push-sentinel 0.1.2 → 0.1.4
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +17 -4
- package/hook-template.sh +1 -1
- package/package.json +1 -1
- package/src/install.js +2 -2
package/README.md
CHANGED
|
@@ -23,7 +23,7 @@ $ git push
|
|
|
23
23
|
## Install
|
|
24
24
|
|
|
25
25
|
```sh
|
|
26
|
-
npx push-sentinel install
|
|
26
|
+
npx --yes --prefer-online push-sentinel@latest install
|
|
27
27
|
```
|
|
28
28
|
|
|
29
29
|
That's it. Runs automatically on every `git push` from now on.
|
|
@@ -59,13 +59,13 @@ Want hard blocking for HIGH findings? Add `--block-on-high`:
|
|
|
59
59
|
|
|
60
60
|
```sh
|
|
61
61
|
# edit .git/hooks/pre-push, change the scan line to:
|
|
62
|
-
npx push-sentinel scan --local-sha "$local_sha" --remote-sha "$remote_sha" --block-on-high
|
|
62
|
+
npx --yes --prefer-online push-sentinel@latest scan --local-sha "$local_sha" --remote-sha "$remote_sha" --block-on-high
|
|
63
63
|
```
|
|
64
64
|
|
|
65
65
|
## Manual scan
|
|
66
66
|
|
|
67
67
|
```sh
|
|
68
|
-
npx push-sentinel scan
|
|
68
|
+
npx --yes --prefer-online push-sentinel@latest scan
|
|
69
69
|
```
|
|
70
70
|
|
|
71
71
|
Manual scan checks, in order:
|
|
@@ -78,14 +78,27 @@ Manual scan checks, in order:
|
|
|
78
78
|
## Uninstall
|
|
79
79
|
|
|
80
80
|
```sh
|
|
81
|
-
npx push-sentinel uninstall
|
|
81
|
+
npx --yes --prefer-online push-sentinel@latest uninstall
|
|
82
82
|
```
|
|
83
83
|
|
|
84
84
|
Your original `pre-push` hook is restored automatically.
|
|
85
85
|
|
|
86
|
+
## GitHub Actions
|
|
87
|
+
|
|
88
|
+
Want to enforce secret scanning across your team or org? Use the [GitHub Action](https://github.com/Pmaind/push-sentinel-action):
|
|
89
|
+
|
|
90
|
+
```yaml
|
|
91
|
+
- uses: Pmaind/push-sentinel-action@v1
|
|
92
|
+
env:
|
|
93
|
+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
|
94
|
+
```
|
|
95
|
+
|
|
96
|
+
Blocks PRs with HIGH severity findings and posts a comment with details.
|
|
97
|
+
|
|
86
98
|
## Details
|
|
87
99
|
|
|
88
100
|
- Scans only the commits being pushed — not your entire history
|
|
89
101
|
- Zero dependencies (Node.js stdlib only)
|
|
90
102
|
- Node.js >= 16
|
|
91
103
|
- Existing `pre-push` hooks are preserved and still run
|
|
104
|
+
- For the most predictable versioning in a repo, install as a dev dependency and run the local binary via `npx push-sentinel`
|
package/hook-template.sh
CHANGED
|
@@ -14,7 +14,7 @@ STDIN_DATA=""
|
|
|
14
14
|
while read local_ref local_sha remote_ref remote_sha; do
|
|
15
15
|
STDIN_DATA="${STDIN_DATA}${local_ref} ${local_sha} ${remote_ref} ${remote_sha}
|
|
16
16
|
"
|
|
17
|
-
npx push-sentinel scan --local-sha "$local_sha" --remote-sha "$remote_sha"
|
|
17
|
+
npx --yes --prefer-online push-sentinel@latest scan --local-sha "$local_sha" --remote-sha "$remote_sha"
|
|
18
18
|
RESULT=$?
|
|
19
19
|
if [ $RESULT -ne 0 ]; then
|
|
20
20
|
EXIT_CODE=$RESULT
|
package/package.json
CHANGED
package/src/install.js
CHANGED
|
@@ -41,7 +41,7 @@ STDIN_DATA=""
|
|
|
41
41
|
while read local_ref local_sha remote_ref remote_sha; do
|
|
42
42
|
STDIN_DATA="${'$'}{STDIN_DATA}${'$'}{local_ref} ${'$'}{local_sha} ${'$'}{remote_ref} ${'$'}{remote_sha}
|
|
43
43
|
"
|
|
44
|
-
npx push-sentinel scan --local-sha "$local_sha" --remote-sha "$remote_sha"
|
|
44
|
+
npx --yes --prefer-online push-sentinel@latest scan --local-sha "$local_sha" --remote-sha "$remote_sha"
|
|
45
45
|
RESULT=$?
|
|
46
46
|
if [ $RESULT -ne 0 ]; then
|
|
47
47
|
EXIT_CODE=$RESULT
|
|
@@ -79,7 +79,7 @@ function install() {
|
|
|
79
79
|
fs.writeFileSync(hookPath, hookContent(), 'utf8');
|
|
80
80
|
fs.chmodSync(hookPath, 0o755);
|
|
81
81
|
console.log('[push-sentinel] Installed pre-push hook.');
|
|
82
|
-
console.log('[push-sentinel] Tip: to block pushes on HIGH findings, edit the hook to use: npx push-sentinel scan --block-on-high');
|
|
82
|
+
console.log('[push-sentinel] Tip: to block pushes on HIGH findings, edit the hook to use: npx --yes --prefer-online push-sentinel@latest scan --block-on-high');
|
|
83
83
|
}
|
|
84
84
|
|
|
85
85
|
function uninstall() {
|