1
0
mirror of synced 2025-12-19 18:10:59 -05:00

Secret Scanning pattern docs refactor (#58635)

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
This commit is contained in:
Daniel Dunn
2025-12-04 11:47:26 -06:00
committed by GitHub
parent ac39da2781
commit 0de59c26ad
10 changed files with 237 additions and 12389 deletions

File diff suppressed because it is too large Load Diff

File diff suppressed because it is too large Load Diff

File diff suppressed because it is too large Load Diff

File diff suppressed because it is too large Load Diff

File diff suppressed because it is too large Load Diff

File diff suppressed because it is too large Load Diff

File diff suppressed because it is too large Load Diff

File diff suppressed because it is too large Load Diff

View File

@@ -1,20 +1,8 @@
import { schema } from '@/frame/lib/frontmatter'
// Secret scanning entries have `versions` blocks that match `versions` frontmatter,
// so we can import that part of the FM schema.
// Access the versions property which is defined dynamically in frontmatter.ts
const versionsProps = Object.assign({}, (schema.properties as Record<string, any>).versions)
// The secret-scanning.json contains an array of objects that look like this: // The secret-scanning.json contains an array of objects that look like this:
// { // {
// "provider": "Azure", // "provider": "Azure",
// "supportedSecret": "Azure SQL Connection String", // "supportedSecret": "Azure SQL Connection String",
// "secretType": "azure_sql_connection_string", // "secretType": "azure_sql_connection_string",
// "versions": {
// "fpt": "*",
// "ghec": "*",
// "ghes": "*"
// },
// "isPublic": true, // "isPublic": true,
// "isPrivateWithGhas": true, // "isPrivateWithGhas": true,
// "hasPushProtection": false, // "hasPushProtection": false,
@@ -27,7 +15,6 @@ export interface SecretScanningEntry {
provider: string provider: string
supportedSecret: string supportedSecret: string
secretType: string secretType: string
versions: Record<string, string>
isPublic: boolean | string isPublic: boolean | string
isPrivateWithGhas: boolean | string isPrivateWithGhas: boolean | string
hasPushProtection: boolean | string hasPushProtection: boolean | string
@@ -45,7 +32,6 @@ export default {
'provider', 'provider',
'supportedSecret', 'supportedSecret',
'secretType', 'secretType',
'versions',
'isPublic', 'isPublic',
'isPrivateWithGhas', 'isPrivateWithGhas',
'hasPushProtection', 'hasPushProtection',
@@ -65,7 +51,6 @@ export default {
type: 'string', type: 'string',
pattern: '[A-Za-z0-9_-]', pattern: '[A-Za-z0-9_-]',
}, },
versions: versionsProps,
isPublic: { isPublic: {
description: 'whether the secret is publicly available', description: 'whether the secret is publicly available',
type: ['boolean', 'string'], type: ['boolean', 'string'],

View File

@@ -3,7 +3,6 @@ import fs from 'fs'
import yaml from 'js-yaml' import yaml from 'js-yaml'
import type { NextFunction, Response } from 'express' import type { NextFunction, Response } from 'express'
import getApplicableVersions from '@/versions/lib/get-applicable-versions'
import { liquid } from '@/content-render/index' import { liquid } from '@/content-render/index'
import { ExtendedRequest, SecretScanningData } from '@/types' import { ExtendedRequest, SecretScanningData } from '@/types'
import { allVersions } from '@/versions/lib/all-versions' import { allVersions } from '@/versions/lib/all-versions'
@@ -38,11 +37,9 @@ export default async function secretScanning(
: 'fpt' : 'fpt'
const filepath = `${secretScanningDir}/${versionPath}/public-docs.yml` const filepath = `${secretScanningDir}/${versionPath}/public-docs.yml`
const secretScanningData = yaml.load(fs.readFileSync(filepath, 'utf-8')) as SecretScanningData[] req.context.secretScanningData = yaml.load(
fs.readFileSync(filepath, 'utf-8'),
req.context.secretScanningData = secretScanningData.filter((entry) => ) as SecretScanningData[]
currentVersion ? getApplicableVersions(entry.versions).includes(currentVersion) : false,
)
// Some entries might use Liquid syntax, so we need // Some entries might use Liquid syntax, so we need
// to execute that Liquid to get the actual value. // to execute that Liquid to get the actual value.