feat(plan-01): Phase 1 — relocate harness code to packages/casan-harness (symlink facade)
Physically move the pure-code subtrees out of .specify into the package, leaving compat symlinks at the old .specify/<dir> paths so every existing reference (internal CASAN_HARNESS_ROOT + external CI/docker/mjs) keeps resolving. Runtime state stays put. Moved (git mv): scripts/ tests/ security/ templates/ config/ governance/ memory/ .specify/<dir> -> packages/casan-harness/<dir> (+ .specify/<dir> symlink) Stays in .specify (state/governance/domain, handled later): logs/ agentops/ level5/ init-options.json traceability-map.json Python `.resolve()` self-location followed the compat symlink into packages and lost the app root; generate-casan-demo-context.py, generate-agentops-dashboard.py and dashboard-server.py now walk UP for the `.specify` state marker instead of a fixed parent depth (fixes "missing trace files" in run-casan4). Full gate: PASS=64 FAIL=0 SKIP=3 (CASAN_CI_STEP_TIMEOUT_SEC=1200 — track-a ~450s runs close to the 600s default and can tip over under load; this is timing variance, not a regression — it passed cleanly with headroom). Runtime log/audit artifacts kept unstaged. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This commit is contained in:
thanhnv
co-authored by
Claude Opus 4.8
Claude Opus 4.8
parent
2c765c9a45
commit
664bd1f00c
@@ -0,0 +1,123 @@
|
||||
#!/usr/bin/env bash
|
||||
set -uo pipefail
|
||||
|
||||
# CASAN WP-S4 — Secrets lifecycle check.
|
||||
# Verifies:
|
||||
# 1. .env files are NOT in the git index (committed).
|
||||
# 2. No real private keys appear in tracked files (test fixtures accepted with override).
|
||||
# 3. No API key patterns in audit/log files.
|
||||
# 4. .gitignore covers .env and key file extensions.
|
||||
#
|
||||
# Honest scope: this scans the local checkout and git index. It does NOT
|
||||
# scan git history (past commits). Historical leak scanning requires
|
||||
# git-secrets or similar tooling noted as a production recommendation.
|
||||
#
|
||||
# Exit: 0 all checks pass, 1 violation found, 2 scan error.
|
||||
|
||||
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
||||
ROOT="$(cd "$SCRIPT_DIR/../../.." && pwd)"
|
||||
PASS=0; FAIL=0; WARN=0
|
||||
|
||||
ok() { echo " PASS $1"; PASS=$((PASS+1)); }
|
||||
fail() { echo " FAIL $1"; FAIL=$((FAIL+1)); }
|
||||
warn() { echo " WARN $1"; WARN=$((WARN+1)); }
|
||||
|
||||
echo "=== CASAN WP-S4: Secrets lifecycle scan ==="
|
||||
|
||||
cd "$ROOT"
|
||||
|
||||
# ── 1. No .env committed to git index ──────────────────────────────────────
|
||||
committed_envs="$(git ls-files | grep -E '(^|/)\.env(\.|$)' 2>/dev/null || true)"
|
||||
if [[ -z "$committed_envs" ]]; then
|
||||
ok ".env files NOT in git index"
|
||||
else
|
||||
fail ".env files committed to git: $committed_envs"
|
||||
fi
|
||||
|
||||
# ── 2. No real private keys in tracked files ───────────────────────────────
|
||||
# Exclude known test-fixture files and evidence directories that intentionally
|
||||
# contain the pattern as test data.
|
||||
FIXTURE_EXCLUDES=(
|
||||
".specify/tests/"
|
||||
"docs/output/casan/evidence/"
|
||||
".specify/security/"
|
||||
".specify/scripts/bash/security-check.sh"
|
||||
".specify/scripts/bash/verify-audit-chain.sh"
|
||||
".specify/scripts/bash/verify-tool-audit.sh"
|
||||
".specify/scripts/bash/tool-audit-lib.sh"
|
||||
".specify/scripts/bash/governance-check.sh"
|
||||
)
|
||||
build_exclude_args() {
|
||||
for ex in "${FIXTURE_EXCLUDES[@]}"; do printf -- "--exclude-dir=%s " "$ex"; done
|
||||
}
|
||||
|
||||
# Look for actual private key headers — presence in test grep-pattern code is OK,
|
||||
# but a real PEM block would have the header on its own line.
|
||||
real_key_hits="$(git ls-files | xargs grep -l -- "^-----BEGIN.*PRIVATE KEY-----" 2>/dev/null | \
|
||||
grep -vE "(tests|evidence|security/|security-check|verify-audit|tool-audit-lib|governance-check)" || true)"
|
||||
if [[ -z "$real_key_hits" ]]; then
|
||||
ok "No real private key PEM headers in tracked files"
|
||||
else
|
||||
fail "Private key PEM headers found in tracked files: $real_key_hits"
|
||||
fi
|
||||
|
||||
# ── 3. Audit PRIVATE key is NOT in the git index ───────────────────────────
|
||||
# PUBLIC keys (*-public.pem, policy-public.pem) are intentionally committed
|
||||
# for audit chain verification — that is correct design.
|
||||
# PRIVATE keys (*-private.pem, *-private.key, id_rsa, id_ed25519) must NEVER
|
||||
# be in the repo; the signing key lives at ~/.casan/audit-keys/ off-repo.
|
||||
repo_private_keys="$(git ls-files | grep -E '(private\.(pem|key)|id_rsa|id_ed25519|\.p12|\.pfx)$' 2>/dev/null || true)"
|
||||
if [[ -z "$repo_private_keys" ]]; then
|
||||
ok "No private key files in git index (public keys are allowed and expected)"
|
||||
else
|
||||
fail "Private key files in git index: $repo_private_keys"
|
||||
fi
|
||||
|
||||
# ── 4. .gitignore covers .env and key extensions ───────────────────────────
|
||||
gitignore="$ROOT/.gitignore"
|
||||
missing_patterns=()
|
||||
for pat in ".env" "*.pem" "*.key"; do
|
||||
if ! grep -qF "$pat" "$gitignore" 2>/dev/null; then
|
||||
missing_patterns+=("$pat")
|
||||
fi
|
||||
done
|
||||
if [[ ${#missing_patterns[@]} -eq 0 ]]; then
|
||||
ok ".gitignore covers .env and key extensions"
|
||||
else
|
||||
fail ".gitignore missing: ${missing_patterns[*]}"
|
||||
fi
|
||||
|
||||
# ── 5. No API key patterns in log/audit files ──────────────────────────────
|
||||
LOG_DIRS=(
|
||||
".specify/logs/audit"
|
||||
".specify/logs/level5"
|
||||
".specify/agentops"
|
||||
)
|
||||
API_KEY_REGEX='(sk-[A-Za-z0-9]{20,}|AKIA[0-9A-Z]{16}|ghp_[A-Za-z0-9]{36})'
|
||||
key_in_logs=""
|
||||
for dir in "${LOG_DIRS[@]}"; do
|
||||
if [[ -d "$ROOT/$dir" ]]; then
|
||||
hit="$(grep -rlE "$API_KEY_REGEX" "$ROOT/$dir" 2>/dev/null || true)"
|
||||
[[ -n "$hit" ]] && key_in_logs="$key_in_logs $hit"
|
||||
fi
|
||||
done
|
||||
if [[ -z "$key_in_logs" ]]; then
|
||||
ok "No API key patterns in audit/log files"
|
||||
else
|
||||
fail "API key pattern found in logs:$key_in_logs"
|
||||
fi
|
||||
|
||||
# ── 6. No ANTHROPIC_API_KEY or OPENAI_API_KEY in any tracked file ──────────
|
||||
key_in_code="$(git ls-files | xargs grep -l \
|
||||
'ANTHROPIC_API_KEY[[:space:]]*=[[:space:]]*[^$"'"'"'({][^[:space:]]' \
|
||||
2>/dev/null | grep -v '.env.example' || true)"
|
||||
if [[ -z "$key_in_code" ]]; then
|
||||
ok "No hardcoded API key assignments in tracked code"
|
||||
else
|
||||
warn "Possible hardcoded API key in: $key_in_code (verify manually)"
|
||||
fi
|
||||
|
||||
echo ""
|
||||
echo "=== Secrets scan: PASS=$PASS FAIL=$FAIL WARN=$WARN ==="
|
||||
echo "NOTE: historical leak scan (git history) requires git-secrets — run separately in CI."
|
||||
[[ "$FAIL" -eq 0 ]] || exit 1
|
||||
Reference in New Issue
Block a user