Scan a repo's whole history before it goes open

curl --request POST \
  --url https://patch.gg/api/v1/projects/{owner}/{slug}/repo/history-scan \
  --header 'Authorization: Bearer <token>'

const options = {method: 'POST', headers: {Authorization: 'Bearer <token>'}};

fetch('https://patch.gg/api/v1/projects/{owner}/{slug}/repo/history-scan', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

import requests

url = "https://patch.gg/api/v1/projects/{owner}/{slug}/repo/history-scan"

headers = {"Authorization": "Bearer <token>"}

response = requests.post(url, headers=headers)

print(response.text)

{
  "id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
  "status": "running",
  "up_to_date": true,
  "started_at": "2023-11-07T05:31:56Z",
  "finished_at": "2023-11-07T05:31:56Z",
  "head_commit": "<string>",
  "failure": "<string>",
  "secret_count": 1,
  "secrets": [
    {
      "commit": "<string>",
      "path": "<string>",
      "line": 2,
      "rule": "an AWS access key",
      "masked": "AKIA…",
      "in": "file"
    }
  ],
  "removable_tags": [
    "<string>"
  ],
  "live_tags": [
    "<string>"
  ],
  "fix": [
    {
      "step": "<string>",
      "commands": [
        "<string>"
      ]
    }
  ],
  "will_become_public": {
    "commit_count": 1,
    "branches": {
      "count": 1,
      "names": [
        "<string>"
      ]
    },
    "tags": {
      "count": 1,
      "names": [
        "<string>"
      ]
    },
    "other_refs": {
      "count": 1,
      "names": [
        "<string>"
      ]
    },
    "files_at_head": {
      "count": 1,
      "paths": [
        "<string>"
      ]
    },
    "big_files": {
      "count": 1,
      "total_size": 1,
      "scanned": true,
      "files": [
        {
          "path": "<string>",
          "sha256": "<string>",
          "size": 1,
          "not_read": "too_big"
        }
      ],
      "not_read": {
        "count": 1,
        "total_size": 1
      },
      "coverage": "<string>"
    },
    "authors": {
      "count": 1,
      "people": [
        {
          "name": "<string>",
          "email": "<string>",
          "commits": 1
        }
      ]
    }
  }
}

{
  "id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
  "status": "running",
  "up_to_date": true,
  "started_at": "2023-11-07T05:31:56Z",
  "finished_at": "2023-11-07T05:31:56Z",
  "head_commit": "<string>",
  "failure": "<string>",
  "secret_count": 1,
  "secrets": [
    {
      "commit": "<string>",
      "path": "<string>",
      "line": 2,
      "rule": "an AWS access key",
      "masked": "AKIA…",
      "in": "file"
    }
  ],
  "removable_tags": [
    "<string>"
  ],
  "live_tags": [
    "<string>"
  ],
  "fix": [
    {
      "step": "<string>",
      "commands": [
        "<string>"
      ]
    }
  ],
  "will_become_public": {
    "commit_count": 1,
    "branches": {
      "count": 1,
      "names": [
        "<string>"
      ]
    },
    "tags": {
      "count": 1,
      "names": [
        "<string>"
      ]
    },
    "other_refs": {
      "count": 1,
      "names": [
        "<string>"
      ]
    },
    "files_at_head": {
      "count": 1,
      "paths": [
        "<string>"
      ]
    },
    "big_files": {
      "count": 1,
      "total_size": 1,
      "scanned": true,
      "files": [
        {
          "path": "<string>",
          "sha256": "<string>",
          "size": 1,
          "not_read": "too_big"
        }
      ],
      "not_read": {
        "count": 1,
        "total_size": 1
      },
      "coverage": "<string>"
    },
    "authors": {
      "count": 1,
      "people": [
        {
          "name": "<string>",
          "email": "<string>",
          "commits": 1
        }
      ]
    }
  }
}

{
  "error": {
    "code": "version_exists",
    "message": "<string>",
    "details": "<unknown>"
  }
}

{
  "error": {
    "code": "version_exists",
    "message": "<string>",
    "details": "<unknown>"
  }
}

{
  "error": {
    "code": "version_exists",
    "message": "<string>",
    "details": "<unknown>"
  }
}

{
  "error": {
    "code": "version_exists",
    "message": "<string>",
    "details": "<unknown>"
  }
}

{
  "error": {
    "code": "version_exists",
    "message": "<string>",
    "details": "<unknown>"
  }
}

{
  "error": {
    "code": "version_exists",
    "message": "<string>",
    "details": "<unknown>"
  }
}

{
  "error": {
    "code": "version_exists",
    "message": "<string>",
    "details": "<unknown>"
  }
}

{
  "error": {
    "code": "version_exists",
    "message": "<string>",
    "details": "<unknown>"
  }
}

Repos

Scan a repo's whole history before it goes open

Members of the owning org, with the publish scope. Going open publishes every commit, so this reads every commit reachable from every branch and tag, and any other ref, for secrets. It runs as a job: read the result with GET. A repo has one scan at a time, and asking while one runs answers with that one. A repo a push closed, as an open repo’s first push does and one that brings a secret does, scans itself, and opens by itself once a scan is clean. A repo with no commits, or that’s open already, has nothing to scan. A repo whose home is GitHub needs none, since GitHub already shows its history: it answers 409 on_github, with the repo’s page in details.html_url, and starts nothing.

POST

projects

{owner}

{slug}

repo

history-scan

Scan a repo's whole history before it goes open

curl --request POST \
  --url https://patch.gg/api/v1/projects/{owner}/{slug}/repo/history-scan \
  --header 'Authorization: Bearer <token>'

const options = {method: 'POST', headers: {Authorization: 'Bearer <token>'}};

fetch('https://patch.gg/api/v1/projects/{owner}/{slug}/repo/history-scan', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

import requests

url = "https://patch.gg/api/v1/projects/{owner}/{slug}/repo/history-scan"

headers = {"Authorization": "Bearer <token>"}

response = requests.post(url, headers=headers)

print(response.text)

{
  "id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
  "status": "running",
  "up_to_date": true,
  "started_at": "2023-11-07T05:31:56Z",
  "finished_at": "2023-11-07T05:31:56Z",
  "head_commit": "<string>",
  "failure": "<string>",
  "secret_count": 1,
  "secrets": [
    {
      "commit": "<string>",
      "path": "<string>",
      "line": 2,
      "rule": "an AWS access key",
      "masked": "AKIA…",
      "in": "file"
    }
  ],
  "removable_tags": [
    "<string>"
  ],
  "live_tags": [
    "<string>"
  ],
  "fix": [
    {
      "step": "<string>",
      "commands": [
        "<string>"
      ]
    }
  ],
  "will_become_public": {
    "commit_count": 1,
    "branches": {
      "count": 1,
      "names": [
        "<string>"
      ]
    },
    "tags": {
      "count": 1,
      "names": [
        "<string>"
      ]
    },
    "other_refs": {
      "count": 1,
      "names": [
        "<string>"
      ]
    },
    "files_at_head": {
      "count": 1,
      "paths": [
        "<string>"
      ]
    },
    "big_files": {
      "count": 1,
      "total_size": 1,
      "scanned": true,
      "files": [
        {
          "path": "<string>",
          "sha256": "<string>",
          "size": 1,
          "not_read": "too_big"
        }
      ],
      "not_read": {
        "count": 1,
        "total_size": 1
      },
      "coverage": "<string>"
    },
    "authors": {
      "count": 1,
      "people": [
        {
          "name": "<string>",
          "email": "<string>",
          "commits": 1
        }
      ]
    }
  }
}

{
  "id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
  "status": "running",
  "up_to_date": true,
  "started_at": "2023-11-07T05:31:56Z",
  "finished_at": "2023-11-07T05:31:56Z",
  "head_commit": "<string>",
  "failure": "<string>",
  "secret_count": 1,
  "secrets": [
    {
      "commit": "<string>",
      "path": "<string>",
      "line": 2,
      "rule": "an AWS access key",
      "masked": "AKIA…",
      "in": "file"
    }
  ],
  "removable_tags": [
    "<string>"
  ],
  "live_tags": [
    "<string>"
  ],
  "fix": [
    {
      "step": "<string>",
      "commands": [
        "<string>"
      ]
    }
  ],
  "will_become_public": {
    "commit_count": 1,
    "branches": {
      "count": 1,
      "names": [
        "<string>"
      ]
    },
    "tags": {
      "count": 1,
      "names": [
        "<string>"
      ]
    },
    "other_refs": {
      "count": 1,
      "names": [
        "<string>"
      ]
    },
    "files_at_head": {
      "count": 1,
      "paths": [
        "<string>"
      ]
    },
    "big_files": {
      "count": 1,
      "total_size": 1,
      "scanned": true,
      "files": [
        {
          "path": "<string>",
          "sha256": "<string>",
          "size": 1,
          "not_read": "too_big"
        }
      ],
      "not_read": {
        "count": 1,
        "total_size": 1
      },
      "coverage": "<string>"
    },
    "authors": {
      "count": 1,
      "people": [
        {
          "name": "<string>",
          "email": "<string>",
          "commits": 1
        }
      ]
    }
  }
}

{
  "error": {
    "code": "version_exists",
    "message": "<string>",
    "details": "<unknown>"
  }
}

{
  "error": {
    "code": "version_exists",
    "message": "<string>",
    "details": "<unknown>"
  }
}

{
  "error": {
    "code": "version_exists",
    "message": "<string>",
    "details": "<unknown>"
  }
}

{
  "error": {
    "code": "version_exists",
    "message": "<string>",
    "details": "<unknown>"
  }
}

{
  "error": {
    "code": "version_exists",
    "message": "<string>",
    "details": "<unknown>"
  }
}

{
  "error": {
    "code": "version_exists",
    "message": "<string>",
    "details": "<unknown>"
  }
}

{
  "error": {
    "code": "version_exists",
    "message": "<string>",
    "details": "<unknown>"
  }
}

{
  "error": {
    "code": "version_exists",
    "message": "<string>",
    "details": "<unknown>"
  }
}

Authorizations

Authorization

string

header

required

An API key (pch_...) or the token from pch login.

Path Parameters

owner

string

required

Example:

"patch"

slug

string

required

Example:

"demo-mod"

Response

One is running already

string<uuid>

required

status

enum<string>

required

Available options:

running,

clean,

secrets_found,

failed

up_to_date

boolean

required

False once a push has landed since it started, which means a new scan.

started_at

string<date-time>

required

finished_at

string<date-time> | null

required

head_commit

string | null

required

The default branch's commit, as the scan read it.

failure

string | null

required

Why a failed scan didn't finish.

secret_count

integer

required

Required range: x >= 0

secrets

object[]

required

The first of them, oldest commit first.

Show child attributes

removable_tags

string[]

required

With secrets found: tags of releases that never went live and hold them. A push may delete these, with plain git, and those releases can't go out after that.

live_tags

string[]

required

With secrets found: tags of releases that went live and hold them. What's live never changes, so these can't come out, and the repo's code can only stay closed.

fix

object[]

required

With secrets found: how to take them out of the history.

Show child attributes

will_become_public

object | null

required

What going open publishes, once a scan has read it.

Show child attributes

Overview

Endpoints

Scan a repo's whole history before it goes open

Authorizations

Path Parameters

Response