Added pre-commit and trivy scan configs

.github/workflows/build-and-test.yaml

@@ -1,5 +1,4 @@
 name: Build and Test
-
 on: [pull_request, push, workflow_dispatch]
 
 jobs:

.gitignore

@@ -8,3 +8,4 @@ dependencies/
 build/**
 .DS_Store
 */node_modules/*
+.pre-commit-trivy-cache/

.pre-commit-config.yaml

@@ -0,0 +1,15 @@
+repos:
+  - repo: https://github.com/mxab/pre-commit-trivy.git
+    rev: v0.5.1
+    hooks:
+      - id: trivyfs-docker
+        args:
+          - --scanners
+          - secret
+          - --secret-config
+          - /src/trivy-secret.yaml
+          - --skip-dirs
+          - /src/target
+          - --skip-dirs
+          - /src/.idea
+          - .

trivy-secret.yaml

@@ -0,0 +1,182 @@
+rules:
+  ##################
+  # UID2 Admin Key #
+  ##################
+  - id: uid2-admin-key-test
+    category: uid2
+    title: UID2 - Admin Key - Test
+    severity: CRITICAL
+    keywords:
+      - UID2-A-T
+    regex: (?P<secret>UID2-A-T-.{6}\..{38})
+    secret-group-name: secret
+  - id: uid2-admin-key-integ
+    category: uid2
+    title: UID2 - Admin Key - Integ
+    severity: CRITICAL
+    keywords:
+      - UID2-A-I
+    regex: (?P<secret>UID2-A-I-.{6}\..{38})
+    secret-group-name: secret
+  - id: uid2-admin-key-prod
+    category: uid2
+    title: UID2 - Admin Key - Prod
+    severity: CRITICAL
+    keywords:
+      - UID2-A-P
+    regex: (?P<secret>UID2-A-P-.{6}\..{38})
+    secret-group-name: secret
+
+  ###################
+  # UID2 Client Key #
+  ###################
+  - id: uid2-client-key-test
+    category: uid2
+    title: UID2 - Client Key - Test
+    severity: CRITICAL
+    keywords:
+      - UID2-C-T
+    regex: (?P<secret>UID2-C-T-.{6}\..{38})
+    secret-group-name: secret
+  - id: uid2-client-key-integ
+    category: uid2
+    title: UID2 - Client Key - Integ
+    severity: CRITICAL
+    keywords:
+      - UID2-C-I
+    regex: (?P<secret>UID2-C-I-.{6}\..{38})
+    secret-group-name: secret
+  - id: uid2-client-key-prod
+    category: uid2
+    title: UID2 - Client Key - Prod
+    severity: CRITICAL
+    keywords:
+      - UID2-C-P
+    regex: (?P<secret>UID2-C-P-.{6}\..{38})
+    secret-group-name: secret
+
+  #####################
+  # UID2 Operator Key #
+  #####################
+  - id: uid2-operator-key-test
+    category: uid2
+    title: UID2 - Operator Key - Test
+    severity: CRITICAL
+    keywords:
+      - UID2-O-T
+    regex: (?P<secret>UID2-O-T-.{6}\..{38})
+    secret-group-name: secret
+  - id: uid2-operator-key-integ
+    category: uid2
+    title: UID2 - Operator Key - Integ
+    severity: CRITICAL
+    keywords:
+      - UID2-O-I
+    regex: (?P<secret>UID2-O-I-.{6}\..{38})
+    secret-group-name: secret
+  - id: uid2-operator-key-prod
+    category: uid2
+    title: UID2 - Operator Key - Prod
+    severity: CRITICAL
+    keywords:
+      - UID2-O-P
+    regex: (?P<secret>UID2-O-P-.{6}\..{38})
+    secret-group-name: secret
+
+  ##################
+  # EUID Admin Key #
+  ##################
+  - id: euid-admin-key-test
+    category: euid
+    title: EUID - Admin Key - Test
+    severity: CRITICAL
+    keywords:
+      - EUID-A-T
+    regex: (?P<secret>EUID-A-T-.{6}\..{38})
+    secret-group-name: secret
+  - id: euid-admin-key-integ
+    category: euid
+    title: EUID - Admin Key - Integ
+    severity: CRITICAL
+    keywords:
+      - EUID-A-I
+    regex: (?P<secret>EUID-A-I-.{6}\..{38})
+    secret-group-name: secret
+  - id: euid-admin-key-prod
+    category: euid
+    title: EUID - Admin Key - Prod
+    severity: CRITICAL
+    keywords:
+      - EUID-A-P
+    regex: (?P<secret>EUID-A-P-.{6}\..{38})
+    secret-group-name: secret
+
+  ###################
+  # EUID Client Key #
+  ###################
+  - id: euid-client-key-test
+    category: euid
+    title: EUID - Client Key - Test
+    severity: CRITICAL
+    keywords:
+      - EUID-C-T
+    regex: (?P<secret>EUID-C-T-.{6}\..{38})
+    secret-group-name: secret
+  - id: euid-client-key-integ
+    category: euid
+    title: EUID - Client Key - Integ
+    severity: CRITICAL
+    keywords:
+      - EUID-C-I
+    regex: (?P<secret>EUID-C-I-.{6}\..{38})
+    secret-group-name: secret
+  - id: euid-client-key-prod
+    category: euid
+    title: EUID - Client Key - Prod
+    severity: CRITICAL
+    keywords:
+      - EUID-C-P
+    regex: (?P<secret>EUID-C-P-.{6}\..{38})
+    secret-group-name: secret
+
+  #####################
+  # EUID Operator Key #
+  #####################
+  - id: euid-operator-key-test
+    category: euid
+    title: EUID - Operator Key - Test
+    severity: CRITICAL
+    keywords:
+      - EUID-O-T
+    regex: (?P<secret>EUID-O-T-.{6}\..{38})
+    secret-group-name: secret
+  - id: euid-operator-key-integ
+    category: euid
+    title: EUID - Operator Key - Integ
+    severity: CRITICAL
+    keywords:
+      - EUID-O-I
+    regex: (?P<secret>EUID-O-I-.{6}\..{38})
+    secret-group-name: secret
+  - id: euid-operator-key-prod
+    category: euid
+    title: EUID - Operator Key - Prod
+    severity: CRITICAL
+    keywords:
+      - EUID-O-P
+    regex: (?P<secret>EUID-O-P-.{6}\..{38})
+    secret-group-name: secret
+
+disable-allow-rules:
+  - tests
+  - examples
+  - vendor
+  - usr-dirs
+  - locale-dir
+  - markdown
+  - node.js
+  - golang
+  - python
+  - rubygems
+  - wordpress
+  - anaconda-log