gsadmin/rustfs
1
0
Fork 0
mirror of https://github.com/rustfs/rustfs.git synced 2026-08-19 19:16:17 +00:00
Code Issues Packages Projects Releases Wiki Activity

test(crypto): replace the one-file key scan with a repo-wide guard

Browse Source 
crates/crypto/src/license_token.rs asserted, via include_str! on its own
file, that the license-token signing key is never checked in. The scan saw
exactly one file: the key moved anywhere else passed silently, and renaming
license_token.rs stopped the guard from compiling instead of reporting.

scripts/check_embedded_secrets.sh scans every tracked and not-yet-added text
file for the same needle plus the other private-key header forms and eleven
provider credential formats, and it does not skip the paths
.github/secret_scanning.yml tells push protection to ignore. Non-secret
matches are excused by exact literal, never by path glob, and an exemption
that stops matching is reported as stale. --self-test asserts every pattern
family fires.
This commit is contained in:
overtrue
2026-08-19 10:53:03 +08:00
parent 09fe561443
commit 2f28bb49d1
8 changed files with 295 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/workflows/ci-docs-only.yml
+3
View File
@@ -120,6 +120,9 @@ jobs:
- name: Check cryptographic capability wording
run: ./scripts/check_fips_wording.sh
- name: Check no embedded secret material
run: ./scripts/check_embedded_secrets.sh
- name: Check no planning docs committed
run: ./scripts/check_no_planning_docs.sh
.github/workflows/ci.yml
+3
View File
@@ -155,6 +155,9 @@ jobs:
- name: Check cryptographic capability wording
run: ./scripts/check_fips_wording.sh
- name: Check no embedded secret material
run: ./scripts/check_embedded_secrets.sh
- name: Check no planning docs committed
run: ./scripts/check_no_planning_docs.sh