102 lines
4.5 KiB
TypeScript
102 lines
4.5 KiB
TypeScript
/** Reject tracked files that expose the internal repository identity outside audited publishing declarations. */
|
|
|
|
import { execFileSync } from 'node:child_process'
|
|
import { existsSync, lstatSync, readFileSync, readlinkSync } from 'node:fs'
|
|
import { resolve } from 'node:path'
|
|
import { pathToFileURL } from 'node:url'
|
|
|
|
const root = resolve(import.meta.dirname, '..')
|
|
const internalOwner = ['deepseek', 'harness'].join('-')
|
|
const internalRepository = [internalOwner, internalOwner].join('/')
|
|
const internalIssueShorthand = `${internalOwner}#`
|
|
const trustedPublishingRepositoryUrl = `git+https://github.com/${internalRepository}.git`
|
|
|
|
/** Exact declarations that intentionally expose the source repository for trusted publishing. */
|
|
const allowedInternalRepositoryLineByFile: Readonly<Record<string, string>> = {
|
|
'native/landlock-run/packages/entry/package.json': `"url": "${trustedPublishingRepositoryUrl}",`,
|
|
'native/landlock-run/packages/linux-arm64/package.json': `"url": "${trustedPublishingRepositoryUrl}",`,
|
|
'native/landlock-run/packages/linux-x64/package.json': `"url": "${trustedPublishingRepositoryUrl}",`,
|
|
'scripts/check-workspace-constraints.ts': `const repositoryUrl = '${trustedPublishingRepositoryUrl}'`,
|
|
}
|
|
|
|
const namedReferenceCharacters: Readonly<Record<string, string>> = {
|
|
hyphen: '-',
|
|
num: '#',
|
|
sol: '/',
|
|
}
|
|
|
|
/** Normalize source spellings that render or decode to repository separators. */
|
|
function canonicalReferenceText(source: string): string {
|
|
return source
|
|
.replaceAll('\\/', '/')
|
|
.replace(/\\u(0023|002d|002f)/gi, (_match, code: string) => String.fromCodePoint(Number.parseInt(code, 16)))
|
|
.replace(/%(23|2d|2f)/gi, (_match, code: string) => String.fromCodePoint(Number.parseInt(code, 16)))
|
|
.replace(/&#(?:(\d+)|x([\da-f]+));/gi, (entity, decimal: string | undefined, hexadecimal: string | undefined) => {
|
|
const code = Number.parseInt(decimal ?? hexadecimal ?? '', decimal === undefined ? 16 : 10)
|
|
return code === 35 || code === 45 || code === 47 ? String.fromCodePoint(code) : entity
|
|
})
|
|
.replace(/&(hyphen|num|sol);/gi, (entity, name: string) => namedReferenceCharacters[name.toLowerCase()] ?? entity)
|
|
.normalize('NFKC')
|
|
.toLowerCase()
|
|
}
|
|
|
|
/** One tracked reference to the internal repository. */
|
|
export interface InternalRepositoryReference {
|
|
/** Repository-relative file path. */
|
|
file: string
|
|
/** One-based source line. */
|
|
line: number
|
|
}
|
|
|
|
/**
|
|
* Locate unaudited internal-repository references in one text file.
|
|
* @param file - Repository-relative path used in diagnostics.
|
|
* @param source - Text to inspect.
|
|
* @returns every matching source line.
|
|
*/
|
|
export function findInternalRepositoryReferences(file: string, source: string): InternalRepositoryReference[] {
|
|
const references: InternalRepositoryReference[] = []
|
|
for (const [index, line] of source.split('\n').entries()) {
|
|
const canonicalLine = canonicalReferenceText(line)
|
|
const isAllowedPublishingDeclaration = line.trim() === allowedInternalRepositoryLineByFile[file]
|
|
if (!isAllowedPublishingDeclaration
|
|
&& (canonicalLine.includes(internalRepository) || canonicalLine.includes(internalIssueShorthand))) {
|
|
references.push({ file, line: index + 1 })
|
|
}
|
|
}
|
|
return references
|
|
}
|
|
|
|
function trackedFiles(repoRoot: string): string[] {
|
|
return execFileSync('git', ['ls-files', '-z'], { cwd: repoRoot, encoding: 'utf8' })
|
|
.split('\0')
|
|
.filter(file => file !== '')
|
|
}
|
|
|
|
function scanRepository(repoRoot: string): InternalRepositoryReference[] {
|
|
const references: InternalRepositoryReference[] = []
|
|
for (const file of trackedFiles(repoRoot)) {
|
|
const path = resolve(repoRoot, file)
|
|
if (!existsSync(path)) continue
|
|
const stat = lstatSync(path)
|
|
if (!stat.isFile() && !stat.isSymbolicLink()) continue
|
|
const source = stat.isSymbolicLink() ? readlinkSync(path) : readFileSync(path, 'utf8')
|
|
if (source.includes('\0')) continue
|
|
references.push(...findInternalRepositoryReferences(file, source))
|
|
}
|
|
return references
|
|
}
|
|
|
|
const invokedPath = process.argv[1]
|
|
const isMain = invokedPath !== undefined && import.meta.url === pathToFileURL(resolve(invokedPath)).href
|
|
if (isMain) {
|
|
const references = scanRepository(root)
|
|
if (references.length === 0) {
|
|
console.log('verify-public-repository-links: tracked files expose no unexpected internal repository identity.')
|
|
} else {
|
|
console.error('verify-public-repository-links: unexpected internal repository references found:')
|
|
for (const reference of references) console.error(` ${reference.file}:${String(reference.line)}`)
|
|
process.exitCode = 1
|
|
}
|
|
}
|