Skip to content

Instantly share code, notes, and snippets.

@dnozay
Created April 10, 2020 16:00
Show Gist options
  • Save dnozay/7ccb137d6e2cc0db747f0bb13ebebb48 to your computer and use it in GitHub Desktop.
Save dnozay/7ccb137d6e2cc0db747f0bb13ebebb48 to your computer and use it in GitHub Desktop.
Find projects to fix in github based on matches in semaphore 2.0 secrets
import json
import pprint
import base64
import requests
import os
"""
export SECRET_NEEDLE=xxxx
export GITHUB_ORG=xxxxx
export GITHUB_TOKEN=xxxxx
export SEMAPHORE_ORG=xxxxx
export SEMAPHORE_TOKEN=xxxx
"""
SECRET_NEEDLE = os.environ.get('SECRET_NEEDLE')
if not SECRET_NEEDLE:
raise RuntimeError('please export SECRET_NEEDLE')
GITHUB_ORG = os.environ.get('GITHUB_ORG')
if not GITHUB_ORG:
raise RuntimeError('please export GITHUB_ORG')
GITHUB_TOKEN = os.environ.get('GITHUB_TOKEN')
if not GITHUB_TOKEN:
raise RuntimeError('please export GITHUB_TOKEN')
SEMAPHORE_ORG = os.environ.get('SEMAPHORE_ORG')
if not SEMAPHORE_ORG:
raise RuntimeError('please export SEMAPHORE_ORG')
SEMAPHORE_TOKEN = os.environ.get('SEMAPHORE_TOKEN')
if not SEMAPHORE_TOKEN:
# e.g. check in ~/.sem.yaml
raise RuntimeError('please export SEMAPHORE_TOKEN')
headers = {'Authorization': f'Token {SEMAPHORE_TOKEN}'}
data = requests.get(f'https://{SEMAPHORE_ORG}.semaphoreci.com/api/v1beta/secrets', headers=headers).json()
def decode64(value):
try:
return base64.decodebytes(value.encode('utf8')).decode('utf8', 'replace')
except TypeError:
return ''
except base64.binascii.Error:
return ''
bad_secrets = []
for secret in data['secrets']:
secret_name = secret['metadata']['name']
secret_data = secret['data']
matches = []
for env_var in secret_data.get('env_vars', []):
if SECRET_NEEDLE in env_var['name'] or SECRET_NEEDLE in env_var['value']:
matches.append(f'\t- found match in {env_var["name"]}')
elif SECRET_NEEDLE in decode64(env_var['value']):
matches.append(f'\t- found match in {env_var["name"]} (base64 encoded)')
for file_secret in secret_data.get('files', []):
if SECRET_NEEDLE in decode64(file_secret['content']):
matches.append(f'\t- found match in file {file_secret["path"]} (base64 encoded)')
if matches:
print(f'* secret {secret_name}')
bad_secrets.append(secret_name)
for match in matches:
print(match)
session = requests.Session()
session.headers.update({'Authorization': f'token {GITHUB_TOKEN}'})
projects = {}
for secret_name in bad_secrets:
page = 1
paths = {}
while True:
q = f'https://api.github.com/search/code?q={secret_name}+org:{GITHUB_ORG}&per_page=100&page={page}'
response = session.get(q)
page += 1
r = response.json()
for item in r['items']:
paths.setdefault(item['path'], []).append(item['html_url'])
if not int(response.headers['X-RateLimit-Remaining']):
print('sleep to avoid rate limit')
time.sleep(60.)
if 'rel="next"' not in response.headers.get('Link', ''):
break
projects[secret_name] = set()
fixes = []
for p in paths.get('.semaphore/semaphore.yml', []):
project = p.split('/')[4]
projects[secret_name].add(project)
fixes.append(f'\t- need to fix {project}')
if fixes:
print(f'* secret {secret_name}')
for fix in fixes:
print(fix)
The MIT License
Copyright (c) 2020, Damien Nozay
Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:
The above copyright notice and this permission notice shall be included in
all copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
THE SOFTWARE.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment