thanhnvandClaude Opus 4.8
36a4812ef3
Standard production layout: the OKR app (was nested under AINative_OKR_CASAN5/) is now
the repository root. No more wrapper directory.
- Promote AINative_OKR_CASAN5/* -> repo root (backend/ frontend/ packages/ apps/
.specify/ docs/ infra/ nginx/ scripts/ + configs). Merge tool dirs: .gitea (kept the
active deploy ci.yml, added harness-ci.yml + runbooks), .claude (agents/commands +
launch.json), .github moved up.
- Remove redundant: 00_SUBMISSION_PACKAGE, scattered root notes (FPT_CASAN_Full.md,
tu-tuong-casan.md, casan-tu-sinh..., casan_harness_assessment.md, source-review...,
README_CASAN5_REFINED.md), casan-next-plans/ and optimize-docs/ (competition/planning
artifacts — roadmap + design history preserved in git log / commit messages).
- Update all references to the old layout:
- .gitea/workflows/{ci,harness-ci}.yml, .github/workflows/{ci,deploy}.yml:
working-directory .; drop AINative_OKR_CASAN5/ prefix; .specify/{tests,scripts}
-> packages/casan-harness/... (.specify/logs state kept)
- .claude/launch.json, .gitea/*-runbook.md: path prefixes
- CLAUDE.md, README.md: docs/input -> apps/okr/domain/input
- policy-bundle.yaml: 8 policy paths -> packages/casan-harness/...; manifest re-signed
- secrets-scan.sh: fixture excludes -> new package/domain paths.
Full gate from the new root: PASS=64 FAIL=0 SKIP=3.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
126 lines
5.1 KiB
Bash
Executable File
126 lines
5.1 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
set -uo pipefail
|
|
|
|
# CASAN WP-S4 — Secrets lifecycle check.
|
|
# Verifies:
|
|
# 1. .env files are NOT in the git index (committed).
|
|
# 2. No real private keys appear in tracked files (test fixtures accepted with override).
|
|
# 3. No API key patterns in audit/log files.
|
|
# 4. .gitignore covers .env and key file extensions.
|
|
#
|
|
# Honest scope: this scans the local checkout and git index. It does NOT
|
|
# scan git history (past commits). Historical leak scanning requires
|
|
# git-secrets or similar tooling noted as a production recommendation.
|
|
#
|
|
# Exit: 0 all checks pass, 1 violation found, 2 scan error.
|
|
|
|
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
|
source "$SCRIPT_DIR/casan-paths.sh"
|
|
ROOT="$CASAN_APP_ROOT"
|
|
PASS=0; FAIL=0; WARN=0
|
|
|
|
ok() { echo " PASS $1"; PASS=$((PASS+1)); }
|
|
fail() { echo " FAIL $1"; FAIL=$((FAIL+1)); }
|
|
warn() { echo " WARN $1"; WARN=$((WARN+1)); }
|
|
|
|
echo "=== CASAN WP-S4: Secrets lifecycle scan ==="
|
|
|
|
cd "$ROOT"
|
|
|
|
# ── 1. No .env committed to git index ──────────────────────────────────────
|
|
committed_envs="$(git ls-files | grep -E '(^|/)\.env(\.|$)' 2>/dev/null || true)"
|
|
if [[ -z "$committed_envs" ]]; then
|
|
ok ".env files NOT in git index"
|
|
else
|
|
fail ".env files committed to git: $committed_envs"
|
|
fi
|
|
|
|
# ── 2. No real private keys in tracked files ───────────────────────────────
|
|
# Exclude known test-fixture files and evidence directories that intentionally
|
|
# contain the pattern as test data.
|
|
FIXTURE_EXCLUDES=(
|
|
"packages/casan-harness/tests/"
|
|
"docs/output/casan/evidence/"
|
|
"packages/casan-harness/security/"
|
|
"apps/okr/domain/corpus/"
|
|
"packages/casan-harness/scripts/bash/security-check.sh"
|
|
"packages/casan-harness/scripts/bash/verify-audit-chain.sh"
|
|
"packages/casan-harness/scripts/bash/verify-tool-audit.sh"
|
|
"packages/casan-harness/scripts/bash/tool-audit-lib.sh"
|
|
"packages/casan-harness/scripts/bash/governance-check.sh"
|
|
)
|
|
build_exclude_args() {
|
|
for ex in "${FIXTURE_EXCLUDES[@]}"; do printf -- "--exclude-dir=%s " "$ex"; done
|
|
}
|
|
|
|
# Look for actual private key headers — presence in test grep-pattern code is OK,
|
|
# but a real PEM block would have the header on its own line.
|
|
real_key_hits="$(git ls-files | xargs grep -l -- "^-----BEGIN.*PRIVATE KEY-----" 2>/dev/null | \
|
|
grep -vE "(tests|evidence|security/|security-check|verify-audit|tool-audit-lib|governance-check)" || true)"
|
|
if [[ -z "$real_key_hits" ]]; then
|
|
ok "No real private key PEM headers in tracked files"
|
|
else
|
|
fail "Private key PEM headers found in tracked files: $real_key_hits"
|
|
fi
|
|
|
|
# ── 3. Audit PRIVATE key is NOT in the git index ───────────────────────────
|
|
# PUBLIC keys (*-public.pem, policy-public.pem) are intentionally committed
|
|
# for audit chain verification — that is correct design.
|
|
# PRIVATE keys (*-private.pem, *-private.key, id_rsa, id_ed25519) must NEVER
|
|
# be in the repo; the signing key lives at ~/.casan/audit-keys/ off-repo.
|
|
repo_private_keys="$(git ls-files | grep -E '(private\.(pem|key)|id_rsa|id_ed25519|\.p12|\.pfx)$' 2>/dev/null || true)"
|
|
if [[ -z "$repo_private_keys" ]]; then
|
|
ok "No private key files in git index (public keys are allowed and expected)"
|
|
else
|
|
fail "Private key files in git index: $repo_private_keys"
|
|
fi
|
|
|
|
# ── 4. .gitignore covers .env and key extensions ───────────────────────────
|
|
gitignore="$ROOT/.gitignore"
|
|
missing_patterns=()
|
|
for pat in ".env" "*.pem" "*.key"; do
|
|
if ! grep -qF "$pat" "$gitignore" 2>/dev/null; then
|
|
missing_patterns+=("$pat")
|
|
fi
|
|
done
|
|
if [[ ${#missing_patterns[@]} -eq 0 ]]; then
|
|
ok ".gitignore covers .env and key extensions"
|
|
else
|
|
fail ".gitignore missing: ${missing_patterns[*]}"
|
|
fi
|
|
|
|
# ── 5. No API key patterns in log/audit files ──────────────────────────────
|
|
LOG_DIRS=(
|
|
".specify/logs/audit"
|
|
".specify/logs/level5"
|
|
".specify/agentops"
|
|
)
|
|
API_KEY_REGEX='(sk-[A-Za-z0-9]{20,}|AKIA[0-9A-Z]{16}|ghp_[A-Za-z0-9]{36})'
|
|
key_in_logs=""
|
|
for dir in "${LOG_DIRS[@]}"; do
|
|
if [[ -d "$ROOT/$dir" ]]; then
|
|
hit="$(grep -rlE "$API_KEY_REGEX" "$ROOT/$dir" 2>/dev/null || true)"
|
|
[[ -n "$hit" ]] && key_in_logs="$key_in_logs $hit"
|
|
fi
|
|
done
|
|
if [[ -z "$key_in_logs" ]]; then
|
|
ok "No API key patterns in audit/log files"
|
|
else
|
|
fail "API key pattern found in logs:$key_in_logs"
|
|
fi
|
|
|
|
# ── 6. No ANTHROPIC_API_KEY or OPENAI_API_KEY in any tracked file ──────────
|
|
key_in_code="$(git ls-files | xargs grep -l \
|
|
'ANTHROPIC_API_KEY[[:space:]]*=[[:space:]]*[^$"'"'"'({][^[:space:]]' \
|
|
2>/dev/null | grep -v '.env.example' || true)"
|
|
if [[ -z "$key_in_code" ]]; then
|
|
ok "No hardcoded API key assignments in tracked code"
|
|
else
|
|
warn "Possible hardcoded API key in: $key_in_code (verify manually)"
|
|
fi
|
|
|
|
echo ""
|
|
echo "=== Secrets scan: PASS=$PASS FAIL=$FAIL WARN=$WARN ==="
|
|
echo "NOTE: historical leak scan (git history) requires git-secrets — run separately in CI."
|
|
[[ "$FAIL" -eq 0 ]] || exit 1
|