Skip to content

Commit

Permalink
[pre-commit.ci] auto fixes from pre-commit.com hooks
Browse files Browse the repository at this point in the history
for more information, see https://pre-commit.ci
  • Loading branch information
pre-commit-ci[bot] committed Dec 19, 2024
1 parent de9461d commit b4e5f8e
Showing 1 changed file with 20 additions and 20 deletions.
40 changes: 20 additions & 20 deletions generate_env.py
Original file line number Diff line number Diff line change
@@ -1,43 +1,43 @@
import os

import hvac

# Configuration for Vault
VAULT_ADDR = 'http://localhost:8200'
VAULT_OIDC_CLIENT_ID = 'your_oidc_client_id'
VAULT_OIDC_ISSUER_URL = 'https://your-oidc-issuer-url'
VAULT_ADDR = "http://localhost:8200"
VAULT_OIDC_CLIENT_ID = "your_oidc_client_id"
VAULT_OIDC_ISSUER_URL = "https://your-oidc-issuer-url"

# Static variables
STATIC_VARIABLES = {
'API_KEY': 'static_api_key',
'DATABASE_URL': 'static_database_url'
}
STATIC_VARIABLES = {"API_KEY": "static_api_key", "DATABASE_URL": "static_database_url"}


def get_secret_from_vault(path):
client = hvac.Client(url=VAULT_ADDR)
token = client.auth.oidc.login(
role='your_oidc_role',
jwt=os.environ['JWT']
)['auth']['client_token']

token = client.auth.oidc.login(role="your_oidc_role", jwt=os.environ["JWT"])[
"auth"
]["client_token"]

client.token = token
secret = client.secrets.kv.v2.read_secret_version(path=path)['data']['data']
secret = client.secrets.kv.v2.read_secret_version(path=path)["data"]["data"]
return secret


def generate_env_file(env_path):
with open(env_path, 'w') as env_file:
with open(env_path, "w") as env_file:
for key, value in STATIC_VARIABLES.items():
env_file.write(f"{key}={value}\n")

# Add secrets from Vault
vault_secrets = {
'SECRET_KEY': get_secret_from_vault('secret/key'),
'PASSWORD': get_secret_from_vault('secret/password')
"SECRET_KEY": get_secret_from_vault("secret/key"),
"PASSWORD": get_secret_from_vault("secret/password"),
}

for key, value in vault_secrets.items():
env_file.write(f"{key}={value}\n")

Check failure

Code scanning / CodeQL

Clear-text storage of sensitive information High

This expression stores
sensitive data (secret)
as clear text.
This expression stores
sensitive data (secret)
as clear text.
This expression stores
sensitive data (secret)
as clear text.
This expression stores
sensitive data (secret)
as clear text.

if __name__ == '__main__':
env_path = '.env'

if __name__ == "__main__":
env_path = ".env"
generate_env_file(env_path)
print(f"Environment file generated at {env_path}")

0 comments on commit b4e5f8e

Please sign in to comment.