OXYGENHUB
◆ v0.9.8 oxygenhub / crates / hub / migrations-pg / 0085_push_protection.sql
1.3 KiB · SQL · last changed Push protection: refuse a push that adds what looks like a secret 16 days ago source blame history raw
1 
-- Push protection (oxygenhub#268): whether pushes that add possible
2 
-- secrets are refused (on by default), the fingerprints a maintainer let
3 
-- through, and the findings of recent refusals for maintainers to judge.
4 
ALTER TABLE repositories ADD COLUMN push_protection BOOLEAN NOT NULL DEFAULT TRUE;
5 
CREATE TABLE secret_bypasses (
6 
    id         BIGINT GENERATED BY DEFAULT AS IDENTITY PRIMARY KEY,
7 
    repo_id    BIGINT NOT NULL REFERENCES repositories(id) ON DELETE CASCADE,
8 
    fingerprint TEXT NOT NULL,
9 
    rule       TEXT NOT NULL DEFAULT '',
10 
    reason     TEXT NOT NULL,
11 
    by_account BIGINT REFERENCES accounts(id) ON DELETE SET NULL,
12 
    by_name    TEXT NOT NULL DEFAULT '',
13 
    created_ms BIGINT NOT NULL,
14 
    UNIQUE (repo_id, fingerprint)
15 
);
16 
CREATE TABLE secret_findings (
17 
    id          BIGINT GENERATED BY DEFAULT AS IDENTITY PRIMARY KEY,
18 
    repo_id     BIGINT NOT NULL REFERENCES repositories(id) ON DELETE CASCADE,
19 
    at_ms       BIGINT NOT NULL,
20 
    pusher      TEXT NOT NULL DEFAULT '',
21 
    via         TEXT NOT NULL DEFAULT '',
22 
    rule        TEXT NOT NULL,
23 
    description TEXT NOT NULL,
24 
    path        TEXT NOT NULL,
25 
    line        BIGINT NOT NULL,
26 
    fingerprint TEXT NOT NULL,
27 
    excerpt     TEXT NOT NULL
28 
);
29 
CREATE INDEX secret_findings_repo ON secret_findings(repo_id, id);