Find projects to fix in github based on matches in semaphore 2.0 secrets

find-github-projects.py

import json
import pprint
import base64
import requests
import os


"""
export SECRET_NEEDLE=xxxx
export GITHUB_ORG=xxxxx
export GITHUB_TOKEN=xxxxx
export SEMAPHORE_ORG=xxxxx
export SEMAPHORE_TOKEN=xxxx
"""

SECRET_NEEDLE = os.environ.get('SECRET_NEEDLE')
if not SECRET_NEEDLE:
    raise RuntimeError('please export SECRET_NEEDLE')

GITHUB_ORG = os.environ.get('GITHUB_ORG')
if not GITHUB_ORG:
    raise RuntimeError('please export GITHUB_ORG')

GITHUB_TOKEN = os.environ.get('GITHUB_TOKEN')
if not GITHUB_TOKEN:
    raise RuntimeError('please export GITHUB_TOKEN')

SEMAPHORE_ORG = os.environ.get('SEMAPHORE_ORG')
if not SEMAPHORE_ORG:
    raise RuntimeError('please export SEMAPHORE_ORG')

SEMAPHORE_TOKEN = os.environ.get('SEMAPHORE_TOKEN')
if not SEMAPHORE_TOKEN:
    # e.g. check in ~/.sem.yaml
    raise RuntimeError('please export SEMAPHORE_TOKEN')

headers = {'Authorization': f'Token {SEMAPHORE_TOKEN}'}
data = requests.get(f'https://{SEMAPHORE_ORG}.semaphoreci.com/api/v1beta/secrets', headers=headers).json()


def decode64(value):
    try:
        return base64.decodebytes(value.encode('utf8')).decode('utf8', 'replace')
    except TypeError:
        return ''
    except base64.binascii.Error:
        return ''


bad_secrets = []
for secret in data['secrets']:
    secret_name = secret['metadata']['name']
    secret_data = secret['data']
    matches = []
    for env_var in secret_data.get('env_vars', []):
        if SECRET_NEEDLE in env_var['name'] or SECRET_NEEDLE in env_var['value']:
            matches.append(f'\t- found match in {env_var["name"]}')
        elif SECRET_NEEDLE in decode64(env_var['value']):
            matches.append(f'\t- found match in {env_var["name"]} (base64 encoded)')
    for file_secret in secret_data.get('files', []):
        if SECRET_NEEDLE in decode64(file_secret['content']):
            matches.append(f'\t- found match in file {file_secret["path"]} (base64 encoded)')
    if matches:
        print(f'* secret {secret_name}')
        bad_secrets.append(secret_name)
        for match in matches:
            print(match)


session = requests.Session()
session.headers.update({'Authorization': f'token {GITHUB_TOKEN}'})

projects = {}

for secret_name in bad_secrets:
    page = 1
    paths = {}
    while True:
        q = f'https://api.github.com/search/code?q={secret_name}+org:{GITHUB_ORG}&per_page=100&page={page}'
        response = session.get(q)
        page += 1
        r = response.json()
        for item in r['items']:
            paths.setdefault(item['path'], []).append(item['html_url'])
        if not int(response.headers['X-RateLimit-Remaining']):
            print('sleep to avoid rate limit')
            time.sleep(60.)
        if 'rel="next"' not in response.headers.get('Link', ''):
            break
    projects[secret_name] = set()
    fixes = []
    for p in paths.get('.semaphore/semaphore.yml', []):
        project = p.split('/')[4]
        projects[secret_name].add(project)
        fixes.append(f'\t- need to fix {project}')
    if fixes:
        print(f'* secret {secret_name}')
        for fix in fixes:
            print(fix)

LICENSE

The MIT License

Copyright (c) 2020, Damien Nozay

Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:

The above copyright notice and this permission notice shall be included in
all copies or substantial portions of the Software.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
THE SOFTWARE.