Jens
29033b5159
GeoIntel release gates / Compile, test, contracts and builds (push) Canceled after 26s
GeoIntel release gates / Python and npm vulnerability policy (push) Canceled after 0s
GeoIntel release gates / GIS image, SBOM and container scan (push) Canceled after 0s
GeoIntel release gates / AI image, SBOM and container scan (push) Canceled after 0s
122 lines
8.0 KiB
Python
122 lines
8.0 KiB
Python
#!/usr/bin/env python3
|
|
from __future__ import annotations
|
|
|
|
import subprocess
|
|
import sys
|
|
from pathlib import Path
|
|
|
|
ROOT = Path(__file__).resolve().parents[1]
|
|
BLOCKED_PREFIXES = (".codex-artifacts/",)
|
|
BLOCKED_SUFFIXES = (".db-wal", ".db-shm")
|
|
LARGE_FILE_LIMIT = 20 * 1024 * 1024
|
|
LARGE_FILE_ALLOWLIST_PREFIXES = (
|
|
"artifacts/evidence/accuracy/",
|
|
"docs/assets/",
|
|
"frontend/public/portfolio/",
|
|
"output/pdf/",
|
|
)
|
|
LEGACY_CODEX_INPUT_BLOBS = {
|
|
".codex-input/stitch-dockdeck-canon-v1/stitch_dockdeck_premium_interface_system/dockdeck_dashboard_licht_thema/code.html": "c88a8a0efb15cfd14c2e8e2ed7f5696cc9f20ce1",
|
|
".codex-input/stitch-dockdeck-canon-v1/stitch_dockdeck_premium_interface_system/dockdeck_dashboard_licht_thema/screen.png": "c2963e261fe2f1ca1e6cd1ea75d7bc5ff83fb987",
|
|
".codex-input/stitch-dockdeck-canon-v1/stitch_dockdeck_premium_interface_system/dockdeck_dashboard_mobiel/code.html": "989258e23a185c071e2ab11ba2971b265e7009ce",
|
|
".codex-input/stitch-dockdeck-canon-v1/stitch_dockdeck_premium_interface_system/dockdeck_dashboard_mobiel/screen.png": "79cf81d82260776c5672db4668b56b7074a071ed",
|
|
".codex-input/stitch-dockdeck-canon-v1/stitch_dockdeck_premium_interface_system/dockdeck_dashboard_mobiel_definitief/code.html": "b5eae728298e6a983e381097a1e0f5d24a4141f6",
|
|
".codex-input/stitch-dockdeck-canon-v1/stitch_dockdeck_premium_interface_system/dockdeck_dashboard_mobiel_definitief/screen.png": "0a2b3a0bb0cafdf186f715cfa91a5aca918e0756",
|
|
".codex-input/stitch-dockdeck-canon-v1/stitch_dockdeck_premium_interface_system/dockdeck_dashboard_overzicht/code.html": "56d03a4737e77fab6b3597f9058a2815a703fd19",
|
|
".codex-input/stitch-dockdeck-canon-v1/stitch_dockdeck_premium_interface_system/dockdeck_dashboard_overzicht/screen.png": "9704ddc764d2fc3c69410ba735d65500d6961909",
|
|
".codex-input/stitch-dockdeck-canon-v1/stitch_dockdeck_premium_interface_system/dockdeck_dashboard_overzicht_definitief/code.html": "f5a5f6ac2811f92a3d8f2eb7b027bdc9ac34a219",
|
|
".codex-input/stitch-dockdeck-canon-v1/stitch_dockdeck_premium_interface_system/dockdeck_dashboard_overzicht_definitief/screen.png": "5d700e451de80a9449b968101933b06226870d66",
|
|
".codex-input/stitch-dockdeck-canon-v1/stitch_dockdeck_premium_interface_system/dockdeck_definitief_logo/screen.png": "e01d27618ff1583a76614d6a714d036d938b33e0",
|
|
".codex-input/stitch-dockdeck-canon-v1/stitch_dockdeck_premium_interface_system/dockdeck_quick_launch_definitief/code.html": "c9d71c2a0d335922af956f8eb07f65f2a8edd584",
|
|
".codex-input/stitch-dockdeck-canon-v1/stitch_dockdeck_premium_interface_system/dockdeck_quick_launch_definitief/screen.png": "dcb36ef137393e91a4122695dfb6a7c688aebb3b",
|
|
".codex-input/stitch-dockdeck-canon-v1/stitch_dockdeck_premium_interface_system/dockdeck_zoeken/code.html": "678869ade78ce6423bd96a360f5515e0d1a00e54",
|
|
".codex-input/stitch-dockdeck-canon-v1/stitch_dockdeck_premium_interface_system/dockdeck_zoeken/screen.png": "e253bd38bfa462fa7537988153a3f259fe02a7f0",
|
|
".codex-input/stitch-dockdeck-canon-v1/stitch_dockdeck_premium_interface_system/instellingen_app_editor_definitief/code.html": "eca901c78c0cd6d267a9e713249bf9707da635a5",
|
|
".codex-input/stitch-dockdeck-canon-v1/stitch_dockdeck_premium_interface_system/instellingen_app_editor_definitief/screen.png": "eb83c7df7154864ba255f53813770b2bfd089c25",
|
|
".codex-input/stitch-dockdeck-canon-v1/stitch_dockdeck_premium_interface_system/instellingen_apps_beheren_definitief/code.html": "c12e25f411fdbd9627c63e4d5b8ea3a1ef9060dc",
|
|
".codex-input/stitch-dockdeck-canon-v1/stitch_dockdeck_premium_interface_system/instellingen_apps_beheren_definitief/screen.png": "cade3f21d441b173e1a0d06e9cdee644f52d9029",
|
|
".codex-input/stitch-dockdeck-canon-v1/stitch_dockdeck_premium_interface_system/instellingen_back_up_definitief/code.html": "a4ca7e58f1dc416508abe7ed8e04417f766879dd",
|
|
".codex-input/stitch-dockdeck-canon-v1/stitch_dockdeck_premium_interface_system/instellingen_back_up_definitief/screen.png": "e1b448ce07a21ed6db7949b3aa73bef760834aa7",
|
|
".codex-input/stitch-dockdeck-canon-v1/stitch_dockdeck_premium_interface_system/instellingen_categorie_n_definitief/code.html": "3d527c4573ea6faa68ce61e237056a4be8d0483a",
|
|
".codex-input/stitch-dockdeck-canon-v1/stitch_dockdeck_premium_interface_system/instellingen_categorie_n_definitief/screen.png": "d162dfcb410e03e3958d36a78523a405ca380ad6",
|
|
".codex-input/stitch-dockdeck-canon-v1/stitch_dockdeck_premium_interface_system/instellingen_favorieten_definitief/code.html": "b9667a198f10ff98e1094ae2582c4f711b0f0e26",
|
|
".codex-input/stitch-dockdeck-canon-v1/stitch_dockdeck_premium_interface_system/instellingen_favorieten_definitief/screen.png": "a94da2e1c139156a4f318f9cf5db0b1178e9379c",
|
|
".codex-input/stitch-dockdeck-canon-v1/stitch_dockdeck_premium_interface_system/instellingen_integraties/code.html": "4688fb1040a48fb75cc50b99a02a07e33e4a3c63",
|
|
".codex-input/stitch-dockdeck-canon-v1/stitch_dockdeck_premium_interface_system/instellingen_integraties/screen.png": "3877e8c894ac2aa0aa13ffeec7be0a294d95e9aa",
|
|
".codex-input/stitch-dockdeck-canon-v1/stitch_dockdeck_premium_interface_system/instellingen_integraties_definitief/code.html": "ed4deee5fa38c3ed42664d4e51eb4361378b6218",
|
|
".codex-input/stitch-dockdeck-canon-v1/stitch_dockdeck_premium_interface_system/instellingen_integraties_definitief/screen.png": "78a561655467a34dd82d07081206e9546d81e114",
|
|
".codex-input/stitch-dockdeck-canon-v1/stitch_dockdeck_premium_interface_system/instellingen_weergave_definitief/code.html": "c493317031e6b034cbf5dff5d14aae5de64ea60a",
|
|
".codex-input/stitch-dockdeck-canon-v1/stitch_dockdeck_premium_interface_system/instellingen_weergave_definitief/screen.png": "ae5e98bc1ae3071f6ee2f90640226d72695bd9c8",
|
|
".codex-input/stitch-dockdeck-canon-v1/stitch_dockdeck_premium_interface_system/obsidian_control/DESIGN.md": "307f98d873009fb9b803186959ba7a67f073610a",
|
|
}
|
|
|
|
|
|
def tracked_files() -> list[str]:
|
|
result = subprocess.run(
|
|
["git", "ls-files", "-z"],
|
|
cwd=ROOT,
|
|
check=True,
|
|
capture_output=True,
|
|
)
|
|
return [item for item in result.stdout.decode("utf-8").split("\0") if item]
|
|
|
|
|
|
def git_blob_sha(path: Path) -> str:
|
|
result = subprocess.run(
|
|
["git", "hash-object", str(path)],
|
|
cwd=ROOT,
|
|
check=True,
|
|
capture_output=True,
|
|
text=True,
|
|
)
|
|
return result.stdout.strip()
|
|
|
|
|
|
def main() -> int:
|
|
violations: list[str] = []
|
|
for relative in tracked_files():
|
|
normalized = relative.replace("\\", "/")
|
|
path = ROOT / relative
|
|
|
|
if normalized.startswith(".codex-input/"):
|
|
expected_sha = LEGACY_CODEX_INPUT_BLOBS.get(normalized)
|
|
if expected_sha is None:
|
|
violations.append(f"{normalized}: local agent scratch must not be tracked")
|
|
continue
|
|
if not path.is_file() or git_blob_sha(path) != expected_sha:
|
|
violations.append(
|
|
f"{normalized}: frozen legacy scratch changed; delete it instead of modifying it"
|
|
)
|
|
continue
|
|
|
|
if normalized.startswith(BLOCKED_PREFIXES):
|
|
violations.append(f"{normalized}: local agent scratch must not be tracked")
|
|
continue
|
|
if normalized.endswith(BLOCKED_SUFFIXES):
|
|
violations.append(f"{normalized}: transient database state must not be tracked")
|
|
continue
|
|
|
|
if not path.is_file():
|
|
continue
|
|
size = path.stat().st_size
|
|
if size > LARGE_FILE_LIMIT and not normalized.startswith(
|
|
LARGE_FILE_ALLOWLIST_PREFIXES
|
|
):
|
|
violations.append(
|
|
f"{normalized}: {size} bytes exceeds the "
|
|
f"{LARGE_FILE_LIMIT}-byte tracked-file budget"
|
|
)
|
|
|
|
if violations:
|
|
print("Repository hygiene violations:", file=sys.stderr)
|
|
for violation in violations:
|
|
print(f" - {violation}", file=sys.stderr)
|
|
return 1
|
|
|
|
print("Repository hygiene check passed.")
|
|
return 0
|
|
|
|
|
|
if __name__ == "__main__":
|
|
raise SystemExit(main())
|