Spaces:

lablab-ai-amd-developer-hackathon
/

proofbridge-liner-safety-kernel

Runtime error

proofbridge-liner-safety-kernel / scripts /check-secrets.js

feat: submit ProofBridge Liner to LabLab AI AMD Developer Hackathon

93c7565 5 months ago

1.89 kB

#!/usr/bin/env node

const fs = require('fs');
const path = require('path');
const { execSync } = require('child_process');

// Patterns for common secrets
const secretPatterns = [
  /nvapi-[a-zA-Z0-9_-]{40,}/,  // NVIDIA API keys
  /sk-[a-zA-Z0-9_-]{40,}/,     // OpenAI keys
  /hf_[a-zA-Z0-9_-]{40,}/,     // Hugging Face tokens
  /[a-zA-Z0-9_-]{32,}@github/, // GitHub tokens (basic)
  /xoxb-[0-9]+-[0-9]+-[a-zA-Z0-9_-]+/, // Slack tokens
  /[a-zA-Z0-9_-]{64}/,         // Generic long keys (adjust as needed)
];

// Files to skip (contain legitimate hashes)
const skipFiles = ['package-lock.json', 'yarn.lock', 'node_modules/**', 'demo/audit-realT.md', 'fetcher-audit.md', 'phase-4-gateway-quorum-summary.md', 'prover/scorer.js', 'docs/calibration-report.md', 'test/calibrate-prior.js', 'test/recalibrate-thresholds.js', 'test/calibration-data.json', 'test/automate-calibration.sh', 'test/calibration-runs/**', 'test/diagnose-cid.js'];

// Get staged files
try {
  const output = execSync('git diff --cached --name-only', { encoding: 'utf8' });
  const files = output.trim().split('\n').filter(f => f);

  for (const file of files) {
    if (!fs.existsSync(file)) continue;
    if (skipFiles.some(skip => file.includes(skip))) continue;
    const content = fs.readFileSync(file, 'utf8');
    for (const pattern of secretPatterns) {
      if (pattern.test(content)) {
        // Allow known placeholders
        if (content.includes('your-key-here') || content.includes('REMOVED_KEY')) continue;
        console.error(`❌ Potential secret detected in ${file} matching pattern: ${pattern}`);
        console.error('Commit blocked. Remove the secret or use environment variables.');
        process.exit(1);
      }
    }
  }

  console.log('✅ No secrets detected in staged files.');
} catch (error) {
  console.error('Error checking for secrets:', error.message);
  process.exit(1);
}

	#!/usr/bin/env node

	const fs = require('fs');
	const path = require('path');
	const { execSync } = require('child_process');

	// Patterns for common secrets
	const secretPatterns = [
	/nvapi-[a-zA-Z0-9_-]{40,}/, // NVIDIA API keys
	/sk-[a-zA-Z0-9_-]{40,}/, // OpenAI keys
	/hf_[a-zA-Z0-9_-]{40,}/, // Hugging Face tokens
	/[a-zA-Z0-9_-]{32,}@github/, // GitHub tokens (basic)
	/xoxb-[0-9]+-[0-9]+-[a-zA-Z0-9_-]+/, // Slack tokens
	/[a-zA-Z0-9_-]{64}/, // Generic long keys (adjust as needed)
	];

	// Files to skip (contain legitimate hashes)
	const skipFiles = ['package-lock.json', 'yarn.lock', 'node_modules/', 'demo/audit-realT.md', 'fetcher-audit.md', 'phase-4-gateway-quorum-summary.md', 'prover/scorer.js', 'docs/calibration-report.md', 'test/calibrate-prior.js', 'test/recalibrate-thresholds.js', 'test/calibration-data.json', 'test/automate-calibration.sh', 'test/calibration-runs/', 'test/diagnose-cid.js'];

	// Get staged files
	try {
	const output = execSync('git diff --cached --name-only', { encoding: 'utf8' });
	const files = output.trim().split('\n').filter(f => f);

	for (const file of files) {
	if (!fs.existsSync(file)) continue;
	if (skipFiles.some(skip => file.includes(skip))) continue;
	const content = fs.readFileSync(file, 'utf8');
	for (const pattern of secretPatterns) {
	if (pattern.test(content)) {
	// Allow known placeholders
	if (content.includes('your-key-here') \|\| content.includes('REMOVED_KEY')) continue;
	console.error(`❌ Potential secret detected in ${file} matching pattern: ${pattern}`);
	console.error('Commit blocked. Remove the secret or use environment variables.');
	process.exit(1);
	}
	}
	}

	console.log('✅ No secrets detected in staged files.');
	} catch (error) {
	console.error('Error checking for secrets:', error.message);
	process.exit(1);
	}