from pathlib import Path
import subprocess, re, json
out=Path('/home/node/.openclaw/workspace/audits/argocd-repo-20260615')
repo=Path('/home/node/.openclaw/workspace/repos/old-argocd')
patterns=[
 ('password', re.compile(r'(?i)(password|passwd|pwd|rootPassword|adminPassword)\s*[:=]\s*([^\s#]+)')),
 ('token_or_key', re.compile(r'(?i)(token|api[_-]?key|secret[_-]?key|client[_-]?secret)\s*[:=]\s*([^\s#]+)')),
 ('github_pat', re.compile(r'gh[pousr]_[A-Za-z0-9_]{20,}')),
 ('private_key', re.compile(r'-----BEGIN [A-Z ]*PRIVATE KEY-----')),
 ('basic_auth_url', re.compile(r'https?://[^\s:/]+:[^\s@]+@')),
]
commits=subprocess.check_output(['git','rev-list','--all'], cwd=repo, text=True).splitlines()
findings=[]
for c in commits:
    tree_files=subprocess.check_output(['git','ls-tree','-r','--name-only',c], cwd=repo, text=True).splitlines()
    for f in tree_files:
        if not re.search(r'\.(ya?ml|json|env|txt|tpl|sh)$|(^|/)Chart\.yaml$', f):
            continue
        try:
            blob=subprocess.check_output(['git','show',f'{c}:{f}'], cwd=repo, text=True, stderr=subprocess.DEVNULL, errors='ignore')
        except Exception:
            continue
        for i,line in enumerate(blob.splitlines(),1):
            for typ,pat in patterns:
                if pat.search(line):
                    masked=re.sub(r'(:\s*|=\s*)([^\s#]+)', r'\1<redacted>', line.strip())
                    masked=re.sub(r'gh[pousr]_[A-Za-z0-9_]{6,}', 'gh*_REDACTED', masked)
                    masked=re.sub(r'https?://([^\s:/]+):([^\s@]+)@', r'https://\1:***@', masked)
                    findings.append({'commit':c[:12],'type':typ,'file':f,'line':i,'text':masked[:220]})
seen=set(); ded=[]
for x in findings:
    k=(x['type'],x['file'],x['line'],x['text'])
    if k not in seen:
        seen.add(k); ded.append(x)
(out/'git-history-secret-scan-masked.json').write_text(json.dumps(ded,indent=2,ensure_ascii=False))
with (out/'git-history-secret-scan-summary.md').open('w') as fh:
    fh.write('# Git history secret scan summary (masked)\n\n')
    fh.write(f'- commits scanned: {len(commits)}\n')
    fh.write(f'- unique masked findings: {len(ded)}\n\n')
    counts={}
    for x in ded: counts[x['type']]=counts.get(x['type'],0)+1
    for typ,cnt in sorted(counts.items()): fh.write(f'- {typ}: {cnt}\n')
    fh.write('\n## Findings\n\n')
    for x in ded[:300]:
        fh.write(f"- {x['type']} `{x['file']}:{x['line']}` commit `{x['commit']}` — `{x['text']}`\n")
print('history_commits',len(commits),'unique_findings',len(ded))