git

Documentation

Overview

Package git provides repository-aware helpers for dotenv-doctor.

The leak scan walks every commit reachable from HEAD and looks for blobs at .env-style paths. We rely on go-git so users do not need a system git binary, and so the tool stays a single static binary.

Index

• func IsTracked(repoDir, absPath string) bool
• func OriginURL(repoDir string) string
• func ParseGitHubOriginURL(url string) (string, string, bool)
• func RemediationHint(l Leak) string
• type Leak
  • func ScanRepo(repoDir string, limit int) ([]Leak, error)

Functions

func IsTracked

func IsTracked(repoDir, absPath string) bool

IsTracked reports whether absPath is currently tracked at HEAD in the repo rooted at repoDir. Used by the dashboard for fast committed-.env detection without walking history.

func OriginURL

func OriginURL(repoDir string) string

OriginURL returns the URL of the origin remote, or "" if not set.

func ParseGitHubOriginURL

func ParseGitHubOriginURL(url string) (string, string, bool)

ParseGitHubOriginURL extracts (owner, repo) from common GitHub remote URL formats: https://github.com/owner/repo(.git), git@github.com:owner/repo(.git), ssh://git@github.com/owner/repo(.git).

func RemediationHint

func RemediationHint(l Leak) string

RemediationHint returns copy-pastable advice for a leak.

Types

type Leak

type Leak struct {
	Repo        string             // git repo root
	Path        string             // path inside the repo of the offending file
	Commit      string             // full SHA
	ShortSHA    string             // 7-char SHA for display
	Author      string             // name <email>
	When        string             // RFC3339 timestamp
	Subject     string             // first line of commit message
	Findings    []classify.Finding // pattern matches
	StillExists bool               // file is still committed at HEAD
}

Leak describes a secret found in git history.

func ScanRepo

func ScanRepo(repoDir string, limit int) ([]Leak, error)

ScanRepo walks every commit and returns leaks for any .env-style file ever committed. `limit` caps the number of commits walked (0 = no limit). For large repos this matters.