Jens
faeb58ef6d
GeoIntel release gates / Compile, test, contracts and builds (push) Successful in 1m49s
GeoIntel release gates / Python and npm vulnerability policy (push) Successful in 21s
GeoIntel release gates / Production AI image, SBOM and container scan (push) Successful in 5m39s
GeoIntel release gates / Deploy exact gated revision to Unraid (push) Failing after 58m43s
90 lines
2.5 KiB
Python
90 lines
2.5 KiB
Python
#!/usr/bin/env python3
|
|
"""Fail when publication-only repository boundaries are violated."""
|
|
|
|
from __future__ import annotations
|
|
|
|
import subprocess
|
|
import sys
|
|
from pathlib import Path
|
|
|
|
|
|
ROOT = Path(__file__).resolve().parents[1]
|
|
BLOCKED_PATHS = {".mcp.json"}
|
|
BLOCKED_PREFIXES = (
|
|
".codex-input/",
|
|
".codex-artifacts/",
|
|
".playwright-mcp/",
|
|
"artifacts/",
|
|
"data/",
|
|
)
|
|
BLOCKED_SUFFIXES = (".db", ".db-shm", ".db-wal")
|
|
BLOCKED_CONTENT = (
|
|
b"192.168." + b"10.150",
|
|
b"geointel." + b"itworx.tech",
|
|
b"itworx_" + b"unraid_deploy",
|
|
b"/mnt/user/appdata/" + b"dockdeck",
|
|
b"tower" + b".local",
|
|
)
|
|
LARGE_FILE_LIMIT = 20 * 1024 * 1024
|
|
LARGE_FILE_ALLOWLIST_PREFIXES = (
|
|
"docs/assets/",
|
|
"frontend/public/portfolio/",
|
|
"output/pdf/",
|
|
)
|
|
|
|
|
|
def tracked_files() -> list[str]:
|
|
result = subprocess.run(
|
|
["git", "ls-files", "-z"],
|
|
cwd=ROOT,
|
|
check=True,
|
|
capture_output=True,
|
|
)
|
|
return [item for item in result.stdout.decode("utf-8").split("\0") if item]
|
|
|
|
|
|
def main() -> int:
|
|
violations: list[str] = []
|
|
for relative in tracked_files():
|
|
normalized = relative.replace("\\", "/")
|
|
if normalized in BLOCKED_PATHS or normalized.startswith(BLOCKED_PREFIXES):
|
|
violations.append(
|
|
f"{normalized}: local or cross-project state must not be tracked"
|
|
)
|
|
continue
|
|
if normalized.endswith(BLOCKED_SUFFIXES):
|
|
violations.append(
|
|
f"{normalized}: database runtime state must not be tracked"
|
|
)
|
|
continue
|
|
|
|
path = ROOT / relative
|
|
if not path.is_file():
|
|
continue
|
|
size = path.stat().st_size
|
|
if size > LARGE_FILE_LIMIT and not normalized.startswith(
|
|
LARGE_FILE_ALLOWLIST_PREFIXES
|
|
):
|
|
violations.append(
|
|
f"{normalized}: {size} bytes exceeds the {LARGE_FILE_LIMIT}-byte tracked-file budget"
|
|
)
|
|
content = path.read_bytes()
|
|
for marker in BLOCKED_CONTENT:
|
|
if marker in content:
|
|
violations.append(
|
|
f"{normalized}: contains private publication marker {marker.decode('ascii')}"
|
|
)
|
|
|
|
if violations:
|
|
print("Repository hygiene violations:", file=sys.stderr)
|
|
for violation in violations:
|
|
print(f" - {violation}", file=sys.stderr)
|
|
return 1
|
|
|
|
print("Repository hygiene check passed.")
|
|
return 0
|
|
|
|
|
|
if __name__ == "__main__":
|
|
raise SystemExit(main())
|