64 lines
2.3 KiB
Shell
Executable file
64 lines
2.3 KiB
Shell
Executable file
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
|
|
ref="${1:-HEAD}"
|
|
root="$(git rev-parse --show-toplevel)"
|
|
allowlist="$root/scripts/public-history-allowlist.txt"
|
|
tmpdir="$(mktemp -d)"
|
|
trap 'rm -rf "$tmpdir"' EXIT
|
|
cd "$root"
|
|
|
|
if [[ "$(git rev-parse --is-shallow-repository)" != "false" ]]; then
|
|
echo "[public-history] full history is required" >&2
|
|
exit 1
|
|
fi
|
|
git rev-parse --verify "${ref}^{commit}" >/dev/null
|
|
|
|
# RedFlag legitimately manages private networks. This gate is deliberately
|
|
# Casey-specific: it catches known home infrastructure and author metadata,
|
|
# not every RFC1918 address a fleet-management tool needs in examples/tests.
|
|
git log "$ref" -p --no-ext-diff --no-color --format='@@COMMIT@@%H' |
|
|
awk '
|
|
/^@@COMMIT@@/ { sha=substr($0,11); next }
|
|
/10\.10\.20\.[0-9]{1,3}|172\.16\.42\.[0-9]{1,3}|wiuf-docker|gitea\.wiuf\.net|\/home\/casey/ { print sha }
|
|
' >"$tmpdir/content"
|
|
|
|
git log "$ref" --format='%H%x09%an%x09%ae%x09%cn%x09%ce' |
|
|
awk -F '\t' '
|
|
tolower($0) ~ /@wiuf\.net|@wifu\.net|10\.10\.20\.|172\.16\.42\.|\/home\/casey/ { print $1 }
|
|
' >"$tmpdir/metadata"
|
|
|
|
sed -E '/^[[:space:]]*(#|$)/d' "$allowlist" | sort -u >"$tmpdir/allowed"
|
|
cat "$tmpdir/content" "$tmpdir/metadata" | sort -u >"$tmpdir/found"
|
|
|
|
while IFS= read -r sha; do
|
|
if ! git merge-base --is-ancestor "$sha" "$ref"; then
|
|
echo "[public-history] stale or unreachable allowlist commit: $sha" >&2
|
|
exit 1
|
|
fi
|
|
done <"$tmpdir/allowed"
|
|
|
|
comm -23 "$tmpdir/found" "$tmpdir/allowed" >"$tmpdir/unreviewed"
|
|
if [[ -s "$tmpdir/unreviewed" ]]; then
|
|
echo "[public-history] unreviewed private infrastructure or author metadata:" >&2
|
|
while IFS= read -r sha; do
|
|
printf ' %s %s\n' "$sha" "$(git show -s --format='%s' "$sha")" >&2
|
|
done <"$tmpdir/unreviewed"
|
|
exit 1
|
|
fi
|
|
|
|
large_blobs="$tmpdir/large-blobs"
|
|
git rev-list --objects "$ref" |
|
|
git cat-file --batch-check='%(objecttype) %(objectname) %(objectsize) %(rest)' |
|
|
awk '$1 == "blob" && $3 > 52428800 { print $2, $3, $4 }' >"$large_blobs"
|
|
if [[ -s "$large_blobs" ]]; then
|
|
echo "[public-history] blobs over 50 MiB require LFS or removal:" >&2
|
|
cat "$large_blobs" >&2
|
|
exit 1
|
|
fi
|
|
|
|
test -s LICENSE
|
|
test -s README.md
|
|
grep -qiE '^#{1,3}[[:space:]]+(quick start|install|installation)|install' README.md
|
|
|
|
echo "[public-history] complete reachable history, metadata, license, install path, and blob size passed"
|