368
Seriously how many times does this have to happen (lemmy.world)
submitted 2 months ago by carrylex@lemmy.world to c/programmer_humor@programming.dev
45 comments fedilink hide all child comments

One does not commit or compile credentials

Template

Context:

This meme was brought to you by the PyPI Director of Infrastructure who accidentally hardcoded credentials - which could have resulted in compromissing the entire core Python ecosystem.

you are viewing a single comment's thread
view the rest of the comments
[-] dan@upvote.au 53 points 2 months ago* (last edited 2 months ago)

At my workplace, we use the string @nocommit to designate code that shouldn't be checked in. Usually in a comment:

// @nocommit temporary for testing
apiKey = 'blah';
// apiKey = getKeyFromKeychain();

but it can be anywhere in the file.

There's a lint rule that looks for @nocommit in all modified files. It shows a lint error in dev and in our code review / build system, and commits that contain @nocommit anywhere are completely blocked from being merged.

(the code in the lint rule does something like "@no"+"commit" to avoid triggering itself)

[-] 8uurg@lemmy.world 7 points 2 months ago

Neat idea. This could be refined by adding a git hook that runs (rip)grep on the entire codebase and fails if anything is found upon commit may accomplish a similar result and stop the code from being committed entirely. Requires a bit more setup work on de developers end, though.

[-] dan@upvote.au 3 points 2 months ago* (last edited 2 months ago)

Would a git hook block you from committing it locally, or would it just run on the server side?

I'm not sure how our one at work is implemented, but we can actually commit @nocommit files in our local repo, and push them into the code review system. We just can't merge any changes that contain it.

It's used for common workflows like creating new database entities. During development, the ORM system creates a dev database on a test DB cluster and automatically points the code for the new table to it, with a @nocommit comment above it. When the code is approved, the new schema is pushed to prod and the code is updated to point to the real DB.

Also, the codebase is way too large for something like ripgrep to search the whole codebase in a reasonable time, which is why it only searches the commit diffs themselves.

[-] calcopiritus@lemmy.world 2 points 2 months ago

There are many git hooks. One of them checks each commit, but there's another that triggers on merges.

load more comments (10 replies)
this post was submitted on 12 Jul 2024
368 points (97.4% liked)

Programmer Humor

19187 readers
1112 users here now

Welcome to Programmer Humor!

This is a place where you can post jokes, memes, humor, etc. related to programming!

For sharing awful code theres also Programming Horror.

Rules

founded 1 year ago
MODERATORS
Feyter@programming.dev
anzo@programming.dev
BurningTurtle@programming.dev