Skip to content

Commit a4c63fb

Browse files
YoungMayorYoungMayor
authored
Dev (#3)
* Add bash scripts for encrypting and decrypting secrets Introduces bash scripts to encrypt and decrypt environment and key files for CI/CD workflows. Includes shared config and functions, main scripts for encryption/decryption, and a test script for decryption. Scripts use OpenSSL and generate a report for encrypted files. * Initial implementation of SecureFlow CLI tool Add Go-based CLI for secure file encryption and decryption using AES-256-CBC with OpenSSL-compatible format. Includes Cobra-based commands (encrypt, decrypt, test, init), configuration management, crypto logic, and utility functions. Project structure, dependencies, and .gitignore updated for SecureFlow. Implements password handling, report generation, and interactive/non-interactive modes. * Add CI workflows, license, install script, and tests Introduces GitHub Actions workflows for build, test, lint, and release automation. Adds MIT license, installation script, and example usage/config files. Updates module path and internal imports to MayR-Labs/secureflow-go. Adds comprehensive unit tests for config, crypto, and utils packages. Enhances README with installation, usage, and contribution instructions. * Refactor test files to improve formatting Replaced tabs with spaces and improved code formatting in config_test.go, crypto_test.go, and utils_test.go for better readability and consistency. No functional changes were made.
1 parent b92f851 commit a4c63fb

23 files changed

Lines changed: 2598 additions & 12 deletions

‎.github/copilot-instructions.md‎

Lines changed: 176 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,176 @@
1+
# GitHub Copilot Instructions for SecureFlow
2+
3+
## Project Overview
4+
5+
SecureFlow is a Go-based CLI tool for securely encrypting and decrypting sensitive files using AES-256-CBC encryption with OpenSSL-compatible standards. It's designed to replace fragile Bash scripts with a fast, cross-platform executable.
6+
7+
## Architecture
8+
9+
### Project Structure
10+
```
11+
secureflow-go/
12+
├── cmd/ # CLI commands (Cobra)
13+
│ ├── root.go # CLI entrypoint and root command
14+
│ ├── encrypt.go # Encryption command
15+
│ ├── decrypt.go # Decryption command
16+
│ ├── test.go # Test decryption command
17+
│ └── init.go # Initialize config command
18+
├── internal/
19+
│ ├── crypto/ # Encryption/decryption logic
20+
│ ├── config/ # secureflow.yaml handling
21+
│ └── utils/ # File handling, error logging
22+
├── main.go # Application entry point
23+
├── go.mod # Go module dependencies
24+
└── README.md
25+
```
26+
27+
## Key Technologies
28+
29+
- **Language**: Go 1.17+
30+
- **CLI Framework**: cobra (github.com/spf13/cobra)
31+
- **Config Format**: YAML (gopkg.in/yaml.v3)
32+
- **Encryption**: AES-256-CBC via crypto/aes, crypto/cipher, OpenSSL-compatible
33+
34+
## Coding Standards
35+
36+
### Go Best Practices
37+
- Follow standard Go formatting (use `gofmt` or `goimports`)
38+
- Use meaningful variable and function names
39+
- Keep functions focused and single-purpose
40+
- Handle errors explicitly; never ignore them
41+
- Use context for cancellation where appropriate
42+
- Write idiomatic Go code following [Effective Go](https://golang.org/doc/effective_go.html)
43+
44+
### Error Handling
45+
- Return errors, don't panic (except in main.go for fatal errors)
46+
- Wrap errors with context using `fmt.Errorf("context: %w", err)`
47+
- Log errors with consistent formatting
48+
- Exit codes: 0 for success, 1 for errors
49+
50+
### Code Organization
51+
- Keep `internal/` packages focused on core logic
52+
- Use `cmd/` for CLI command definitions only
53+
- Avoid circular dependencies
54+
- Export only what's necessary (use lowercase for internal functions)
55+
56+
### Comments and Documentation
57+
- Add package documentation comments
58+
- Document exported functions and types
59+
- Use clear, concise comments
60+
- Avoid obvious comments
61+
62+
## Security Requirements
63+
64+
1. **Password Handling**
65+
- Never log or store passwords in plaintext
66+
- Clear password variables after use when possible
67+
- Use secure password input (no echo) for interactive mode
68+
69+
2. **Encryption Standards**
70+
- AES-256-CBC with PBKDF2 key derivation
71+
- OpenSSL-compatible format (Salted__ header)
72+
- Use crypto/rand for random generation
73+
74+
3. **File Operations**
75+
- Validate file paths before operations
76+
- Handle permission errors gracefully
77+
- Create directories with appropriate permissions (0755)
78+
- Set encrypted file permissions appropriately (0644)
79+
80+
## CLI Command Guidelines
81+
82+
### Command Structure
83+
- Use Cobra for all commands
84+
- Support both interactive and non-interactive modes
85+
- Provide helpful error messages
86+
- Include usage examples in help text
87+
88+
### Flags and Options
89+
- `--config`: Custom config file path
90+
- `--password`: Non-interactive password (for CI/CD)
91+
- `--non-interactive`: Skip all prompts
92+
- `--version`: Show version information
93+
94+
### User Experience
95+
- Use colored output for better readability (optional, graceful degradation)
96+
- Show progress for long operations
97+
- Provide clear success/failure messages
98+
- Include emoji in output for visual clarity (✅, ❌, 🔐, etc.)
99+
100+
## Configuration File (secureflow.yaml)
101+
102+
```yaml
103+
output_dir: enc_keys # Encrypted files directory
104+
test_output_dir: test_dec_keys # Test decryption directory
105+
106+
files:
107+
- input: .env.prod # Source file
108+
output: .env.prod.encrypted # Encrypted filename
109+
- input: android/app/keystore.jks
110+
output: keystore.jks.encrypted
111+
```
112+
113+
## Testing
114+
115+
- Write unit tests for crypto functions
116+
- Test error conditions
117+
- Mock file I/O where appropriate
118+
- Test both interactive and non-interactive modes
119+
- Run tests with: `go test ./...`
120+
121+
## Build and Release
122+
123+
- Build command: `go build -o secureflow`
124+
- Cross-compile for Linux, macOS, Windows
125+
- Version management via git tags
126+
- Binary should be statically linked when possible
127+
128+
## Dependencies
129+
130+
- Prefer standard library when possible
131+
- Keep dependencies minimal
132+
- Use go modules for dependency management
133+
- Pin dependency versions in go.mod
134+
135+
## Common Commands
136+
137+
```bash
138+
# Run locally
139+
go run main.go [command]
140+
141+
# Build
142+
go build -o secureflow
143+
144+
# Test
145+
go test ./...
146+
147+
# Format code
148+
gofmt -w .
149+
150+
# Run linter (if golangci-lint installed)
151+
golangci-lint run
152+
```
153+
154+
## Encryption/Decryption Implementation
155+
156+
The crypto package should implement OpenSSL-compatible encryption:
157+
- Use PBKDF2 for key derivation from password
158+
- Add "Salted__" prefix followed by 8-byte salt
159+
- Use AES-256-CBC mode
160+
- Match OpenSSL's `openssl enc -aes-256-cbc -salt -pbkdf2` behavior
161+
162+
## Report Generation
163+
164+
After encryption, generate a report.txt file with:
165+
- Encryption note and password hint
166+
- Timestamp
167+
- For each file: name, encrypted name, size, line count, last modified
168+
169+
## Contribution Guidelines
170+
171+
When extending or modifying this project:
172+
1. Maintain backward compatibility with encrypted files
173+
2. Update README.md with new features
174+
3. Add tests for new functionality
175+
4. Follow existing code patterns and structure
176+
5. Keep CLI interface consistent

‎.github/workflows/build.yml‎

Lines changed: 107 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,107 @@
1+
name: Build and Test
2+
3+
on:
4+
push:
5+
branches: [ main, develop ]
6+
pull_request:
7+
branches: [ main, develop ]
8+
9+
permissions:
10+
contents: read
11+
12+
jobs:
13+
test:
14+
name: Test
15+
runs-on: ubuntu-latest
16+
permissions:
17+
contents: read
18+
steps:
19+
- name: Checkout code
20+
uses: actions/checkout@v4
21+
22+
- name: Set up Go
23+
uses: actions/setup-go@v5
24+
with:
25+
go-version: '1.24'
26+
27+
- name: Cache Go modules
28+
uses: actions/cache@v4
29+
with:
30+
path: ~/go/pkg/mod
31+
key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
32+
restore-keys: |
33+
${{ runner.os }}-go-
34+
35+
- name: Download dependencies
36+
run: go mod download
37+
38+
- name: Run tests
39+
run: go test -v -race -coverprofile=coverage.txt -covermode=atomic ./...
40+
41+
- name: Upload coverage to Codecov
42+
uses: codecov/codecov-action@v4
43+
with:
44+
file: ./coverage.txt
45+
fail_ci_if_error: false
46+
47+
build:
48+
name: Build
49+
runs-on: ubuntu-latest
50+
needs: test
51+
permissions:
52+
contents: read
53+
strategy:
54+
matrix:
55+
goos: [linux, darwin, windows]
56+
goarch: [amd64, arm64]
57+
exclude:
58+
# Windows ARM64 is less common, exclude for now
59+
- goos: windows
60+
goarch: arm64
61+
steps:
62+
- name: Checkout code
63+
uses: actions/checkout@v4
64+
65+
- name: Set up Go
66+
uses: actions/setup-go@v5
67+
with:
68+
go-version: '1.24'
69+
70+
- name: Build binary
71+
env:
72+
GOOS: ${{ matrix.goos }}
73+
GOARCH: ${{ matrix.goarch }}
74+
run: |
75+
OUTPUT_NAME=secureflow-${{ matrix.goos }}-${{ matrix.goarch }}
76+
if [ "${{ matrix.goos }}" = "windows" ]; then
77+
OUTPUT_NAME="${OUTPUT_NAME}.exe"
78+
fi
79+
go build -ldflags="-s -w" -o "${OUTPUT_NAME}" .
80+
ls -lh "${OUTPUT_NAME}"
81+
82+
- name: Upload artifact
83+
uses: actions/upload-artifact@v4
84+
with:
85+
name: secureflow-${{ matrix.goos }}-${{ matrix.goarch }}
86+
path: secureflow-*
87+
retention-days: 7
88+
89+
lint:
90+
name: Lint
91+
runs-on: ubuntu-latest
92+
permissions:
93+
contents: read
94+
steps:
95+
- name: Checkout code
96+
uses: actions/checkout@v4
97+
98+
- name: Set up Go
99+
uses: actions/setup-go@v5
100+
with:
101+
go-version: '1.24'
102+
103+
- name: Run golangci-lint
104+
uses: golangci/golangci-lint-action@v4
105+
with:
106+
version: latest
107+
args: --timeout=5m

0 commit comments

Comments
 (0)