redactpiitools-release/.github/workflows/sterility.yml at main · Jibbscript/redactpiitools-release · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
name: Sterility

on:
  push:
    branches: [main]
    tags: ["v*"]
  pull_request:
  workflow_dispatch:

permissions:
  contents: read

jobs:
  validate_tracked_tree:
    name: Validate sterile tracked tree
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Validate tracked contents
        shell: python
        run: |
          from __future__ import annotations

          import subprocess
          from pathlib import Path, PurePosixPath

          allowed_root_files = {
              ".gitattributes",
              ".gitignore",
              "LICENSE",
              "README.md",
              "SECURITY.md",
          }
          allowed_root_dirs = {".github", "docs", "metadata"}
          disallowed_parts = {
              ".git",
              ".idea",
              ".vscode",
              "archive",
              "build",
              "dist",
              "keys",
              "native-host-swift",
              "node_modules",
              "release-bundle",
              "release-out",
              "scripts",
              "server",
              "src",
              "tests",
              "vendor",
          }
          disallowed_suffixes = (
              ".7z",
              ".app",
              ".c",
              ".cc",
              ".cpp",
              ".crx",
              ".dmg",
              ".env",
              ".go",
              ".h",
              ".js",
              ".jsx",
              ".mjs",
              ".pkg",
              ".py",
              ".sh",
              ".swift",
              ".tar",
              ".tar.gz",
              ".tgz",
              ".ts",
              ".tsx",
              ".wasm",
              ".zip",
          )

          output = subprocess.check_output(["git", "ls-files", "-z"])
          tracked = [entry.decode("utf-8") for entry in output.split(b"\0") if entry]
          if not tracked:
              raise SystemExit("Repository has no tracked files")

          violations = []
          for name in tracked:
              path = PurePosixPath(name)
              root = path.parts[0]
              lowered = name.lower()
              if any(part in disallowed_parts for part in path.parts):
                  violations.append(f"{name}: disallowed path component")
                  continue
              if root not in allowed_root_files and root not in allowed_root_dirs:
                  violations.append(f"{name}: root path is outside metadata allowlist")
                  continue
              if lowered.endswith(disallowed_suffixes):
                  violations.append(f"{name}: source, binary, or archive suffix is not allowed")
                  continue
              file_path = Path(name)
              if file_path.stat().st_size > 1_000_000:
                  violations.append(f"{name}: metadata file is unexpectedly large")
                  continue
              if b"\0" in file_path.read_bytes()[:8192]:
                  violations.append(f"{name}: binary content is not allowed")

          if violations:
              raise SystemExit("Sterility check failed:\n- " + "\n- ".join(violations))

          print("Sterile tracked tree:")
          for name in tracked:
              print(f"- {name}")