chore: prepare repository for public release

2026-08-31 07:23:03 +02:00
parent 03df2db8b6
commit e43d7aca68
164 changed files with 694 additions and 29691 deletions
@@ -0,0 +1,84 @@
+#!/usr/bin/env python3
+"""Fail when publication-only repository boundaries are violated."""
+
+from __future__ import annotations
+
+import subprocess
+import sys
+from pathlib import Path
+
+
+ROOT = Path(__file__).resolve().parents[1]
+BLOCKED_PATHS = {".mcp.json"}
+BLOCKED_PREFIXES = (".codex-input/", ".codex-artifacts/", ".playwright-mcp/", "data/")
+BLOCKED_SUFFIXES = (".db", ".db-shm", ".db-wal")
+BLOCKED_CONTENT = (
+    b"192.168." + b"10.150",
+    b"geointel." + b"itworx.tech",
+    b"itworx_" + b"unraid_deploy",
+    b"/mnt/user/appdata/" + b"dockdeck",
+    b"tower" + b".local",
+)
+LARGE_FILE_LIMIT = 20 * 1024 * 1024
+LARGE_FILE_ALLOWLIST_PREFIXES = (
+    "artifacts/evidence/accuracy/",
+    "docs/assets/",
+    "frontend/public/portfolio/",
+    "output/pdf/",
+)
+
+
+def tracked_files() -> list[str]:
+    result = subprocess.run(
+        ["git", "ls-files", "-z"],
+        cwd=ROOT,
+        check=True,
+        capture_output=True,
+    )
+    return [item for item in result.stdout.decode("utf-8").split("\0") if item]
+
+
+def main() -> int:
+    violations: list[str] = []
+    for relative in tracked_files():
+        normalized = relative.replace("\\", "/")
+        if normalized in BLOCKED_PATHS or normalized.startswith(BLOCKED_PREFIXES):
+            violations.append(
+                f"{normalized}: local or cross-project state must not be tracked"
+            )
+            continue
+        if normalized.endswith(BLOCKED_SUFFIXES):
+            violations.append(
+                f"{normalized}: database runtime state must not be tracked"
+            )
+            continue
+
+        path = ROOT / relative
+        if not path.is_file():
+            continue
+        size = path.stat().st_size
+        if size > LARGE_FILE_LIMIT and not normalized.startswith(
+            LARGE_FILE_ALLOWLIST_PREFIXES
+        ):
+            violations.append(
+                f"{normalized}: {size} bytes exceeds the {LARGE_FILE_LIMIT}-byte tracked-file budget"
+            )
+        content = path.read_bytes()
+        for marker in BLOCKED_CONTENT:
+            if marker in content:
+                violations.append(
+                    f"{normalized}: contains private publication marker {marker.decode('ascii')}"
+                )
+
+    if violations:
+        print("Repository hygiene violations:", file=sys.stderr)
+        for violation in violations:
+            print(f" - {violation}", file=sys.stderr)
+        return 1
+
+    print("Repository hygiene check passed.")
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())