Skip to content

Commit 4484878

Browse files
dansysanalystdansysanalyst
committed
wip
0 parents  commit 4484878

51 files changed

Lines changed: 9803 additions & 0 deletions

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.github/workflows/check_media_types.yml‎

Lines changed: 165 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,165 @@
1+
name: Secure Media + Docs Validation
2+
3+
on:
4+
push:
5+
pull_request:
6+
7+
permissions:
8+
contents: read
9+
10+
concurrency:
11+
group: validation-${{ github.ref }}
12+
cancel-in-progress: true
13+
14+
jobs:
15+
validate:
16+
runs-on: ubuntu-latest
17+
18+
steps:
19+
- name: Checkout repository
20+
uses: actions/checkout@v5
21+
22+
- name: Install dependencies
23+
run: |
24+
set -euo pipefail
25+
26+
sudo apt-get update
27+
28+
sudo apt-get install -y \
29+
file \
30+
ffmpeg \
31+
imagemagick \
32+
jq \
33+
clamav \
34+
clamav-freshclam
35+
36+
- name: Update ClamAV signatures
37+
run: |
38+
set -euo pipefail
39+
40+
sudo systemctl stop clamav-freshclam || true
41+
42+
# Allow fallback if signature update fails (common on CI)
43+
sudo freshclam || true
44+
45+
echo "ClamAV databases:"
46+
ls -lah /var/lib/clamav || true
47+
48+
- name: Scan for malware
49+
run: |
50+
set -euo pipefail
51+
52+
SCAN_TARGETS=()
53+
[ -d media ] && SCAN_TARGETS+=(media)
54+
[ -d docs ] && SCAN_TARGETS+=(docs)
55+
56+
if [ ${#SCAN_TARGETS[@]} -eq 0 ]; then
57+
echo "Neither media/ nor docs/ exists"
58+
exit 1
59+
fi
60+
61+
if ls /var/lib/clamav/*.cvd >/dev/null 2>&1 || \
62+
ls /var/lib/clamav/*.cld >/dev/null 2>&1; then
63+
64+
clamscan -r "${SCAN_TARGETS[@]}" \
65+
--infected \
66+
--no-summary \
67+
--max-filesize=50M \
68+
--max-scansize=100M
69+
else
70+
echo "WARNING: No ClamAV signatures found. Skipping scan."
71+
fi
72+
73+
- name: Validate media files
74+
run: |
75+
set -euo pipefail
76+
77+
if [ ! -d media ]; then
78+
echo "media/ directory not found"
79+
exit 1
80+
fi
81+
82+
find media -type f -print0 | while IFS= read -r -d '' file; do
83+
echo "Checking media: $file"
84+
85+
mime=$(file --mime-type -b "$file")
86+
87+
case "$mime" in
88+
image/jpeg|image/png|image/gif|image/webp)
89+
identify "$file" >/dev/null
90+
;;
91+
92+
video/mp4|video/webm|video/quicktime)
93+
ffprobe -v error "$file" >/dev/null
94+
;;
95+
96+
audio/mpeg|audio/wav|audio/ogg)
97+
ffprobe -v error "$file" >/dev/null
98+
;;
99+
100+
*)
101+
echo "ERROR: Unsupported media type"
102+
echo "File: $file"
103+
echo "MIME: $mime"
104+
exit 1
105+
;;
106+
esac
107+
done
108+
109+
- name: Validate docs files
110+
run: |
111+
set -euo pipefail
112+
113+
if [ ! -d docs ]; then
114+
echo "docs/ directory not found"
115+
exit 1
116+
fi
117+
118+
find docs -type f -print0 | while IFS= read -r -d '' file; do
119+
echo "Checking docs: $file"
120+
121+
case "$file" in
122+
*.md)
123+
# 1. Must be valid text file (reject binaries properly)
124+
if ! grep -Iq . "$file"; then
125+
echo "ERROR: Non-text or binary markdown detected"
126+
echo "File: $file"
127+
exit 1
128+
fi
129+
130+
# 2. Enforce UTF-8 encoding (prevents UTF-16 issues)
131+
encoding=$(file --mime-encoding -b "$file" || true)
132+
133+
case "$encoding" in
134+
utf-8|us-ascii) ;;
135+
*)
136+
echo "ERROR: Invalid encoding in markdown: $encoding"
137+
echo "File: $file"
138+
exit 1
139+
;;
140+
esac
141+
;;
142+
143+
*.json)
144+
jq -e . "$file" >/dev/null
145+
;;
146+
147+
*)
148+
echo "ERROR: Unsupported file in docs/"
149+
echo "File: $file"
150+
exit 1
151+
;;
152+
esac
153+
done
154+
155+
- name: Reject executable files
156+
run: |
157+
set -euo pipefail
158+
159+
mapfile -d '' exec_files < <(find media docs -type f -executable -print0 2>/dev/null || true)
160+
161+
if [ ${#exec_files[@]} -gt 0 ]; then
162+
echo "ERROR: Executable files found"
163+
printf '%s\n' "${exec_files[@]}"
164+
exit 1
165+
fi

‎.github/workflows/json_check.yml‎

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
name: JSON Validation
2+
3+
on:
4+
push:
5+
pull_request:
6+
7+
permissions:
8+
contents: read
9+
10+
concurrency:
11+
group: json-validation-${{ github.ref }}
12+
cancel-in-progress: true
13+
14+
jobs:
15+
validate-json:
16+
runs-on: ubuntu-latest
17+
18+
steps:
19+
- name: Checkout repository
20+
uses: actions/checkout@v4
21+
with:
22+
persist-credentials: false
23+
24+
- name: Setup Node.js
25+
uses: actions/setup-node@v4
26+
with:
27+
node-version: 20
28+
29+
- name: 🧐 Validate JSON files in docs/
30+
shell: bash
31+
run: |
32+
set -euo pipefail
33+
34+
echo "🔎 Checking docs/*.json files..."
35+
36+
shopt -s nullglob
37+
38+
for file in docs/*.json; do
39+
echo "Validating $file"
40+
node -e "JSON.parse(require('fs').readFileSync('$file','utf8'))"
41+
done
42+
43+
echo "✅ All JSON files are valid."

‎.github/workflows/lint_markdown.yml‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
name: Lint Markdown
2+
3+
on:
4+
push:
5+
branches:
6+
- 6x
7+
- 7x
8+
paths:
9+
- "docs/**/*.md"
10+
pull_request:
11+
branches:
12+
- 6x
13+
- 7x
14+
paths:
15+
- "docs/**/*.md"
16+
17+
permissions:
18+
contents: read
19+
20+
concurrency:
21+
group: markdown-lint-${{ github.ref }}
22+
cancel-in-progress: true
23+
24+
jobs:
25+
markdown-linter:
26+
name: Run Markdown Linter
27+
runs-on: ubuntu-latest
28+
29+
steps:
30+
- name: Checkout repository
31+
uses: actions/checkout@v4
32+
with:
33+
persist-credentials: false
34+
35+
- name: Setup Node.js
36+
uses: actions/setup-node@v4
37+
with:
38+
node-version: 20
39+
cache: npm
40+
41+
- name: Install dependencies
42+
run: npm ci
43+
44+
- name: 🏗️ Markdown Lint Check
45+
run: npm run markdown:lint-check
46+
47+
- name: 💅 Markdown Format Check
48+
run: npm run markdown:format-check

‎.github/workflows/lychee.yml‎

Lines changed: 105 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,105 @@
1+
name: Link Check
2+
3+
on:
4+
push:
5+
branches:
6+
- 6x
7+
- 7x
8+
pull_request:
9+
branches:
10+
- 6x
11+
- 7x
12+
13+
permissions:
14+
contents: read
15+
16+
jobs:
17+
links:
18+
runs-on: ubuntu-latest
19+
20+
steps:
21+
- name: Checkout
22+
uses: actions/checkout@v6
23+
24+
- name: Normalize docs
25+
run: |
26+
set -euo pipefail
27+
28+
INPUT_DIR="docs"
29+
OUTPUT_DIR=".docs-clean"
30+
MEDIA_DIR="media"
31+
MEDIA_OUT="${OUTPUT_DIR}/media"
32+
33+
# --- reset output dir -------------------------------------------
34+
rm -rf "${OUTPUT_DIR}"
35+
mkdir -p "${OUTPUT_DIR}"
36+
37+
# --- walk docs/, transform .md files into .docs-clean -----------
38+
if [ -d "${INPUT_DIR}" ]; then
39+
find "${INPUT_DIR}" -type f -name "*.md" -print0 | while IFS= read -r -d '' file; do
40+
rel="${file#${INPUT_DIR}/}"
41+
out="${OUTPUT_DIR}/${rel}"
42+
mkdir -p "$(dirname "${out}")"
43+
44+
perl -CSD -pe '
45+
BEGIN {
46+
sub rewrite_link {
47+
my ($link) = @_;
48+
return $link unless defined $link && length $link;
49+
50+
# leave external / mailto links untouched
51+
return $link if $link =~ m{^https?://} || $link =~ m{^mailto:};
52+
53+
# sponsor links -> harmless placeholder
54+
#return "#" if $link =~ m{^/sponsors/};
55+
56+
my $out = $link;
57+
58+
# 1. root-relative path -> relative path
59+
$out =~ s{^/+(.*)$}{../$1};
60+
61+
# 2. strip anchors
62+
$out =~ s{^(?!https?://)([^#]*)#.*$}{$1};
63+
64+
# 3. .html -> no extension
65+
$out =~ s{^(?!https?://)(.+)\.html$}{$1};
66+
67+
# 4. default to .md if no known extension
68+
$out =~ s{^(?!https?://)(.+)(?<!\.(?:md|png|jpg|jpeg|gif|svg|webp|pdf|mp4))$}{$1.md};
69+
70+
# 5. collapse stray leading double slashes
71+
$out =~ s{^//+}{/};
72+
73+
# 6. legacy media dir -> media/
74+
$out =~ s{_media/}{media/}g;
75+
76+
return $out;
77+
}
78+
}
79+
80+
s{\]\(([^)]+)\)}{"](" . rewrite_link($1) . ")"}ge;
81+
s{src=(["\x27])([^"\x27]+)\1}{"src=" . $1 . rewrite_link($2) . $1}ge;
82+
s{href=(["\x27])([^"\x27]+)\1}{"href=" . $1 . rewrite_link($2) . $1}ge;
83+
' "${file}" > "${out}"
84+
done
85+
fi
86+
87+
# --- copy root media/ -> .docs-clean/media -----------------------
88+
if [ -d "${MEDIA_DIR}" ]; then
89+
mkdir -p "${MEDIA_OUT}"
90+
cp -a "${MEDIA_DIR}/." "${MEDIA_OUT}/"
91+
fi
92+
93+
echo "OK: docs + root media -> .docs-clean"
94+
95+
- name: Run lychee
96+
id: lychee
97+
uses: lycheeverse/lychee-action@v2
98+
with:
99+
args: >
100+
.docs-clean
101+
--exclude '^https?://(www\.)?(twitter\.com|x\.com|instagram\.com|linkedin\.com)'
102+
--exclude '/sponsors/'
103+
format: markdown
104+
output: lychee-report.md
105+
fail: true

‎.gitignore‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
node_modules
2+
.temp
3+
.cache
4+
node_modules
5+
.temp
6+
.cache
7+
.env
8+
docs/.vitepress/dist
9+
docs/.vitepress/cache
10+
.idea
11+
.DS_Store

0 commit comments

Comments
 (0)