hololake-system-architecture/product-source/hololake-platform/scripts/run-hololake-native-quality-gate.sh

#!/usr/bin/env bash
set -Eeuo pipefail

repository_root=$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)
receipt_path=${1:-}

if [[ -z "${receipt_path}" ]]; then
  echo "usage: run-hololake-native-quality-gate.sh <receipt-output-outside-repository>" >&2
  exit 2
fi

mkdir -p "$(dirname "${receipt_path}")"
receipt_parent=$(cd "$(dirname "${receipt_path}")" && pwd)
receipt_path="${receipt_parent}/$(basename "${receipt_path}")"
case "${receipt_path}" in
  "${repository_root}" | "${repository_root}"/*)
    echo "quality receipt must be written outside the source repository" >&2
    exit 2
    ;;
esac

commit=$(git -C "${repository_root}" rev-parse HEAD)
tree=$(git -C "${repository_root}" rev-parse 'HEAD^{tree}')
branch=$(git -C "${repository_root}" branch --show-current)
profile_id=$(node -p \
  "JSON.parse(require('fs').readFileSync(process.argv[1], 'utf8')).profileId" \
  "${repository_root}/standards/guanghu-native-engineering-profile.json")
started_at=$(date -u '+%Y-%m-%dT%H:%M:%SZ')
current_gate=initialization
passed_gates=

write_receipt() {
  local result=$1
  local total_score=$2
  local failed_gate=${3:-none}
  {
    echo "schema: hololake.guanghu-native-code-quality-receipt/v1"
    echo "protocol: GLS-0844"
    echo "acronym: GHNQG"
    echo "authority: HLP-MOD-CODE-CHANNEL"
    echo "product: HoloLake"
    echo "profile: ${profile_id}"
    echo "result: ${result}"
    echo "total_score: ${total_score}"
    echo "partial_acceptance: false"
    echo "source:"
    echo "  branch: ${branch:-DETACHED}"
    echo "  commit: ${commit}"
    echo "  tree: ${tree}"
    echo "started_at: ${started_at}"
    echo "completed_at: $(date -u '+%Y-%m-%dT%H:%M:%SZ')"
    echo "failed_gate: ${failed_gate}"
    echo "gates:"
    if [[ -n "${passed_gates}" ]]; then
      while IFS= read -r gate; do
        echo "  ${gate}: 100"
      done <<<"${passed_gates}"
    fi
    if [[ "${result}" != "PASS_100" ]]; then
      echo "  ${failed_gate}: 0"
    fi
    echo "external_observers:"
    echo "  authority: none"
    echo "  blocking: false"
  } >"${receipt_path}"
}

on_error() {
  local exit_code=$?
  trap - ERR
  write_receipt FAIL_0 0 "${current_gate}"
  echo "GHNQG_FAIL_0 gate=${current_gate} receipt=${receipt_path}" >&2
  exit "${exit_code}"
}
trap on_error ERR

run_gate() {
  current_gate=$1
  shift
  "$@"
  passed_gates="${passed_gates}${passed_gates:+$'\n'}${current_gate}"
}

run_package_tool() {
  local tool=$1
  shift
  if command -v pnpm >/dev/null 2>&1; then
    pnpm --dir "${repository_root}" exec "${tool}" "$@"
    return
  fi
  if [[ -x "${repository_root}/node_modules/.bin/${tool}" ]]; then
    (
      cd "${repository_root}"
      "node_modules/.bin/${tool}" "$@"
    )
    return
  fi
  echo "${tool} is unavailable; install the locked HoloLake dependencies first" >&2
  return 127
}

run_gate clean_source_tree \
  bash -c '[[ -z "$(git -C "$1" status --porcelain --untracked-files=all)" ]]' \
  _ "${repository_root}"
run_gate diff_whitespace git -C "${repository_root}" diff --check HEAD
run_gate registered_protocol_profile \
  bash "${repository_root}/scripts/test-guanghu-native-authority.sh"
run_gate automatic_protocol_bindings \
  node "${repository_root}/scripts/validate-guanghu-native-profile.mjs"
run_gate frontend_zero_warning_lint \
  run_package_tool eslint . --max-warnings=0
run_gate frontend_type_contract \
  run_package_tool tsc -b
run_gate frontend_build \
  run_package_tool vite build
run_gate frontend_unit_and_integration_tests \
  run_package_tool vitest run
run_gate auditable_native_core_lines_and_functions_100 \
  run_package_tool vitest run \
    --config vitest.guanghu-native.config.ts --coverage
run_gate rust_format \
  cargo fmt --all --manifest-path "${repository_root}/src-tauri/Cargo.toml" -- --check
run_gate rust_unit_and_integration_tests \
  cargo test --manifest-path "${repository_root}/src-tauri/Cargo.toml" \
    --all-targets -- --test-threads=1
run_gate rust_zero_warning_lint \
  cargo clippy --manifest-path "${repository_root}/src-tauri/Cargo.toml" \
    --all-targets -- -D warnings
run_gate bundled_world_and_protocol_validation \
  cargo run --quiet \
    --manifest-path "${repository_root}/guanghu-os/Cargo.toml" \
    -p ghctl -- wake "${repository_root}/guanghu-os/world-seed"
run_gate shell_syntax \
  bash -c '
    while IFS= read -r script; do
      [[ -z "$script" ]] && continue
      bash -n "$1/$script"
    done < <(git -C "$1" ls-files "*.sh" ".husky/*")
  ' _ "${repository_root}"

current_gate=sensitive_information_scan
if git -C "${repository_root}" grep -nEI \
  'BEGIN [A-Z ]*PRIVATE KEY|AKID[A-Za-z0-9]{13,}|(password|secret|access[_-]?token)[[:space:]]*[:=][[:space:]]*["'\''][^"'\'']{12,}' \
  -- .; then
  false
fi
passed_gates="${passed_gates}${passed_gates:+$'\n'}${current_gate}"

current_gate=source_tree_fingerprint
[[ "${commit}" =~ ^[0-9a-f]{40}$ ]]
[[ "${tree}" =~ ^[0-9a-f]{40}$ ]]
index_fingerprint=$(git -C "${repository_root}" ls-files -s | shasum -a 256 | awk '{print $1}')
[[ "${index_fingerprint}" =~ ^[0-9a-f]{64}$ ]]
passed_gates="${passed_gates}${passed_gates:+$'\n'}${current_gate}"

write_receipt PASS_100 100
echo "GHNQG_PASS_100 commit=${commit} tree=${tree} index=${index_fingerprint} receipt=${receipt_path}"