nilesh.pandClaude Opus 4.8
45b5b34680
A complete loop for defining, generating, running and gating tests: - qa/: scenario-card template + examples (API/UI/binding), the Claude generation prompt, and a QA runbook tying it together - e2e/CLAUDE.md: conventions that keep AI-generated tests consistent - run-tests.ps1: one runner for every layer (backend/api/web/ui/binding), logs per run under .testlogs/, JUnit output, evidence report, and a re-seed guard against stale demo data - .githooks/ + scripts/install-hooks.ps1: pre-commit secret scan and pre-push unit tests (shift-left before CI) - evidence report now captures each API call's request, payload and response (Authorization redacted); JUnit reporter added for CI - scripts/db.mjs: db:check freshness guard Azure DevOps pipeline deferred; the runner already emits JUnit + the evidence report for any CI to publish. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
46 lines
1.5 KiB
Bash
46 lines
1.5 KiB
Bash
#!/bin/sh
|
|
# Fast, local shift-left gate: block obvious secrets from being committed.
|
|
# Runs in seconds, needs no toolchain. Enable with: scripts/install-hooks.ps1
|
|
#
|
|
# Bypass in a genuine emergency with: git commit --no-verify (discouraged).
|
|
|
|
staged=$(git diff --cached --name-only --diff-filter=ACM)
|
|
[ -z "$staged" ] && exit 0
|
|
|
|
fail=0
|
|
report() { echo " BLOCKED: $1"; fail=1; }
|
|
|
|
for f in $staged; do
|
|
# Skip the hook scripts themselves: they legitimately contain the patterns
|
|
# (and literals) they search for, so scanning them would self-block.
|
|
case "$f" in
|
|
.githooks/*) continue;;
|
|
esac
|
|
|
|
# Never commit a real env file (only .env.example is allowed).
|
|
case "$f" in
|
|
*.env|.env) report "$f looks like a secrets file (.env is git-ignored for a reason)";;
|
|
esac
|
|
|
|
# Scan staged content for credential patterns.
|
|
[ -f "$f" ] || continue
|
|
content=$(git show ":$f" 2>/dev/null) || continue
|
|
|
|
echo "$content" | grep -Eq 'GITEA_TOKEN[[:space:]]*=[[:space:]]*[A-Za-z0-9]' && \
|
|
report "$f contains a GITEA_TOKEN value"
|
|
echo "$content" | grep -Eq 'PGPASSWORD[[:space:]]*=[[:space:]]*[^ \"$]' && \
|
|
report "$f hardcodes PGPASSWORD"
|
|
echo "$content" | grep -q 'BEGIN .*PRIVATE KEY' && \
|
|
report "$f contains a private key"
|
|
# The known dev DB password must never re-enter the tree (see VAPT FINDING-8).
|
|
echo "$content" | grep -q 'Did10n@c' && \
|
|
report "$f contains the real dev DB password"
|
|
done
|
|
|
|
if [ "$fail" -ne 0 ]; then
|
|
echo ""
|
|
echo "Commit blocked: remove the secret(s) above, or use .env (git-ignored)."
|
|
exit 1
|
|
fi
|
|
exit 0
|