Repository navigation
seed: fail-closed credential key-scan pre-commit (fleet-hooks, wave 53) - #32
Merged
Merged
Conversation
Adds .githooks/pre-commit + setup.sh from SuperInstance/fleet-hooks (byte-identical, commit bbc14cf). Makes the house practice — scanning staged files for credential-shaped strings before every push (wave-52 receipts) — self-enforcing at commit time. Arm once with: sh setup.sh (sets core.hooksPath .githooks, smoke-scans the index, refuses to arm a hooks path with no hook behind it). Scans staged INDEX blobs: ghp_/gho_/ghs_/ghu_ (36), github_pat_ (22+), sk-ant prefix, AKIA+16. Fail-closed (scan errors block, exit 2), never echoes matched content, FLEET_ALLOW=<ERE> line-granular escape hatch for obviously- fake fixtures, no network, stdlib-only POSIX sh. 11/11 controls pass (tests live in SuperInstance/fleet-hooks tests/test_hooks.sh).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Adds two files (minimal diff, nothing else touched):
.githooks/pre-commit+setup.sh, byte-identical to SuperInstance/fleet-hooks commitbbc14cf98394076202b589b1f0df5aa43de96cc6.Why — makes the house practice self-enforcing
The fleet's wave-52 receipts record the practice: scan staged files for credential-shaped strings before every push (
rg "ghp_|gho_|github_pat_"). Until now that was a manual discipline; this PR moves it into the commit gate, so the repo itself refuses a commit whose staged content carries a credential.Arm once after merge:
sh setup.sh— setsgit config core.hooksPath .githooks, smoke-scans the current index, and refuses (fail-closed) to arm a hooks path with no hook behind it.Design law (details in the fleet-hooks README)
git grep --cached), not the worktree — a staged-then-deleted file cannot slip through.ghp_/gho_/ghs_/ghu_(36),github_pat_(22+), Anthropicsk-antprefix, AWSAKIA+16..git/*+node_modules/*excluded; control-char filenames refused.FLEET_ALLOW=<ERE>: line-granular, per-invocation, loud — for obviously-fake fixtures only.sh,git,grep,awk,mktemp…). The hook never needs a real token.Test receipt
sh tests/test_hooks.shin fleet-hooks: 11/11 controls pass (dash + bash; git 2.47.3) — fakeghp_staged → BLOCKED (names file+class), multi-class → BLOCKED, clean → PASS, deletion → PASS, binary → PASS no crash, binary-with-fake-token → graceful skip,FLEET_ALLOW→ PASS, newline filename → fail-closed block,node_modules→ excluded,setup.sharms fresh repo / refuses without.githooks. Fixtures are runtime-built from obviously-fake chars (ghp_+ 36 x's); no credential-shaped literals in the tree (full-pattern scan: 0 hits; prefix-scan hits are the hook's own pattern-definition lines).Provenance
Codifies the wave-52 house practice recorded in the SuperInstance fleet worklog. Commit identity:
SuperInstance <fleet@superinstance.dev>. Zero force-push; branch only; no CI/dependency changes.