wright/scripts/security-scan.sh at dev · burhop/wright · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
#!/bin/bash
set -euo pipefail

ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
INCLUDE_UNTRACKED=0
SKIP_GITLEAKS=0
SKIP_TRUFFLEHOG=0

GITLEAKS_IMAGE="${GITLEAKS_IMAGE:-ghcr.io/gitleaks/gitleaks:v8.30.1}"
TRUFFLEHOG_IMAGE="${TRUFFLEHOG_IMAGE:-ghcr.io/trufflesecurity/trufflehog:3.95.7}"

# Git for Windows rewrites POSIX-looking arguments before invoking Windows
# executables. Give Docker Desktop an explicit Windows bind source and disable
# conversion so both the host path and in-container /repo paths stay correct.
DOCKER_ROOT_DIR="$ROOT_DIR"
case "$(uname -s)" in
  MINGW*|MSYS*|CYGWIN*) DOCKER_ROOT_DIR="$(cygpath -w "$ROOT_DIR")" ;;
esac

usage() {
  cat <<'USAGE'
Usage: scripts/security-scan.sh [--include-untracked] [--skip-gitleaks] [--skip-trufflehog]

Runs Wright's public-alpha leak scan plus Dockerized Gitleaks and TruffleHog
history scans. Requires Docker for the dedicated scanners.
USAGE
}

while [ "$#" -gt 0 ]; do
  case "$1" in
    --include-untracked)
      INCLUDE_UNTRACKED=1
      ;;
    --skip-gitleaks)
      SKIP_GITLEAKS=1
      ;;
    --skip-trufflehog)
      SKIP_TRUFFLEHOG=1
      ;;
    -h|--help)
      usage
      exit 0
      ;;
    *)
      echo "Unknown argument: $1" >&2
      usage >&2
      exit 2
      ;;
  esac
  shift
done

cd "$ROOT_DIR"

PYTHON_CMD=()
if command -v python >/dev/null 2>&1; then
  PYTHON_CMD=(python)
elif command -v python3 >/dev/null 2>&1; then
  PYTHON_CMD=(python3)
elif command -v py >/dev/null 2>&1; then
  PYTHON_CMD=(py -3)
else
  echo "Could not find python, python3, or py on PATH." >&2
  exit 1
fi

echo "== Wright public-alpha leak scan =="
if [ "$INCLUDE_UNTRACKED" = "1" ]; then
  "${PYTHON_CMD[@]}" scripts/check-public-alpha-leaks.py --include-untracked
else
  "${PYTHON_CMD[@]}" scripts/check-public-alpha-leaks.py
fi

if [ "$SKIP_GITLEAKS" != "1" ]; then
  echo
  echo "== Gitleaks history scan =="
  MSYS_NO_PATHCONV=1 docker run --rm \
    -v "$DOCKER_ROOT_DIR:/repo" \
    "$GITLEAKS_IMAGE" \
    git /repo \
    --config /repo/.gitleaks.toml \
    --no-banner \
    --redact \
    --verbose
fi

if [ "$SKIP_TRUFFLEHOG" != "1" ]; then
  echo
  echo "== TruffleHog history scan =="
  MSYS_NO_PATHCONV=1 docker run --rm \
    -v "$DOCKER_ROOT_DIR:/repo" \
    -w /repo \
    "$TRUFFLEHOG_IMAGE" \
    git file:///repo \
    --no-update \
    --fail \
    --results=verified,unknown \
    --no-verification \
    --exclude-globs=uv.lock,package-lock.json
fi

echo
echo "Security scans passed."