Skip to content

Commit ef0bd8c

Browse files
rlirli
authored
Add git-secrets to verification tasks (#4072)
1 parent eed87a1 commit ef0bd8c

File tree

8 files changed

+155
-3
lines changed

8 files changed

+155
-3
lines changed

‎build.gradle.kts‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,7 @@ import software.aws.toolkits.gradle.changelog.tasks.GenerateGithubChangeLog
77
plugins {
88
id("base")
99
id("toolkit-changelog")
10+
id("toolkit-git-secrets")
1011
id("toolkit-jacoco-report")
1112
id("org.jetbrains.gradle.plugin.idea-ext")
1213
}

‎buildSrc/build.gradle.kts‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,7 @@ buildscript {
1010

1111
plugins {
1212
`kotlin-dsl`
13+
`java-gradle-plugin`
1314
}
1415

1516

@@ -25,11 +26,13 @@ dependencies {
2526
implementation(libs.gradlePlugin.kotlin)
2627
implementation(libs.gradlePlugin.testLogger)
2728
implementation(libs.gradlePlugin.testRetry)
29+
implementation(libs.gradlePlugin.undercouch.download)
2830
implementation(libs.jgit)
2931

3032
testImplementation(libs.assertj)
3133
testImplementation(libs.junit4)
3234
testImplementation(libs.bundles.mockito)
35+
testImplementation(gradleTestKit())
3336

3437
testRuntimeOnly(libs.junit5.jupiterVintage)
3538
}

‎buildSrc/src/main/kotlin/toolkit-git-secrets.gradle.kts‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
// Copyright 2023 Amazon.com, Inc. or its affiliates. All Rights Reserved.
2+
// SPDX-License-Identifier: Apache-2.0
3+
4+
import de.undercouch.gradle.tasks.download.Download
5+
import org.gradle.nativeplatform.platform.internal.DefaultNativePlatform
6+
7+
plugins {
8+
id("de.undercouch.download")
9+
}
10+
11+
val downloadGitSecrets = tasks.register<Download>("downloadGitSecrets") {
12+
src("https://raw.githubusercontent.com/awslabs/git-secrets/master/git-secrets")
13+
dest("$buildDir/git-secrets")
14+
onlyIfModified(true)
15+
useETag(true)
16+
}
17+
18+
val gitSecrets = tasks.register<Exec>("gitSecrets") {
19+
onlyIf {
20+
!DefaultNativePlatform.getCurrentOperatingSystem().isWindows
21+
}
22+
23+
dependsOn(downloadGitSecrets)
24+
workingDir(project.rootDir)
25+
val path = "$buildDir${File.pathSeparator}"
26+
val patchendEnv = environment.apply { replace("PATH", path + getOrDefault("PATH", "")) }
27+
environment = patchendEnv
28+
29+
commandLine("/bin/sh", "$buildDir/git-secrets", "--register-aws")
30+
31+
// cleaner than having multiple separate exec tasks
32+
doLast {
33+
exec {
34+
workingDir(project.rootDir)
35+
commandLine("git", "config", "--add", "secrets.allowed", "123456789012")
36+
}
37+
38+
exec {
39+
workingDir(project.rootDir)
40+
environment = patchendEnv
41+
commandLine("/bin/sh", "$buildDir/git-secrets", "--scan")
42+
}
43+
}
44+
}
45+
46+
tasks.findByName("check")?.let {
47+
it.dependsOn(gitSecrets)
48+
}

‎buildSrc/src/test/kotlin/software/aws/toolkits/gradle/GitSecretsTest.kt‎

Lines changed: 95 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,95 @@
1+
// Copyright 2023 Amazon.com, Inc. or its affiliates. All Rights Reserved.
2+
// SPDX-License-Identifier: Apache-2.0
3+
4+
package software.aws.toolkits.gradle
5+
6+
import org.assertj.core.api.Assertions.assertThat
7+
import org.eclipse.jgit.api.Git
8+
import org.eclipse.jgit.storage.file.FileRepositoryBuilder
9+
import org.gradle.testfixtures.ProjectBuilder
10+
import org.gradle.testkit.runner.GradleRunner
11+
import org.gradle.testkit.runner.TaskOutcome
12+
import org.gradle.testkit.runner.UnexpectedBuildFailure
13+
import org.junit.jupiter.api.Test
14+
import org.junit.jupiter.api.assertThrows
15+
import org.junit.jupiter.api.io.TempDir
16+
import java.io.File
17+
import kotlin.io.path.writeText
18+
19+
class GitSecretsTest {
20+
@Test
21+
fun `plugin can be applied`() {
22+
val project = ProjectBuilder.builder().build()
23+
project.getPluginManager().apply("toolkit-git-secrets")
24+
}
25+
26+
@Test
27+
fun `passes when no secrets`(@TempDir tempDir: File) {
28+
tempDir.mkdirs()
29+
val repo = FileRepositoryBuilder()
30+
.setWorkTree(tempDir)
31+
.build()
32+
repo.create()
33+
34+
tempDir
35+
.resolve("build.gradle.kts")
36+
.writeText(
37+
"""
38+
plugins {
39+
id("toolkit-git-secrets")
40+
}
41+
""".trimIndent()
42+
)
43+
44+
Git.wrap(repo).add().addFilepattern(".").call()
45+
46+
val result = GradleRunner.create()
47+
.withProjectDir(tempDir)
48+
.withArguments("gitSecrets")
49+
.withPluginClasspath()
50+
.build()
51+
52+
assertThat(result.task(":gitSecrets")?.outcome).isEqualTo(TaskOutcome.SUCCESS)
53+
}
54+
55+
@Test
56+
fun `fails when contains secrets`(@TempDir tempDir: File) {
57+
tempDir.mkdirs()
58+
val repo = FileRepositoryBuilder()
59+
.setWorkTree(tempDir)
60+
.build()
61+
repo.create()
62+
63+
tempDir
64+
.resolve("build.gradle.kts")
65+
.apply {
66+
writeText(
67+
"""
68+
plugins {
69+
id("toolkit-git-secrets")
70+
}
71+
""".trimIndent()
72+
)
73+
74+
appendText(
75+
buildString {
76+
appendLine()
77+
// split to avoid tripping git-secrets
78+
append("// AKI")
79+
append("AXXXXXXXXXXXXXXXX")
80+
}
81+
)
82+
83+
Git.wrap(repo).add().addFilepattern(".").call()
84+
}
85+
86+
val failure = assertThrows<UnexpectedBuildFailure> {
87+
GradleRunner.create()
88+
.withProjectDir(tempDir)
89+
.withArguments("gitSecrets")
90+
.withPluginClasspath()
91+
.build()
92+
}
93+
assertThat(failure.message).contains("Matched one or more prohibited patterns")
94+
}
95+
}

‎buildspec/linuxTests.yml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,10 @@ phases:
1616
- useradd codebuild-user
1717
- dnf install -y acl
1818
- chown -R codebuild-user:codebuild-user /codebuild/output
19+
- chown -R codebuild-user:codebuild-user /codebuild/local-cache
1920
- setfacl -m d:o::rwx,o::rwx /root
21+
# (CVE-2022-24765) fatal: detected dubious ownership in repository
22+
- su codebuild-user -c "git config --global --add safe.directory \"$CODEBUILD_SRC_DIR\""
2023

2124
build:
2225
commands:

‎gradle/libs.versions.toml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -27,6 +27,7 @@ testRetry = "1.5.2"
2727
slf4j = "1.7.36"
2828
sshd = "2.11.0"
2929
wiremock = "2.35.0"
30+
undercouch-download = "5.2.1"
3031
zjsonpatch = "0.4.11"
3132

3233
[libraries]
@@ -70,6 +71,7 @@ gradlePlugin-intellij = { module = "org.jetbrains.intellij:org.jetbrains.intelli
7071
gradlePlugin-kotlin = { module = "org.jetbrains.kotlin:kotlin-gradle-plugin", version.ref = "kotlin" }
7172
gradlePlugin-testLogger = { module = "com.adarshr:gradle-test-logger-plugin", version.ref = "testLogger" }
7273
gradlePlugin-testRetry = { module = "org.gradle:test-retry-gradle-plugin", version.ref = "testRetry" }
74+
gradlePlugin-undercouch-download = { module = "de.undercouch:gradle-download-task", version.ref = "undercouch-download" }
7375
intellijRemoteFixtures = { module = "com.intellij.remoterobot:remote-fixtures", version.ref = "intellijRemoteRobot" }
7476
intellijRemoteRobot = { module = "com.intellij.remoterobot:remote-robot", version.ref = "intellijRemoteRobot" }
7577
jackson-datetime = { module = "com.fasterxml.jackson.datatype:jackson-datatype-jsr310", version.ref = "jackson" }

‎jetbrains-core/tst/software/aws/toolkits/jetbrains/services/telemetry/TelemetryServiceTest.kt‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -198,7 +198,7 @@ class TelemetryServiceTest {
198198

199199
telemetryService.record(
200200
MetricEventMetadata(
201-
awsAccount = "222222222222",
201+
awsAccount = "123456789012",
202202
awsRegion = "bar-region"
203203
)
204204
) {
@@ -207,7 +207,7 @@ class TelemetryServiceTest {
207207
telemetryService.dispose()
208208

209209
verify(batcher).enqueue(eventCaptor.capture())
210-
assertMetricEventsContains(eventCaptor.allValues, "Foo", "222222222222", "bar-region")
210+
assertMetricEventsContains(eventCaptor.allValues, "Foo", "123456789012", "bar-region")
211211
}
212212

213213
@Test

‎resources/build.gradle.kts‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ import software.aws.toolkits.gradle.resources.ValidateMessages
77
plugins {
88
id("toolkit-kotlin-conventions")
99
id("toolkit-testing")
10-
id("de.undercouch.download") version "5.2.1"
10+
id("de.undercouch.download")
1111
}
1212

1313
sourceSets {

0 commit comments

Comments
 (0)