gamertan
c0986168bc
verify / verify (push) Successful in 4m17s
Signed-off-by: Cole Speelman <crspeelman@gmail.com>
28 lines
1.2 KiB
Bash
Executable File
28 lines
1.2 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# SPDX-License-Identifier: AGPL-3.0-only
|
|
set -euo pipefail
|
|
root=$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)
|
|
cd "$root"
|
|
temporary=$(mktemp -d)
|
|
trap 'rm -rf "$temporary"' EXIT
|
|
./scripts/export-public.sh "$temporary/export"
|
|
(cd "$temporary/export" && find . -type f -print | sed 's#^\./##' | LC_ALL=C sort) >"$temporary/actual"
|
|
while IFS= read -r path; do
|
|
if [[ $path = */ ]]; then
|
|
find "${path%/}" -type f -print
|
|
else
|
|
echo "$path"
|
|
fi
|
|
done < <(grep -Ev '^[[:space:]]*(#|$)' scripts/public-snapshot.allow) | LC_ALL=C sort >"$temporary/expected"
|
|
diff -u "$temporary/expected" "$temporary/actual"
|
|
# The allowlist is a source distribution boundary: it must still contain the
|
|
# implementation files required by the exported packages, not just match itself.
|
|
(cd "$temporary/export" && GOWORK=off go build ./...)
|
|
private_word='PRI''VATE'
|
|
token_word='to''ken'
|
|
private_pattern="BEGIN (RSA|OPENSSH|EC) ${private_word} KEY|Authorization: ${token_word}|/home/"'cole'"|/mnt/c/"'Users'"|"'eqlwiki'"-deploy|"'crspeelman'"@gmail\\.com"
|
|
if rg -n --hidden --glob '!.git/**' "$private_pattern" "$temporary/export"; then
|
|
echo "private marker escaped into public snapshot" >&2; exit 1
|
|
fi
|
|
test -z "$(git status --porcelain=v1 --untracked-files=all)"
|