Jens/geointel
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

hardening: forbid all codex scratch after full cleanup
GeoIntel release gates / Compile, test, contracts and builds (push) Canceled after 0s
Details
GeoIntel release gates / Python and npm vulnerability policy (push) Canceled after 0s
Details
GeoIntel release gates / GIS image, SBOM and container scan (push) Canceled after 0s
Details
GeoIntel release gates / AI image, SBOM and container scan (push) Canceled after 0s
Details

Browse Source
This commit is contained in:
Jens
2026-08-27 00:14:55 +02:00
parent 125131581d
commit 1026fde6f1
1 changed files with 2 additions and 59 deletions
Download Patch File Download Diff File Expand all files Collapse all files
scripts/check_repository_hygiene.py
+2 -59
View File
@@ -6,7 +6,7 @@ import sys
from pathlib import Path from pathlib import Path
ROOT = Path(__file__).resolve().parents[1] ROOT = Path(__file__).resolve().parents[1]
BLOCKED_PREFIXES = (".codex-artifacts/",) BLOCKED_PREFIXES = (".codex-input/", ".codex-artifacts/")
BLOCKED_SUFFIXES = (".db-wal", ".db-shm") BLOCKED_SUFFIXES = (".db-wal", ".db-shm")
LARGE_FILE_LIMIT = 20 * 1024 * 1024 LARGE_FILE_LIMIT = 20 * 1024 * 1024
LARGE_FILE_ALLOWLIST_PREFIXES = ( LARGE_FILE_ALLOWLIST_PREFIXES = (
@@ -15,40 +15,6 @@ LARGE_FILE_ALLOWLIST_PREFIXES = (
"frontend/public/portfolio/", "frontend/public/portfolio/",
"output/pdf/", "output/pdf/",
) )
LEGACY_CODEX_INPUT_BLOBS = {
".codex-input/stitch-dockdeck-canon-v1/stitch_dockdeck_premium_interface_system/dockdeck_dashboard_licht_thema/code.html": "c88a8a0efb15cfd14c2e8e2ed7f5696cc9f20ce1",
".codex-input/stitch-dockdeck-canon-v1/stitch_dockdeck_premium_interface_system/dockdeck_dashboard_licht_thema/screen.png": "c2963e261fe2f1ca1e6cd1ea75d7bc5ff83fb987",
".codex-input/stitch-dockdeck-canon-v1/stitch_dockdeck_premium_interface_system/dockdeck_dashboard_mobiel/code.html": "989258e23a185c071e2ab11ba2971b265e7009ce",
".codex-input/stitch-dockdeck-canon-v1/stitch_dockdeck_premium_interface_system/dockdeck_dashboard_mobiel/screen.png": "79cf81d82260776c5672db4668b56b7074a071ed",
".codex-input/stitch-dockdeck-canon-v1/stitch_dockdeck_premium_interface_system/dockdeck_dashboard_mobiel_definitief/code.html": "b5eae728298e6a983e381097a1e0f5d24a4141f6",
".codex-input/stitch-dockdeck-canon-v1/stitch_dockdeck_premium_interface_system/dockdeck_dashboard_mobiel_definitief/screen.png": "0a2b3a0bb0cafdf186f715cfa91a5aca918e0756",
".codex-input/stitch-dockdeck-canon-v1/stitch_dockdeck_premium_interface_system/dockdeck_dashboard_overzicht/code.html": "56d03a4737e77fab6b3597f9058a2815a703fd19",
".codex-input/stitch-dockdeck-canon-v1/stitch_dockdeck_premium_interface_system/dockdeck_dashboard_overzicht/screen.png": "9704ddc764d2fc3c69410ba735d65500d6961909",
".codex-input/stitch-dockdeck-canon-v1/stitch_dockdeck_premium_interface_system/dockdeck_dashboard_overzicht_definitief/code.html": "f5a5f6ac2811f92a3d8f2eb7b027bdc9ac34a219",
".codex-input/stitch-dockdeck-canon-v1/stitch_dockdeck_premium_interface_system/dockdeck_dashboard_overzicht_definitief/screen.png": "5d700e451de80a9449b968101933b06226870d66",
".codex-input/stitch-dockdeck-canon-v1/stitch_dockdeck_premium_interface_system/dockdeck_definitief_logo/screen.png": "e01d27618ff1583a76614d6a714d036d938b33e0",
".codex-input/stitch-dockdeck-canon-v1/stitch_dockdeck_premium_interface_system/dockdeck_quick_launch_definitief/code.html": "c9d71c2a0d335922af956f8eb07f65f2a8edd584",
".codex-input/stitch-dockdeck-canon-v1/stitch_dockdeck_premium_interface_system/dockdeck_quick_launch_definitief/screen.png": "dcb36ef137393e91a4122695dfb6a7c688aebb3b",
".codex-input/stitch-dockdeck-canon-v1/stitch_dockdeck_premium_interface_system/dockdeck_zoeken/code.html": "678869ade78ce6423bd96a360f5515e0d1a00e54",
".codex-input/stitch-dockdeck-canon-v1/stitch_dockdeck_premium_interface_system/dockdeck_zoeken/screen.png": "e253bd38bfa462fa7537988153a3f259fe02a7f0",
".codex-input/stitch-dockdeck-canon-v1/stitch_dockdeck_premium_interface_system/instellingen_app_editor_definitief/code.html": "eca901c78c0cd6d267a9e713249bf9707da635a5",
".codex-input/stitch-dockdeck-canon-v1/stitch_dockdeck_premium_interface_system/instellingen_app_editor_definitief/screen.png": "eb83c7df7154864ba255f53813770b2bfd089c25",
".codex-input/stitch-dockdeck-canon-v1/stitch_dockdeck_premium_interface_system/instellingen_apps_beheren_definitief/code.html": "c12e25f411fdbd9627c63e4d5b8ea3a1ef9060dc",
".codex-input/stitch-dockdeck-canon-v1/stitch_dockdeck_premium_interface_system/instellingen_apps_beheren_definitief/screen.png": "cade3f21d441b173e1a0d06e9cdee644f52d9029",
".codex-input/stitch-dockdeck-canon-v1/stitch_dockdeck_premium_interface_system/instellingen_back_up_definitief/code.html": "a4ca7e58f1dc416508abe7ed8e04417f766879dd",
".codex-input/stitch-dockdeck-canon-v1/stitch_dockdeck_premium_interface_system/instellingen_back_up_definitief/screen.png": "e1b448ce07a21ed6db7949b3aa73bef760834aa7",
".codex-input/stitch-dockdeck-canon-v1/stitch_dockdeck_premium_interface_system/instellingen_categorie_n_definitief/code.html": "3d527c4573ea6faa68ce61e237056a4be8d0483a",
".codex-input/stitch-dockdeck-canon-v1/stitch_dockdeck_premium_interface_system/instellingen_categorie_n_definitief/screen.png": "d162dfcb410e03e3958d36a78523a405ca380ad6",
".codex-input/stitch-dockdeck-canon-v1/stitch_dockdeck_premium_interface_system/instellingen_favorieten_definitief/code.html": "b9667a198f10ff98e1094ae2582c4f711b0f0e26",
".codex-input/stitch-dockdeck-canon-v1/stitch_dockdeck_premium_interface_system/instellingen_favorieten_definitief/screen.png": "a94da2e1c139156a4f318f9cf5db0b1178e9379c",
".codex-input/stitch-dockdeck-canon-v1/stitch_dockdeck_premium_interface_system/instellingen_integraties/code.html": "4688fb1040a48fb75cc50b99a02a07e33e4a3c63",
".codex-input/stitch-dockdeck-canon-v1/stitch_dockdeck_premium_interface_system/instellingen_integraties/screen.png": "3877e8c894ac2aa0aa13ffeec7be0a294d95e9aa",
".codex-input/stitch-dockdeck-canon-v1/stitch_dockdeck_premium_interface_system/instellingen_integraties_definitief/code.html": "ed4deee5fa38c3ed42664d4e51eb4361378b6218",
".codex-input/stitch-dockdeck-canon-v1/stitch_dockdeck_premium_interface_system/instellingen_integraties_definitief/screen.png": "78a561655467a34dd82d07081206e9546d81e114",
".codex-input/stitch-dockdeck-canon-v1/stitch_dockdeck_premium_interface_system/instellingen_weergave_definitief/code.html": "c493317031e6b034cbf5dff5d14aae5de64ea60a",
".codex-input/stitch-dockdeck-canon-v1/stitch_dockdeck_premium_interface_system/instellingen_weergave_definitief/screen.png": "ae5e98bc1ae3071f6ee2f90640226d72695bd9c8",
".codex-input/stitch-dockdeck-canon-v1/stitch_dockdeck_premium_interface_system/obsidian_control/DESIGN.md": "307f98d873009fb9b803186959ba7a67f073610a",
}
def tracked_files() -> list[str]: def tracked_files() -> list[str]:
@@ -61,34 +27,10 @@ def tracked_files() -> list[str]:
return [item for item in result.stdout.decode("utf-8").split("\0") if item] return [item for item in result.stdout.decode("utf-8").split("\0") if item]
def git_blob_sha(path: Path) -> str:
result = subprocess.run(
["git", "hash-object", str(path)],
cwd=ROOT,
check=True,
capture_output=True,
text=True,
)
return result.stdout.strip()
def main() -> int: def main() -> int:
violations: list[str] = [] violations: list[str] = []
for relative in tracked_files(): for relative in tracked_files():
normalized = relative.replace("\\", "/") normalized = relative.replace("\\", "/")
path = ROOT / relative
if normalized.startswith(".codex-input/"):
expected_sha = LEGACY_CODEX_INPUT_BLOBS.get(normalized)
if expected_sha is None:
violations.append(f"{normalized}: local agent scratch must not be tracked")
continue
if not path.is_file() or git_blob_sha(path) != expected_sha:
violations.append(
f"{normalized}: frozen legacy scratch changed; delete it instead of modifying it"
)
continue
if normalized.startswith(BLOCKED_PREFIXES): if normalized.startswith(BLOCKED_PREFIXES):
violations.append(f"{normalized}: local agent scratch must not be tracked") violations.append(f"{normalized}: local agent scratch must not be tracked")
continue continue
@@ -96,6 +38,7 @@ def main() -> int:
violations.append(f"{normalized}: transient database state must not be tracked") violations.append(f"{normalized}: transient database state must not be tracked")
continue continue
path = ROOT / relative
if not path.is_file(): if not path.is_file():
continue continue
size = path.stat().st_size size = path.stat().st_size