +# [extend] | ||
| 22 | +# useDefault = true | ||
| 23 | +# disabledRules = ["generic-api-key","generic-password"] | ||
| 24 | + | ||
| 25 | +# Syntax B (Legacy compatibility, disable rules one by one) | ||
| 26 | +# [[rules.disabled]] | ||
| 27 | +# id = "generic-api-key" | ||
| 28 | +# [[rules.disabled]] | ||
| 29 | +# id = "generic-password" | ||
| 30 | +# Command to list all built-in rule IDs: ./gitleaks detect --list-rules --config=pre-commit/.gitleaks.toml | ||
| 31 | + | ||
| 32 | +# ============================================================================== | ||
| 33 | +# 2. Add custom business detection rules (commented examples, not enabled currently) | ||
| 34 | +# Fixed format [[rules]], used to detect project-specific credentials | ||
| 35 | +# ============================================================================== | ||
| 36 | +# [[rules]] | ||
| 37 | +# id = "huawei-obs-plain-ak-sk" | ||
| 38 | +# description = "Hardcoded plaintext Huawei Cloud OBS AK/SK credentials" | ||
| 39 | +# regex = '''(access_key|secret_key|AK|SK)\s*[:=]\s*["']?[A-Z0-9]{20,}["']?''' | ||
| 40 | +# secretGroup = 1 | ||
| 41 | +# entropy = 3.5 | ||
| 42 | +# keywords = ["ak", "sk", "obs"] | ||
| 43 | +# # Local allowlist for single rule: skip this rule for ut test directories | ||
| 44 | +# [[rules.allowlist]] | ||
| 45 | +# paths = ["^ut/", "^test/"] | ||
| 46 | + | ||
| 47 | +# ============================================================================== | ||
| 48 | +# 3. Global allowlist configuration (new version requires [[allowlists]], [allowlist] is invalid) | ||
| 49 | +# Syntax requirement: At least one uncommented array must exist inside, otherwise configuration loading fails | ||
| 50 | +# ============================================================================== | ||
| 51 | +[[allowlists]] | ||
| 52 | +# Placeholder empty regular expression, only used to pass syntax validation, no files will be allowed | ||
| 53 | +paths = ["^$"] | ||
| 54 | +# Uncomment example if directories need to be allowed | ||
| 55 | +# paths = [ | ||
| 56 | +# "^dist/", | ||
| 57 | +# "^build/", | ||
| 58 | +# "\\.md$" | ||
| 59 | +# ] | ||
| 60 | +# Allow fixed dummy test secret strings | ||
| 61 | +stopwords = [ | ||
| 62 | + # "dummy-test-ak-123456", | ||
| 63 | + # "fake-secret-000000" | ||
| 64 | +] | ||
| 65 | +commits = [] | ||
| 66 | + | ||
| 67 | +# ============================================================================== | ||
| 68 | +# 4. Inline suppression for single line / full file (no need to modify this config file) | ||
| 69 | +# Two inline comment formats, add at the end of code line when committing code, gitleaks will automatically skip detection | ||
| 70 | +# ============================================================================== | ||
| 71 | +# Method 1: Suppress secret alert only for current single line (Recommended) | ||
| 72 | +# access_key = "AKXXXXXXXXXXXXXXXXXXXX" # gitleaks:allow | ||
| 73 | +# | ||
| 74 | +# Method 2: Suppress all alerts of the entire file, place at the top of target file | ||
| 75 | +# # gitleaks:skip-file | ||
| 76 | + | ||
| 77 | +# ============================================================================== | ||
| 78 | +# Global basic scan parameters | ||
| 79 | +# ============================================================================== | ||
| 80 | +minEntropy = 3.0 | ||
| 81 | +redact = true | ||
| 82 | +maxMatchLength = 2048 | ||
| 83 | +scanGitHistory = false | ||
🟠 High Priority
.pre-commit-config.yaml第 91 行entry: ./gitleaks引用仓库根目录下的 gitleaks 二进制文件，但该文件在当前 PR 中并未提交。仓库根目录下不存在任何gitleaks文件（./gitleaks、gitleaks均不存在），.gitignore中也未排除该文件。影响： 合并后，任何人执行
git commit触发 pre-commit 钩子时，./gitleaks将因找不到可执行文件而失败（"executable file not found" 或 "command not found"），导致所有提交被阻断。触发条件： 任意一次
git commit操作（自动触发 pre-commit 阶段）。建议：将 gitleaks 二进制文件提交到仓库根目录（
./gitleaks），并确保设置了可执行权限（chmod +x gitleaks）；或增加 CI 自动下载步骤并在文档中说明开发者需预先安装 gitleaks。