Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Secrets in examples #80

Open
sckott opened this issue Jan 21, 2025 · 2 comments
Open

Secrets in examples #80

sckott opened this issue Jan 21, 2025 · 2 comments
Milestone

Comments

@sckott
Copy link
Member

sckott commented Jan 21, 2025

So aws secret key and access key are not likely to end up in examples output, but account id and possibly region may end up in output. Region is probably not an issue but the googling I've done so far suggests it's best to hide account id too.

Not sure how to deal with this yet, but here are some options:

  1. After examples are run, run a script to scrub al the .Rd files, just read each file in, look for any secrets line by line, and replace the string if found, then writelines back. Not sure if this will be straightforward or not. This could be run every time docs are generated via Makefile route, which I always use, but we can't be certain some commits in the future won't use a different approach to generate docs.
  2. Have a separate function (which has to be exported) to scrub secrets - already written this locally. Downside of this is we have an additional function in the example and then have to explain in each instance why its there. Just seems sloppy
  3. Have logic inside all functions or just the set we know that may output account id that scrubs it whenever we detect that it's being run to generate docs - not sure this is possible yet, haven't tried. I don't love this approach because it adds extra code into many functions that's not related to the point/goal of the function, sloppy

Regardless of approach used above, ideally we have a pre-commit hook or something similar to check for any secrets and stop the commit if there are any found

@sckott sckott added this to the v0.2 milestone Jan 21, 2025
@sckott
Copy link
Member Author

sckott commented Jan 21, 2025

(related #71)

@sckott
Copy link
Member Author

sckott commented Jan 29, 2025

likely to go with option 2 above, and have it mostly implemented locally under function mask in dir sixtyfour-mask-scripts

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant