mirror of
https://github.com/rcourtman/Pulse.git
synced 2026-08-31 02:14:29 +00:00
69 lines
2 KiB
Python
69 lines
2 KiB
Python
#!/usr/bin/env python3
|
|
"""Keep historical gitleaks suppressions exact and auditable."""
|
|
|
|
from __future__ import annotations
|
|
|
|
import re
|
|
import subprocess
|
|
import unittest
|
|
from pathlib import Path
|
|
|
|
|
|
REPO_ROOT = Path(__file__).resolve().parents[2]
|
|
IGNORE_PATH = REPO_ROOT / ".gitleaksignore"
|
|
HISTORICAL_FINGERPRINT = re.compile(
|
|
r"^(?P<commit>[0-9a-f]{40}):(?P<path>.+):(?P<rule>[a-z0-9-]+):(?P<line>[1-9][0-9]*)$"
|
|
)
|
|
CURRENT_FINGERPRINT = re.compile(
|
|
r"^(?P<path>.+):(?P<rule>[a-z0-9-]+):(?P<line>[1-9][0-9]*)$"
|
|
)
|
|
|
|
|
|
def ignore_entries() -> list[str]:
|
|
return [
|
|
line.strip()
|
|
for line in IGNORE_PATH.read_text(encoding="utf-8").splitlines()
|
|
if line.strip() and not line.lstrip().startswith("#")
|
|
]
|
|
|
|
|
|
class GitleaksIgnoreTest(unittest.TestCase):
|
|
def test_entries_are_exact_fingerprints(self) -> None:
|
|
invalid = [
|
|
entry
|
|
for entry in ignore_entries()
|
|
if not HISTORICAL_FINGERPRINT.fullmatch(entry)
|
|
and not CURRENT_FINGERPRINT.fullmatch(entry)
|
|
]
|
|
self.assertEqual(invalid, [], msg=f"non-exact gitleaks ignore entries: {invalid}")
|
|
|
|
def test_historical_fingerprints_resolve_to_the_named_blob(self) -> None:
|
|
failures: list[str] = []
|
|
|
|
for entry in ignore_entries():
|
|
match = HISTORICAL_FINGERPRINT.fullmatch(entry)
|
|
if match is None:
|
|
continue
|
|
|
|
commit = match.group("commit")
|
|
path = match.group("path")
|
|
result = subprocess.run(
|
|
["git", "cat-file", "-e", f"{commit}:{path}"],
|
|
cwd=REPO_ROOT,
|
|
stdout=subprocess.DEVNULL,
|
|
stderr=subprocess.DEVNULL,
|
|
check=False,
|
|
)
|
|
if result.returncode != 0:
|
|
failures.append(entry)
|
|
|
|
self.assertEqual(
|
|
failures,
|
|
[],
|
|
msg="historical gitleaks fingerprints do not resolve:\n- "
|
|
+ "\n- ".join(failures),
|
|
)
|
|
|
|
|
|
if __name__ == "__main__":
|
|
unittest.main()
|