63 lines
2.0 KiB
Bash
Executable File
63 lines
2.0 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
set -Eeuo pipefail
|
|
|
|
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
|
REPO_ROOT="$(cd "${SCRIPT_DIR}/.." && pwd)"
|
|
export PYTHONPATH="${REPO_ROOT}/src${PYTHONPATH:+:${PYTHONPATH}}"
|
|
|
|
run_step() {
|
|
local label="$1"
|
|
shift
|
|
printf '[check] %s\n' "${label}"
|
|
"$@"
|
|
}
|
|
|
|
secret_scan() {
|
|
python3 - "${REPO_ROOT}" <<'PY'
|
|
import re
|
|
import sys
|
|
from pathlib import Path
|
|
|
|
root = Path(sys.argv[1])
|
|
rom_suffixes = (".iso", ".gcm", ".wbfs", ".nkit.iso")
|
|
secret_pattern = re.compile(
|
|
r"BEGIN [A-Z ]+PRIVATE KEY|Authorization:\s*Bearer\s+[A-Za-z0-9._~-]{20,}"
|
|
)
|
|
findings: list[str] = []
|
|
for path in root.rglob("*"):
|
|
if not path.is_file() or any(part in {".git", "__pycache__", "artifacts"} for part in path.parts):
|
|
continue
|
|
relative = path.relative_to(root)
|
|
if path.name.lower().endswith(rom_suffixes):
|
|
findings.append(f"ROM file: {relative}")
|
|
continue
|
|
if relative in {Path("templates/couchd.token.example"), Path("scripts/check.sh")}:
|
|
continue
|
|
try:
|
|
text = path.read_text(encoding="utf-8")
|
|
except (UnicodeDecodeError, OSError):
|
|
continue
|
|
if secret_pattern.search(text):
|
|
findings.append(f"possible secret: {relative}")
|
|
if findings:
|
|
print("\n".join(findings))
|
|
raise SystemExit(1)
|
|
PY
|
|
}
|
|
|
|
run_step "unit tests" python3 -m unittest discover -v
|
|
run_step "setup shell tests" bash "${REPO_ROOT}/tests/test_setup_modes.sh"
|
|
run_step "shell syntax" bash -n "${REPO_ROOT}/setup.sh" "${REPO_ROOT}"/scripts/*.sh
|
|
run_step "python compile" python3 -m py_compile "${REPO_ROOT}"/src/couchd/*.py "${REPO_ROOT}"/tests/*.py
|
|
if command -v node >/dev/null 2>&1; then
|
|
run_step "dashboard JS syntax" node --check "${REPO_ROOT}/dashboard/app.js"
|
|
else
|
|
printf '[check] dashboard JS syntax skipped: node not installed\n'
|
|
fi
|
|
if git -C "${REPO_ROOT}" rev-parse --is-inside-work-tree >/dev/null 2>&1; then
|
|
run_step "git diff check" git -C "${REPO_ROOT}" diff --check
|
|
else
|
|
printf '[check] git diff check skipped: deployed tree has no .git directory\n'
|
|
fi
|
|
run_step "secret and ROM scan" secret_scan
|