74 lines
1.9 KiB
JavaScript
74 lines
1.9 KiB
JavaScript
#!/usr/bin/env node
|
|
|
|
import { execFileSync } from "node:child_process";
|
|
import fs from "node:fs";
|
|
import path from "node:path";
|
|
|
|
const allowed = new Map([
|
|
[
|
|
"guanghu-ice-heart",
|
|
"https://guanghulab.com/code/bingshuo/guanghu-ice-heart.git",
|
|
],
|
|
[
|
|
"hololake-system-architecture",
|
|
"https://guanghulab.com/code/bingshuo/hololake-system-architecture.git",
|
|
],
|
|
]);
|
|
|
|
function classify(repositoryPath) {
|
|
const resolved = path.resolve(repositoryPath);
|
|
const gitMarker = path.join(resolved, ".git");
|
|
if (!fs.existsSync(gitMarker)) {
|
|
return { path: resolved, state: "NOT_GIT_WORKTREE" };
|
|
}
|
|
let remote;
|
|
try {
|
|
remote = execFileSync(
|
|
"git",
|
|
["remote", "get-url", "--push", "origin"],
|
|
{ cwd: resolved, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] },
|
|
).trim();
|
|
} catch {
|
|
return { path: resolved, state: "ORIGIN_PUSH_URL_MISSING" };
|
|
}
|
|
let parsed;
|
|
try {
|
|
parsed = new URL(remote);
|
|
} catch {
|
|
return { path: resolved, state: "NON_CANONICAL_REMOTE_FORMAT" };
|
|
}
|
|
if (parsed.username || parsed.password) {
|
|
return { path: resolved, state: "CREDENTIAL_BEARING_REMOTE_FORBIDDEN" };
|
|
}
|
|
const slug = path.basename(parsed.pathname, ".git");
|
|
const expected = allowed.get(slug);
|
|
if (!expected || remote !== expected) {
|
|
return {
|
|
path: resolved,
|
|
state: remote.includes("/fifth-domain/")
|
|
? "HISTORICAL_REMOTE_NO_PUSH"
|
|
: "NON_CANONICAL_REMOTE_NO_PUSH",
|
|
};
|
|
}
|
|
return {
|
|
path: resolved,
|
|
repository: slug,
|
|
state: "CANONICAL_PUSH_ROUTE",
|
|
remote: expected,
|
|
};
|
|
}
|
|
|
|
const targets = process.argv.slice(2);
|
|
if (!targets.length) {
|
|
process.stderr.write(
|
|
"usage: node scripts/audit-code-channel-route.mjs <git-worktree> [...]\n",
|
|
);
|
|
process.exit(2);
|
|
}
|
|
|
|
const results = targets.map(classify);
|
|
process.stdout.write(`${JSON.stringify(results, null, 2)}\n`);
|
|
if (results.some((entry) => entry.state !== "CANONICAL_PUSH_ROUTE")) {
|
|
process.exitCode = 1;
|
|
}
|
|
|