this post was submitted on 12 Jul 2024
364 points (97.4% liked)
Programmer Humor
18962 readers
395 users here now
Welcome to Programmer Humor!
This is a place where you can post jokes, memes, humor, etc. related to programming!
For sharing awful code theres also Programming Horror.
Rules
- Keep content in english
- No advertisements
- Posts must be related to programming or programmer topics
founded 1 year ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
At my workplace, we use the string
@nocommit
to designate code that shouldn't be checked in. Usually in a comment:but it can be anywhere in the file.
There's a lint rule that looks for
@nocommit
in all modified files. It shows a lint error in dev and in our code review / build system, and commits that contain@nocommit
anywhere are completely blocked from being merged.(the code in the lint rule does something like
"@no"+"commit"
to avoid triggering itself)That approach seems useful but it wouldn't have prevented the PyPI incident OP links to: the access token was temporarily entered in a
.py
python source file, but it was not committed to git. The leak was via.pyc
compiled python files which made it into a published docker build.Yeah, but a combination of this approach, and adding all compiled file types including .pyc to .gitignore would fix it.
But in this case they didn't accidentally put the token in git; the place where they forgot to put
*.pyc
was.dockerignore
.