36 lines
2.3 KiB
JavaScript
36 lines
2.3 KiB
JavaScript
import fs from 'node:fs'
|
|
import path from 'node:path'
|
|
|
|
const root = path.resolve(import.meta.dirname, '..')
|
|
const artifact = path.join(root, 'release/server-artifact')
|
|
const update = JSON.parse(fs.readFileSync(path.join(root, 'protocol/update-authority.json'), 'utf8'))
|
|
const profile = JSON.parse(fs.readFileSync(path.join(root, 'protocol/deployment-profile.json'), 'utf8'))
|
|
const failures = []
|
|
|
|
if (update.controlMode !== 'GUANGHU_IS_PRIMARY_UPSTREAM') failures.push('GUANGHU_NOT_PRIMARY_UPSTREAM')
|
|
if (update.upstreamSync !== 'DISABLED') failures.push('UPSTREAM_SYNC_NOT_DISABLED')
|
|
if (update.automaticUpstreamFetch || update.automaticUpstreamMerge || update.automaticComponentUpdate) failures.push('AUTOMATIC_UPSTREAM_PATH_ENABLED')
|
|
if (update.serverSourceCheckout || update.serverSourcePresence !== 'FORBIDDEN') failures.push('SERVER_SOURCE_POLICY_INVALID')
|
|
if (profile.sourceCodeOnServer !== false) failures.push('SOURCE_CODE_ALLOWED_BY_PROFILE')
|
|
if (profile.nodeId === 'PENDING_LIGHTHOUSE_REGISTRATION') failures.push('TARGET_NODE_NOT_REGISTERED')
|
|
if (profile.nodeId !== 'XX-GZ-001') failures.push('TARGET_NODE_MISMATCH')
|
|
if (!profile.lighthouseSourceCommit || !profile.expectedDmiInstanceUuid) failures.push('TARGET_IDENTITY_EVIDENCE_MISSING')
|
|
if (!fs.existsSync(artifact)) failures.push('SERVER_ARTIFACT_MISSING')
|
|
|
|
const forbiddenNames = new Set(['src', '.git', 'node_modules', 'Cargo.toml', 'Cargo.lock', 'package.json', 'pnpm-lock.yaml', 'package-lock.json', 'vite.config.ts', 'tsconfig.json'])
|
|
const forbiddenExtensions = new Set(['.ts', '.tsx', '.rs', '.map'])
|
|
function scan(directory) {
|
|
if (!fs.existsSync(directory)) return
|
|
for (const entry of fs.readdirSync(directory, { withFileTypes: true })) {
|
|
const absolute = path.join(directory, entry.name)
|
|
if (forbiddenNames.has(entry.name) || (!entry.isDirectory() && forbiddenExtensions.has(path.extname(entry.name)))) failures.push(`FORBIDDEN_SOURCE_PAYLOAD:${path.relative(artifact, absolute)}`)
|
|
if (entry.isDirectory()) scan(absolute)
|
|
}
|
|
}
|
|
scan(artifact)
|
|
|
|
if (failures.length) {
|
|
process.stderr.write(`${JSON.stringify({ state: 'BLOCK_0', gate: 'GH-EDU-SERVER-ARTIFACT-ONLY-001', failures }, null, 2)}\n`)
|
|
process.exit(1)
|
|
}
|
|
process.stdout.write(`${JSON.stringify({ state: 'PASS_100', gate: 'GH-EDU-SERVER-ARTIFACT-ONLY-001', upstreamSync: 'DISABLED', sourceIncluded: false, nodeId: profile.nodeId }, null, 2)}\n`)
|