javi-forge 1.25.1 → 1.26.0

package/templates/security-hooks/pre-commit-secrets

@@ -1,74 +0,0 @@
-#!/bin/bash
-# =============================================================================
-# SECURITY LAYER 1: Secret Scanning (pre-commit)
-# =============================================================================
-# Scans staged files for hardcoded secrets, API keys, and credentials.
-# Runs on every commit to prevent accidental secret leaks.
-#
-# Requires: git
-# To skip:  git commit --no-verify (NOT recommended)
-# =============================================================================
-
-set -e
-
-RED='\033[0;31m'
-YELLOW='\033[1;33m'
-GREEN='\033[0;32m'
-NC='\033[0m'
-
-echo "SECURITY [1/6]: Secret scanning..."
-
-# Patterns that indicate hardcoded secrets
-SECRET_PATTERNS=(
-    # AWS
-    'AKIA[0-9A-Z]{16}'
-    # Generic API keys (long hex/base64 strings assigned to key-like vars)
-    '(?i)(api[_-]?key|api[_-]?secret|access[_-]?token|auth[_-]?token)\s*[:=]\s*["\x27][A-Za-z0-9+/=_-]{20,}["\x27]'
-    # Private keys
-    '-----BEGIN (RSA |EC |DSA |OPENSSH )?PRIVATE KEY-----'
-    # GitHub tokens
-    'gh[pousr]_[A-Za-z0-9_]{36,}'
-    # Generic password assignments
-    '(?i)(password|passwd|pwd)\s*[:=]\s*["\x27][^\s"'\'']{8,}["\x27]'
-    # Slack tokens
-    'xox[baprs]-[0-9a-zA-Z-]+'
-    # Stripe keys
-    'sk_live_[0-9a-zA-Z]{24,}'
-    'rk_live_[0-9a-zA-Z]{24,}'
-    # SendGrid
-    'SG\.[A-Za-z0-9_-]{22}\.[A-Za-z0-9_-]{43}'
-)
-
-STAGED_FILES=$(git diff --cached --name-only --diff-filter=ACM)
-
-if [ -z "$STAGED_FILES" ]; then
-    echo -e "${GREEN}  No staged files to scan.${NC}"
-    exit 0
-fi
-
-FOUND=0
-for pattern in "${SECRET_PATTERNS[@]}"; do
-    # Use grep -P for perl-compatible regex, fall back to -E
-    MATCHES=$(echo "$STAGED_FILES" | xargs git diff --cached -- | grep -nP "$pattern" 2>/dev/null || true)
-    if [ -n "$MATCHES" ]; then
-        if [ "$FOUND" -eq 0 ]; then
-            echo -e "${RED}  Potential secrets detected in staged changes:${NC}"
-        fi
-        echo -e "${YELLOW}  Pattern: $pattern${NC}"
-        echo "$MATCHES" | head -5 | while read -r line; do
-            echo -e "${RED}    $line${NC}"
-        done
-        FOUND=$((FOUND + 1))
-    fi
-done
-
-if [ "$FOUND" -gt 0 ]; then
-    echo -e ""
-    echo -e "${RED}COMMIT BLOCKED: $FOUND secret pattern(s) detected.${NC}"
-    echo -e "${YELLOW}  Remove secrets and use environment variables instead.${NC}"
-    echo -e "${YELLOW}  If this is a false positive, add to .secret-scan-ignore${NC}"
-    exit 1
-fi
-
-echo -e "${GREEN}  No secrets found.${NC}"
-exit 0

package/templates/security-hooks/pre-push-branch-protection

@@ -1,62 +0,0 @@
-#!/bin/bash
-# =============================================================================
-# SECURITY LAYER 5: Branch Protection (pre-push)
-# =============================================================================
-# Prevents direct pushes to protected branches (main, master, release/*).
-# Forces use of pull requests for protected branches.
-#
-# To skip:  git push --no-verify (NOT recommended)
-# =============================================================================
-
-set -e
-
-RED='\033[0;31m'
-YELLOW='\033[1;33m'
-GREEN='\033[0;32m'
-NC='\033[0m'
-
-echo "SECURITY [5/6]: Branch protection check..."
-
-# Protected branch patterns
-PROTECTED_BRANCHES=(
-    "main"
-    "master"
-    "release/*"
-    "production"
-    "staging"
-)
-
-CURRENT_BRANCH=$(git rev-parse --abbrev-ref HEAD 2>/dev/null || echo "")
-
-if [ -z "$CURRENT_BRANCH" ]; then
-    echo -e "${YELLOW}  Could not determine current branch. Skipping.${NC}"
-    exit 0
-fi
-
-for pattern in "${PROTECTED_BRANCHES[@]}"; do
-    # Support glob patterns
-    if [[ "$CURRENT_BRANCH" == $pattern ]]; then
-        # Check if we're on CI (allow CI pushes)
-        if [ -n "$CI" ] || [ -n "$GITHUB_ACTIONS" ] || [ -n "$GITLAB_CI" ]; then
-            echo -e "${GREEN}  CI environment detected. Allowing push to $CURRENT_BRANCH.${NC}"
-            exit 0
-        fi
-
-        echo -e ""
-        echo -e "${RED}PUSH BLOCKED: Direct push to protected branch '$CURRENT_BRANCH'.${NC}"
-        echo -e ""
-        echo -e "${YELLOW}  Protected branches require pull requests:${NC}"
-        for b in "${PROTECTED_BRANCHES[@]}"; do
-            echo -e "${YELLOW}    - $b${NC}"
-        done
-        echo -e ""
-        echo -e "${YELLOW}  Create a feature branch and open a PR instead:${NC}"
-        echo -e "${GREEN}    git checkout -b feat/my-feature${NC}"
-        echo -e "${GREEN}    git push -u origin feat/my-feature${NC}"
-        echo -e "${GREEN}    gh pr create${NC}"
-        exit 1
-    fi
-done
-
-echo -e "${GREEN}  Branch '$CURRENT_BRANCH' is not protected. OK.${NC}"
-exit 0

package/templates/security-hooks/pre-push-deps

@@ -1,83 +0,0 @@
-#!/bin/bash
-# =============================================================================
-# SECURITY LAYER 2: Dependency Audit (pre-push)
-# =============================================================================
-# Runs dependency vulnerability audit before pushing.
-# Checks for known CVEs in project dependencies.
-#
-# Supports: npm/pnpm/yarn, pip-audit, cargo audit, govulncheck
-# To skip:  git push --no-verify (NOT recommended)
-# =============================================================================
-
-set -e
-
-RED='\033[0;31m'
-YELLOW='\033[1;33m'
-GREEN='\033[0;32m'
-NC='\033[0m'
-
-echo "SECURITY [2/6]: Dependency audit..."
-
-# Auto-detect stack and run appropriate audit
-if [ -f "package.json" ]; then
-    if [ -f "pnpm-lock.yaml" ]; then
-        echo -e "${YELLOW}  Running: pnpm audit${NC}"
-        pnpm audit --audit-level=high 2>/dev/null || {
-            echo -e "${RED}  High/critical vulnerabilities found in dependencies.${NC}"
-            echo -e "${YELLOW}  Run 'pnpm audit' for details, 'pnpm audit --fix' to auto-fix.${NC}"
-            exit 1
-        }
-    elif [ -f "yarn.lock" ]; then
-        echo -e "${YELLOW}  Running: yarn npm audit${NC}"
-        yarn npm audit --severity high 2>/dev/null || {
-            echo -e "${RED}  High/critical vulnerabilities found in dependencies.${NC}"
-            echo -e "${YELLOW}  Run 'yarn npm audit' for details.${NC}"
-            exit 1
-        }
-    else
-        echo -e "${YELLOW}  Running: npm audit${NC}"
-        npm audit --audit-level=high 2>/dev/null || {
-            echo -e "${RED}  High/critical vulnerabilities found in dependencies.${NC}"
-            echo -e "${YELLOW}  Run 'npm audit' for details, 'npm audit fix' to auto-fix.${NC}"
-            exit 1
-        }
-    fi
-elif [ -f "requirements.txt" ] || [ -f "pyproject.toml" ]; then
-    if command -v pip-audit &>/dev/null; then
-        echo -e "${YELLOW}  Running: pip-audit${NC}"
-        pip-audit 2>/dev/null || {
-            echo -e "${RED}  Vulnerabilities found in Python dependencies.${NC}"
-            echo -e "${YELLOW}  Run 'pip-audit' for details.${NC}"
-            exit 1
-        }
-    else
-        echo -e "${YELLOW}  pip-audit not installed. Skipping. Install: pip install pip-audit${NC}"
-    fi
-elif [ -f "Cargo.toml" ]; then
-    if command -v cargo-audit &>/dev/null; then
-        echo -e "${YELLOW}  Running: cargo audit${NC}"
-        cargo audit 2>/dev/null || {
-            echo -e "${RED}  Vulnerabilities found in Rust dependencies.${NC}"
-            echo -e "${YELLOW}  Run 'cargo audit' for details.${NC}"
-            exit 1
-        }
-    else
-        echo -e "${YELLOW}  cargo-audit not installed. Skipping. Install: cargo install cargo-audit${NC}"
-    fi
-elif [ -f "go.mod" ]; then
-    if command -v govulncheck &>/dev/null; then
-        echo -e "${YELLOW}  Running: govulncheck${NC}"
-        govulncheck ./... 2>/dev/null || {
-            echo -e "${RED}  Vulnerabilities found in Go dependencies.${NC}"
-            echo -e "${YELLOW}  Run 'govulncheck ./...' for details.${NC}"
-            exit 1
-        }
-    else
-        echo -e "${YELLOW}  govulncheck not installed. Skipping. Install: go install golang.org/x/vuln/cmd/govulncheck@latest${NC}"
-    fi
-else
-    echo -e "${YELLOW}  No supported dependency manifest found. Skipping.${NC}"
-fi
-
-echo -e "${GREEN}  Dependency audit passed.${NC}"
-exit 0

package/templates/security-hooks/pre-push-signing

@@ -1,67 +0,0 @@
-#!/bin/bash
-# =============================================================================
-# SECURITY LAYER 4: Code Signing Verification (pre-push)
-# =============================================================================
-# Checks that commits being pushed are GPG/SSH signed (if configured).
-# Warns but does not block if signing is not configured.
-#
-# To skip:  git push --no-verify (NOT recommended)
-# =============================================================================
-
-set -e
-
-RED='\033[0;31m'
-YELLOW='\033[1;33m'
-GREEN='\033[0;32m'
-CYAN='\033[0;36m'
-NC='\033[0m'
-
-echo "SECURITY [4/6]: Code signing check..."
-
-# Check if commit signing is configured
-SIGN_KEY=$(git config --get user.signingkey 2>/dev/null || echo "")
-GPG_SIGN=$(git config --get commit.gpgsign 2>/dev/null || echo "false")
-GPG_FORMAT=$(git config --get gpg.format 2>/dev/null || echo "openpgp")
-
-if [ -z "$SIGN_KEY" ] || [ "$GPG_SIGN" != "true" ]; then
-    echo -e "${YELLOW}  Commit signing not configured. Skipping verification.${NC}"
-    echo -e "${CYAN}  To enable: git config --global commit.gpgsign true${NC}"
-    echo -e "${CYAN}  GPG:  git config --global user.signingkey <KEY_ID>${NC}"
-    echo -e "${CYAN}  SSH:  git config --global gpg.format ssh && git config --global user.signingkey ~/.ssh/id_ed25519.pub${NC}"
-    exit 0
-fi
-
-# Verify recent commits are signed
-REMOTE="$1"
-URL="$2"
-
-while read -r LOCAL_REF LOCAL_OID REMOTE_REF REMOTE_OID; do
-    if [ "$LOCAL_OID" = "0000000000000000000000000000000000000000" ]; then
-        continue  # Branch deletion
-    fi
-
-    # Check last 10 commits (or all new ones)
-    RANGE=""
-    if [ "$REMOTE_OID" = "0000000000000000000000000000000000000000" ]; then
-        RANGE="$LOCAL_OID"
-    else
-        RANGE="$REMOTE_OID..$LOCAL_OID"
-    fi
-
-    UNSIGNED=$(git log --format='%H %G?' "$RANGE" 2>/dev/null | grep -E ' N$' | head -5 || true)
-
-    if [ -n "$UNSIGNED" ]; then
-        echo -e "${YELLOW}  Warning: unsigned commits detected:${NC}"
-        echo "$UNSIGNED" | while read -r hash status; do
-            MSG=$(git log --format='%s' -1 "$hash" 2>/dev/null)
-            echo -e "${YELLOW}    ${hash:0:8} $MSG${NC}"
-        done
-        echo -e "${YELLOW}  Signing is configured but some commits are unsigned.${NC}"
-        echo -e "${CYAN}  To sign: git commit -S -m 'message'${NC}"
-        echo -e "${CYAN}  To amend: git commit --amend -S${NC}"
-        # Warning only, don't block
-    fi
-done
-
-echo -e "${GREEN}  Signing check complete.${NC}"
-exit 0