gamertan
a39e8f893c
verify / verify (push) Successful in 3m28s
Publish the reviewed Gamertan Web Foundations v0.1.0-preview.6 snapshot with a narrow mode-0640 collector boundary, private mode-0600 default, explicit setgid ownership guidance, and native macOS-safe release verification. Exported from reviewed private source 120d660fa432761f85316ca3dde990e2dd142f19 after trusted Gitea CI run 681 and the complete native Mac verification suite. Material implementation assistance provided by OpenAI Codex; reviewed and verified through the maintainer workflow. Signed-off-by: Cole Speelman <crspeelman@gmail.com>
25 lines
1.0 KiB
Bash
Executable File
25 lines
1.0 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# SPDX-License-Identifier: AGPL-3.0-only
|
|
set -euo pipefail
|
|
root=$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)
|
|
cd "$root"
|
|
temporary=$(mktemp -d)
|
|
trap 'rm -rf "$temporary"' EXIT
|
|
./scripts/export-public.sh "$temporary/export"
|
|
(cd "$temporary/export" && find . -type f -print | sed 's#^\./##' | LC_ALL=C sort) >"$temporary/actual"
|
|
while IFS= read -r path; do
|
|
if [[ $path = */ ]]; then
|
|
find "${path%/}" -type f -print
|
|
else
|
|
echo "$path"
|
|
fi
|
|
done < <(grep -Ev '^[[:space:]]*(#|$)' scripts/public-snapshot.allow) | LC_ALL=C sort >"$temporary/expected"
|
|
diff -u "$temporary/expected" "$temporary/actual"
|
|
private_word='PRI''VATE'
|
|
token_word='to''ken'
|
|
private_pattern="BEGIN (RSA|OPENSSH|EC) ${private_word} KEY|Authorization: ${token_word}|/home/"'cole'"|/mnt/c/"'Users'"|"'eqlwiki'"-deploy|"'crspeelman'"@gmail\\.com"
|
|
if rg -n --hidden --glob '!.git/**' "$private_pattern" "$temporary/export"; then
|
|
echo "private marker escaped into public snapshot" >&2; exit 1
|
|
fi
|
|
test -z "$(git status --porcelain=v1 --untracked-files=all)"
|