mirror of
https://github.com/Such-Software/adaptive-multi-protocol-browser.git
synced 2026-10-17 14:31:46 +02:00
98 lines
3.0 KiB
Python
98 lines
3.0 KiB
Python
from __future__ import annotations
|
|
|
|
import re
|
|
import sys
|
|
from pathlib import Path
|
|
|
|
|
|
ROOT = Path(__file__).resolve().parents[1]
|
|
IGNORED_PARTS = {".git", "__pycache__", "generated", "private"}
|
|
LINK_RE = re.compile(r"\[[^\]]+\]\(([^)]+)\)")
|
|
FORBIDDEN_PUBLIC_TERMS = (
|
|
"wowrace",
|
|
"wowngeon",
|
|
"smirk-monorepo",
|
|
"medusa-multi-tenant-platform",
|
|
"ai-gen-bot",
|
|
)
|
|
SECRET_PATTERNS = (
|
|
("private key block", re.compile(r"-----BEGIN [A-Z0-9 ]*PRIVATE KEY-----")),
|
|
("open ssh private key block", re.compile(r"-----BEGIN OPENSSH PRIVATE KEY-----")),
|
|
("aws access key", re.compile(r"\bAKIA[0-9A-Z]{16}\b")),
|
|
("github token", re.compile(r"\bgh[pousr]_[A-Za-z0-9_]{20,}\b")),
|
|
("slack token", re.compile(r"\bxox[baprs]-[A-Za-z0-9-]{10,}\b")),
|
|
(
|
|
"assigned secret",
|
|
re.compile(
|
|
r"(?i)\b(api[_-]?key|secret|password|token)\s*=\s*['\"][^'\"]{8,}['\"]"
|
|
),
|
|
),
|
|
)
|
|
|
|
|
|
def main() -> int:
|
|
failures: list[str] = []
|
|
for path in _markdown_files():
|
|
text = path.read_text(encoding="utf-8")
|
|
rel = path.relative_to(ROOT)
|
|
if not _has_status_header(text):
|
|
failures.append(f"{rel}: missing status header in first six lines")
|
|
lower_text = text.lower()
|
|
for term in FORBIDDEN_PUBLIC_TERMS:
|
|
if term in lower_text:
|
|
failures.append(f"{rel}: public docs contain private target term {term!r}")
|
|
for label, pattern in SECRET_PATTERNS:
|
|
if pattern.search(text):
|
|
failures.append(f"{rel}: public docs may contain {label}")
|
|
failures.extend(_broken_links(path, text))
|
|
if failures:
|
|
for failure in failures:
|
|
print(failure, file=sys.stderr)
|
|
return 1
|
|
print("AMPBROWSER_DOCS_CHECK status=ok")
|
|
return 0
|
|
|
|
|
|
def _markdown_files() -> list[Path]:
|
|
paths: list[Path] = []
|
|
for path in ROOT.rglob("*.md"):
|
|
rel_parts = set(path.relative_to(ROOT).parts)
|
|
if rel_parts & IGNORED_PARTS:
|
|
continue
|
|
paths.append(path)
|
|
return sorted(paths)
|
|
|
|
|
|
def _has_status_header(text: str) -> bool:
|
|
return any(line.startswith("> Status:") for line in text.splitlines()[:6])
|
|
|
|
|
|
def _broken_links(path: Path, text: str) -> list[str]:
|
|
failures: list[str] = []
|
|
for match in LINK_RE.finditer(text):
|
|
target = match.group(1)
|
|
if _is_external_or_anchor(target):
|
|
continue
|
|
target_path = (path.parent / target.split("#", 1)[0]).resolve()
|
|
try:
|
|
target_path.relative_to(ROOT)
|
|
except ValueError:
|
|
failures.append(f"{path.relative_to(ROOT)}: link escapes repo: {target}")
|
|
continue
|
|
if not target_path.exists():
|
|
failures.append(f"{path.relative_to(ROOT)}: broken link: {target}")
|
|
return failures
|
|
|
|
|
|
def _is_external_or_anchor(target: str) -> bool:
|
|
return (
|
|
target.startswith("#")
|
|
or "://" in target
|
|
or target.startswith("mailto:")
|
|
or target.startswith("tel:")
|
|
)
|
|
|
|
|
|
if __name__ == "__main__":
|
|
raise SystemExit(main())
|