Add git-secrets check to build

git-secrets is a local tool that every developer has to set up on
their own working copy. Add it to the guide so new contributors
don't forget.

Initializes a new git repo if the current directory is not a git repo.

Fixes #271.

.gitignore

@@ -6,6 +6,7 @@ dist
 pack
 .BUILD_COMPLETED
 .local-npm
+.tools
 coverage
 .nyc_output
 .LAST_BUILD

CONTRIBUTING.md

@@ -74,6 +74,9 @@ docker run --net=host -it -v $PWD:$PWD -w $PWD ${IMAGE}
 This will get you into an interactive docker shell. You can then run
 `./install.sh` and `./build.sh` as described below.
 
+Also install the [git-secrets](https://github.com/awslabs/git-secrets) tool
+and activate it on your working copy of the `aws-cdk` repository.
+
 ### Bootstrapping
 
 1. Clone this repository (or run `git clean -fdx` to clean up all build artifacts).

build.sh

@@ -5,6 +5,8 @@ if [ ! -d node_modules ]; then
     /bin/bash ./install.sh
 fi
 
+/bin/bash ./git-secrets-scan.sh
+
 BUILD_INDICATOR=".BUILD_COMPLETED"
 rm -rf $BUILD_INDICATOR
 

git-secrets-scan.sh

@@ -0,0 +1,30 @@
+#!/bin/bash
+set -euo pipefail
+
+mkdir -p .tools
+[[ ! -d .tools/git-secrets ]] && {
+    echo "============================================================================================="
+    echo "Downloading git-secrets..."
+    (cd .tools && git clone --depth 1 https://github.com/awslabs/git-secrets.git)
+}
+
+# As the name implies, git-secrets heavily depends on git:
+#
+# a) the config is stored and fetched using 'git config'.
+# b) the search is performed using 'git grep' (other search methods don't work
+#    properly, see https://github.com/awslabs/git-secrets/issues/66)
+#
+# When we run in a CodeBuild build, we don't have a git repo, unfortunately. So
+# when that's the case, 'git init' one on the spot, add all files to it (which
+# because of the .gitignore will exclude dependencies and generated files) and
+# then call 'git-secrets' as usual.
+git rev-parse --git-dir > /dev/null 2>&1 || {
+    git init --quiet
+    git add -A .
+
+    # AWS config needs to be added to this fresh repository's config
+    .tools/git-secrets/git-secrets --register-aws
+}
+
+.tools/git-secrets/git-secrets --scan
+echo "git-secrets scan ok"