mirror of
https://github.com/wanikua/danghuangshang.git
synced 2026-09-03 07:03:37 +08:00
2ac7f21468
新增： - docs/architecture-review-2026-03-21.md - 全项目深度审核报告 - docs/VERSIONS.md - 版本更新日志 - scripts/pre-commit-hook.sh - API Key 泄露检测 - scripts/cleanup-repo.sh - 仓库清理脚本 修复： - scripts/task-store.js - 添加 shebang 和执行权限 - scripts/context-compressor.js - 添加 shebang 和执行权限 - .gitignore - 添加 *.tar.gz 和独立仓库目录 改进： - configs/ming-neige/agents/silijian.md - 完善任务状态机使用说明 审核发现： ✅ 文档完整性：9/10 ✅ 代码质量：7/10 ✅ 安全性：7/10 ✅ 可维护性：7/10 ✅ 用户体验：9/10 总体：7.7/10 待修复 P0 问题： 1. API Key 泄露风险 → pre-commit hook 已添加 2. 生产配置和模板混用 → 待明确标记 3. 缺少监控告警 → health-check.sh 待创建
79 lines
2.7 KiB
Bash
Executable File
79 lines
2.7 KiB
Bash
Executable File
#!/bin/bash
|
||
# ============================================
|
||
# Pre-commit Hook - API Key 泄露检测
|
||
#
|
||
# 用法：
|
||
# .git/hooks/pre-commit 中调用此脚本
|
||
# 或直接运行：bash scripts/pre-commit-hook.sh
|
||
# ============================================
|
||
|
||
set -e
|
||
|
||
RED='\033[0;31m'
|
||
GREEN='\033[0;32m'
|
||
YELLOW='\033[1;33m'
|
||
NC='\033[0m'
|
||
|
||
echo -e "${YELLOW}🔍 正在检查可能的敏感信息...${NC}"
|
||
|
||
# 检测模式
|
||
PATTERNS=(
|
||
"sk-[a-zA-Z0-9]{20,}" # OpenAI/DashScope API Key
|
||
"ghp_[a-zA-Z0-9]{36}" # GitHub Personal Access Token
|
||
"xox[baprs]-[0-9a-zA-Z-]+" # Slack Token
|
||
"secret_[a-zA-Z0-9]{32}" # Notion Integration Secret
|
||
"cli_[a-zA-Z0-9]{16}" # 飞书 App ID
|
||
"Bearer [a-zA-Z0-9_-]{20,}" # Bearer Token
|
||
"-----BEGIN RSA PRIVATE KEY-----" # 私钥
|
||
"AKIA[0-9A-Z]{16}" # AWS Access Key
|
||
)
|
||
|
||
FOUND_ISSUES=0
|
||
|
||
for pattern in "${PATTERNS[@]}"; do
|
||
# 搜索暂存区文件
|
||
if git diff --cached --name-only | xargs grep -E "$pattern" 2>/dev/null; then
|
||
echo -e "${RED}❌ 检测到可能的敏感信息：$pattern${NC}"
|
||
FOUND_ISSUES=1
|
||
fi
|
||
done
|
||
|
||
# 额外检查：配置文件中的真实 API Key
|
||
CONFIG_FILES=$(git diff --cached --name-only | grep -E "openclaw\.json$|clawdbot\.json$" || true)
|
||
if [ -n "$CONFIG_FILES" ]; then
|
||
echo -e "${YELLOW}⚠️ 检测到配置文件变更，请确认不包含真实 API Key${NC}"
|
||
|
||
for file in $CONFIG_FILES; do
|
||
# 检查是否是模板文件（configs/ 下的可以提交）
|
||
if [[ "$file" == configs/* ]]; then
|
||
echo -e "${GREEN}✓ $file 是模板文件，允许提交${NC}"
|
||
else
|
||
# 检查是否包含真实 Key（非占位符）
|
||
if git diff --cached "$file" | grep -E '"apiKey":\s*"[^"]{20,}"' | grep -v "YOUR_" | grep -v "placeholder"; then
|
||
echo -e "${RED}❌ $file 包含疑似真实 API Key，禁止提交！${NC}"
|
||
FOUND_ISSUES=1
|
||
fi
|
||
fi
|
||
done
|
||
fi
|
||
|
||
if [ $FOUND_ISSUES -eq 1 ]; then
|
||
echo ""
|
||
echo -e "${RED}═══════════════════════════════════════${NC}"
|
||
echo -e "${RED}❌ 提交被拒绝！检测到可能的敏感信息${NC}"
|
||
echo -e "${RED}═══════════════════════════════════════${NC}"
|
||
echo ""
|
||
echo "请检查以上文件，确保不包含："
|
||
echo " - API Key（sk-xxx, ghp_xxx 等）"
|
||
echo " - Token（secret_xxx, Bearer xxx 等）"
|
||
echo " - 私钥文件"
|
||
echo ""
|
||
echo "如果确认是误报，可以使用 --no-verify 强制提交："
|
||
echo " git commit --no-verify -m \"...\""
|
||
echo ""
|
||
exit 1
|
||
fi
|
||
|
||
echo -e "${GREEN}✅ 未检测到敏感信息，允许提交${NC}"
|
||
exit 0
|