From dd33c99532a036493df03d04d26ef85b98baba6a Mon Sep 17 00:00:00 2001
From: Jacques ROUSSEL <jacques.roussel@rouaje.com>
Date: Fri, 24 May 2024 14:59:23 +0200
Subject: [PATCH] =?UTF-8?q?=F0=9F=92=9A(CI)=20add=20git=20hook?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Add git hook to avoid secret leaks
---
 scripts/install-hooks.sh | 30 ++++++++++++++++++++++++++++++
 scripts/updatekeys.sh    |  3 +++
 2 files changed, 33 insertions(+)
 create mode 100755 scripts/install-hooks.sh
 create mode 100755 scripts/updatekeys.sh

diff --git a/scripts/install-hooks.sh b/scripts/install-hooks.sh
new file mode 100755
index 00000000..7d1c790c
--- /dev/null
+++ b/scripts/install-hooks.sh
@@ -0,0 +1,30 @@
+#!/bin/bash
+
+mkdir -p "$(dirname -- "${BASH_SOURCE[0]}")/../.git/hooks/"
+PRE_COMMIT_FILE="$(dirname -- "${BASH_SOURCE[0]}")/../.git/hooks/pre-commit"
+
+cat <<'EOF' >$PRE_COMMIT_FILE
+#!/bin/bash
+
+# directories containing potential secrets
+DIRS="."
+
+bold=$(tput bold)
+normal=$(tput sgr0)
+
+# allow to read user input, assigns stdin to keyboard
+exec </dev/tty
+
+for d in $DIRS; do
+	# find files containing secrets that should be encrypted
+	for f in $(find "${d}" -type f -regex ".*\.enc\..*"); do
+		if ! $(grep -q "unencrypted_suffix" $f); then
+			printf '\xF0\x9F\x92\xA5 '
+			echo "File $f has non encrypted secrets!"
+			exit 1
+		fi
+	done
+done
+EOF
+
+chmod +x $PRE_COMMIT_FILE
diff --git a/scripts/updatekeys.sh b/scripts/updatekeys.sh
new file mode 100755
index 00000000..43e2f9d4
--- /dev/null
+++ b/scripts/updatekeys.sh
@@ -0,0 +1,3 @@
+#!/bin/bash
+
+find . -name "*.enc.*" -exec sops updatekeys -y {} \;