gamertan
b68fa2487d
Sanitized root snapshot from private source commit a72903c63e1753f9e6ffbf40453c0830bdfc05c5 and tree 295641e67eef5979da76746d8ae271249568263e. Private development history and workflows are excluded by the exact allowlist. AI-assisted: OpenAI Codex helped implement, test, and audit this preview. Signed-off-by: Cole Speelman <crspeelman@gmail.com>
54 lines
1.5 KiB
Go
54 lines
1.5 KiB
Go
// SPDX-License-Identifier: AGPL-3.0-only
|
|
|
|
package provenance
|
|
|
|
import (
|
|
"context"
|
|
"errors"
|
|
"fmt"
|
|
"strconv"
|
|
"strings"
|
|
|
|
"gamertan.com/tend/internal/process"
|
|
)
|
|
|
|
type Source struct {
|
|
Commit string
|
|
Epoch int64
|
|
}
|
|
|
|
func Inspect(ctx context.Context, runner process.Runner, dir, branch string) (Source, error) {
|
|
status, err := runner.Run(ctx, dir, nil, "git", "status", "--porcelain=v1", "--untracked-files=all")
|
|
if err != nil {
|
|
return Source{}, err
|
|
}
|
|
if len(status) != 0 {
|
|
return Source{}, errors.New("source checkout is not clean")
|
|
}
|
|
commitOut, err := runner.Run(ctx, dir, nil, "git", "rev-parse", "HEAD")
|
|
if err != nil {
|
|
return Source{}, err
|
|
}
|
|
commit := strings.TrimSpace(string(commitOut))
|
|
if len(commit) != 40 {
|
|
return Source{}, errors.New("source commit is not a full SHA-1 object id")
|
|
}
|
|
remoteOut, err := runner.Run(ctx, dir, nil, "git", "ls-remote", "--exit-code", "origin", "refs/heads/"+branch)
|
|
if err != nil {
|
|
return Source{}, fmt.Errorf("verify pushed commit: %w", err)
|
|
}
|
|
fields := strings.Fields(string(remoteOut))
|
|
if len(fields) != 2 || fields[0] != commit || fields[1] != "refs/heads/"+branch {
|
|
return Source{}, errors.New("HEAD is not the exact pushed branch commit")
|
|
}
|
|
epochOut, err := runner.Run(ctx, dir, nil, "git", "show", "-s", "--format=%ct", commit)
|
|
if err != nil {
|
|
return Source{}, err
|
|
}
|
|
epoch, err := strconv.ParseInt(strings.TrimSpace(string(epochOut)), 10, 64)
|
|
if err != nil || epoch <= 0 {
|
|
return Source{}, errors.New("commit timestamp is invalid")
|
|
}
|
|
return Source{Commit: commit, Epoch: epoch}, nil
|
|
}
|