build: add missing security/lint targets
ober
abef43ca0557dfcd3868b97ec60966792c5b58ae
--- a/Makefile +++ b/Makefile @@ -94,7 +94,7 @@ PODMAN ?= podman jerboa-yubikey-lib check-yubikey-lib-fresh \ yubikey-native-linux-amd64 yubikey-native-linux-arm64 \ vendor-deps vendor-deps-linux vendor-native-rs vendor-native-rs-pruned \ - install install-binary install-shims learn-codex-shim lint + install install-binary install-shims learn-codex-shim lint security all: ffi jerboa compile @@ -1039,6 +1039,14 @@ check-platforms: lint: @sh support/security-policy-check.sh +security: + @echo "==> security: high-confidence secret scan" + @if git grep -nIE '(AKIA[0-9A-Z]{16}|-----BEGIN (RSA |EC |OPENSSH )?PRIVATE KEY-----|aws_secret_access_key|GH_TOKEN|sk-[A-Za-z0-9]{20,})' -- ':!vendor' ':!*.lock' ':!test*' ':!Makefile' ':!*.md' ':!.gitsafe.json' ':!.github' ':!shims' 2>/dev/null; then \ + echo "SECURITY: potential secret detected" >&2; exit 1; \ + else \ + echo "security: no high-confidence secrets found"; \ + fi + install-hooks: @if [ ! -d .git ]; then echo "not a git checkout — cannot install hooks" >&2; exit 1; fi @mkdir -p .git/hooks