OXYGENHUB
◆ v0.7.0 oxygenhub / crates / hub / migrations / 0085_push_protection.sql
1.2 KiB · SQL · last changed Push protection: refuse a push that adds what looks like a secret 16 days ago source blame history raw
1 
-- Push protection (oxygenhub#268): whether pushes that add possible
2 
-- secrets are refused (on by default), the fingerprints a maintainer let
3 
-- through, and the findings of recent refusals for maintainers to judge.
4 
ALTER TABLE repositories ADD COLUMN push_protection INTEGER NOT NULL DEFAULT 1;
5 
CREATE TABLE secret_bypasses (
6 
    id         INTEGER PRIMARY KEY,
7 
    repo_id    INTEGER NOT NULL REFERENCES repositories(id) ON DELETE CASCADE,
8 
    fingerprint TEXT NOT NULL,
9 
    rule       TEXT NOT NULL DEFAULT '',
10 
    reason     TEXT NOT NULL,
11 
    by_account INTEGER REFERENCES accounts(id) ON DELETE SET NULL,
12 
    by_name    TEXT NOT NULL DEFAULT '',
13 
    created_ms INTEGER NOT NULL,
14 
    UNIQUE (repo_id, fingerprint)
15 
);
16 
CREATE TABLE secret_findings (
17 
    id          INTEGER PRIMARY KEY,
18 
    repo_id     INTEGER NOT NULL REFERENCES repositories(id) ON DELETE CASCADE,
19 
    at_ms       INTEGER NOT NULL,
20 
    pusher      TEXT NOT NULL DEFAULT '',
21 
    via         TEXT NOT NULL DEFAULT '',
22 
    rule        TEXT NOT NULL,
23 
    description TEXT NOT NULL,
24 
    path        TEXT NOT NULL,
25 
    line        INTEGER NOT NULL,
26 
    fingerprint TEXT NOT NULL,
27 
    excerpt     TEXT NOT NULL
28 
);
29 
CREATE INDEX secret_findings_repo ON secret_findings(repo_id, id);