ripsecrets 0.1.11

A command-line tool to prevent committing secret keys into your source code
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129

{
  description =
    "A command-line tool to prevent committing secret keys into your source code";

  inputs = {
    nixpkgs.url = "github:NixOS/nixpkgs";
    crane.url = "github:ipetkov/crane";
    flake-utils.url = "github:numtide/flake-utils";
    rust-overlay = {
      url = "github:oxalica/rust-overlay";
      inputs.nixpkgs.follows = "nixpkgs";
    };
    advisory-db = {
      url = "github:rustsec/advisory-db";
      flake = false;
    };
    pre-commit-hooks.url = "github:cachix/pre-commit-hooks.nix";
  };

  outputs = { self, nixpkgs, crane, flake-utils, rust-overlay, advisory-db
    , pre-commit-hooks }:
    {
      overlays.default =
        (final: prev: { inherit (self.packages.${final.system}) ripsecrets; });
    } // flake-utils.lib.eachDefaultSystem (system:
      let
        craneLib = crane.mkLib nixpkgs.legacyPackages.${system};
        src = craneLib.cleanCargoSource ./.;

        pkgs = import nixpkgs {
          inherit system;
          overlays = [ (import rust-overlay) ];
        };

        nativeBuildInputs = pkgs.lib.optionals pkgs.stdenv.isDarwin [
          # Additional darwin specific inputs can be set here
          pkgs.gcc
          pkgs.libiconv
        ];

        # Build *just* the cargo dependencies, so we can reuse
        # all of that work (e.g. via cachix) when running in CI
        cargoArtifacts =
          craneLib.buildDepsOnly { inherit src nativeBuildInputs; };

        # Build ripsecrets itself, reusing the dependency artifacts from above.
        ripsecrets = craneLib.buildPackage {
          inherit cargoArtifacts src nativeBuildInputs;
          doCheck = false;
          meta = with pkgs.lib; {
            description =
              "A command-line tool to prevent committing secret keys into your source code";
            homepage = "https://github.com/sirwart/ripsecrets";
            maintainers = [ maintainers.lafrenierejm ];
            license = licenses.mit;
          };
        };

        pre-commit = pre-commit-hooks.lib."${system}".run;
      in rec {
        packages = flake-utils.lib.flattenTree {
          # `nix build .#ripsecrets`
          inherit ripsecrets;
          # `nix build`
          default = ripsecrets;
          # Build an OCI image.
          # `nix build .#ripsecrets-oci`
          ripsecrets-oci = pkgs.dockerTools.buildImage {
            name = "ripsecrets";
            tag = "latest";
            config = {
              Entrypoint = [ "${ripsecrets}/bin/ripsecrets" ];
              WorkingDir = "/data";
              Volumes = { "/data" = { }; };
            };
          };
        };

        # `nix run`
        apps.default = flake-utils.lib.mkApp { drv = packages.ripsecrets; };

        # `nix flake check`
        checks = {
          audit = craneLib.cargoAudit { inherit src advisory-db; };

          clippy = craneLib.cargoClippy {
            inherit cargoArtifacts src nativeBuildInputs;
            cargoClippyExtraArgs = "--all-targets -- --deny warnings";
          };

          doc = craneLib.cargoDoc { inherit cargoArtifacts src; };

          fmt = craneLib.cargoFmt { inherit src; };

          nextest = craneLib.cargoNextest {
            inherit cargoArtifacts src nativeBuildInputs;
            partitions = 1;
            partitionType = "count";
          };

          pre-commit = pre-commit {
            src = ./.;
            hooks = {
              editorconfig-checker.enable = true;
              nixfmt.enable = true;
              rustfmt.enable = true;
              typos = {
                enable = true;
                excludes = [ "^test/one_per_file/.*" "^test/one_per_line/.*" ];
              };
            };
          };
        } // pkgs.lib.optionalAttrs (system == "x86_64-linux") {
          # NB: cargo-tarpaulin only supports x86_64 systems
          # Check code coverage (note: this will not upload coverage anywhere)
          ripsecrets-coverage =
            craneLib.cargoTarpaulin { inherit cargoArtifacts src; };
        };

        # `nix develop`
        devShells.default = pkgs.mkShell {
          inherit (self.checks.${system}.pre-commit) shellHook;
          inputsFrom = builtins.attrValues self.checks;
          packages = with pkgs; [ cargo clippy rustc ];
          nativeBuildInputs = nativeBuildInputs ++ (with pkgs;
            lib.optionals (system == "x86_64-linux") [ cargo-tarpaulin ]);
        };
      });
}