diff --git a/README.md b/README.md index d164291270f7717f7037027cd4fa01cace061296..7ad8b23a0c86d3b2b9fcd974431a49b563444090 100644 --- a/README.md +++ b/README.md @@ -27,4 +27,4 @@ This file is automatically updated after execute `git commit` based on the conte - its-registry.unl.edu/unl-its/docker-ci/static-code-analysis:python - _Last update: Thu May 30 16:58:18 CDT 2019_ + _Last update: Thu May 30 17:47:26 CDT 2019_ diff --git a/detect-secrets/Dockerfile b/detect-secrets/Dockerfile index 51e07dee38d13191436d21e8d8c3ea27971ecd21..390f8c3581853da6ee43bb8aedfb4b1e2657a559 100644 --- a/detect-secrets/Dockerfile +++ b/detect-secrets/Dockerfile @@ -20,7 +20,6 @@ RUN apk update && apk upgrade && \ COPY entrypoint.sh /usr/local/bin/ RUN chmod +x /usr/local/bin/entrypoint.sh -#ENTRYPOINT ["/usr/local/bin/detect-secrets"] ENTRYPOINT ["/usr/local/bin/entrypoint.sh"] -CMD ["/usr/local/bin/detect-secrets", "scan"] +CMD ["/usr/local/bin/detect-secrets"] diff --git a/detect-secrets/entrypoint.sh b/detect-secrets/entrypoint.sh index 1b946b7577c696f48ec22fdd0bd2ad879428bffc..0bbe5c0a73f1818f27daf14df44645754d3f4a2f 100644 --- a/detect-secrets/entrypoint.sh +++ b/detect-secrets/entrypoint.sh @@ -1,21 +1,34 @@ #!/bin/sh set -e +OPT="" +ENTROPY="4" while [ -n "$1" ]; do case "$1" in -s) - OUTPUT=`/usr/local/bin/detect-secrets scan` - echo ${OUTPUT} | jq - RESULT=`echo ${OUTPUT} | jq '.results | length == 0'` - if [ "${RESULT}" = "true" ]; then - exit 0 - else - exit 1 - fi - ;; - *) - exec /bin/sh + OPT="scan" ;; + -e) + shift + ENTROPY="$1" + ;; + *) + echo "Invalid parameter(s)" + echo "Usage:" + echo "docker run --rm -v "${PWD}:/work" -w /work its-registry.unl.edu/unl-its/docker-ci/detect-secrets -s -e 3" + echo "" + exit 2 esac shift done + +if [ ${OPT} = "scan" ]; then + OUTPUT=`/usr/local/bin/detect-secrets scan --base64-limit ${ENTROPY}` + echo ${OUTPUT} | jq + RESULT=`echo ${OUTPUT} | jq '.results | length == 0'` + if [ "${RESULT}" = "true" ]; then + exit 0 + else + exit 1 + fi +fi diff --git a/examples/Detect-Secrets.md b/examples/Detect-Secrets.md index 0ad75c9101f0049c2f88a5fbe957db31758dbe31..42057ba55024a39460234f92cf354f545439600c 100644 --- a/examples/Detect-Secrets.md +++ b/examples/Detect-Secrets.md @@ -1,8 +1,17 @@ # Secrets detection example + +## Parameters + +| Argument | Description | +| :------- | :--------------------------- | +| -s | Scans the current directory | +| -e value | Entropy threshold (allowed randomness); Default value 4 | + + ## Detects secrets in the current project - One 'analysis' stage with one job - + ``` yml stages: - analysis @@ -11,5 +20,5 @@ variables: tags: - docker script: - - docker run --rm -v "${PWD}:/work" -w /work its-registry.unl.edu/unl-its/docker-ci/detect-secrets -s + - docker run --rm -v "${PWD}:/work" -w /work its-registry.unl.edu/unl-its/docker-ci/detect-secrets -s -e 4.5 ```