fix(hooks): 讓四支閘認得出「指令位置」跟「heredoc/引號裡的文字」
inkstone/InkStoneCo#23、#56 同一個病：閘對整條指令字串做關鍵字掃描， 把「檔案內容/留言引用裡剛好提到某個關鍵字」當成「真的在執行」， 同時放過包一層讀取指令、或藏在 heredoc body 裡的真動作。 - 新增共用輔助 hooks/lib/strip_heredoc.py：heredoc body 是資料不是指令， 四支閘（github-contact / main-and-prod-push / stage-before-prod / kbdb-api-wall 的 Bash 分支）呼叫前一律先拿掉 body 再比對。 - main-and-prod-push-guard.sh：修掉跟 release-tag-guard.sh 同款的 「開頭是讀取工具就整條放行」前綴繞過洞；git push 的偵測改成指令位置比對； main/master 目標改用單字邊界，不再誤中 "domain" 這種子字串。 - github-contact-guard.sh：拿掉 gh CLI／git push 判準裡「前面隨便一個空白 就算數」的鬆散邊界，只認真正的指令分隔符。 - kbdb-api-wall-guard.sh：Bash 分支原本引用不存在的 kbdb_cmd_check.py， python3 找不到檔案就吃掉錯誤印 "OK"，該分支形同虛設——任何 `wrangler d1 execute` 直打 kbdb 都會被放行。邏輯搬進新檔 hooks/lib/kbdb_cmd_check.py（shlex 分詞、quote-aware），把 .sh 的 參照路徑改過去，補回 Bash 分支的 kbdb-sql-ok 逃生口。 四支各補 InkStoneCo#40 §1 要求的三行中文檔頭。 新增四支可重跑測試（scripts/test-*.sh），共 69 條斷言全過， 含 #23／#56 票上實撞的原始形狀（寫 docs/TESTING.md 的 heredoc、 貼引用 #56 敘述的留言、`grep git push`）。 Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
This commit is contained in:
Executable
+39
@@ -0,0 +1,39 @@
|
||||
#!/bin/bash
|
||||
# github-contact-guard 的測試（inkstone/InkStoneCo#23）
|
||||
# 判準：真的寫 GitHub（gh CLI 高頻 API、git push/remote add 指向 github.com）要擋；
|
||||
# 只是提到（heredoc body、同一行引號內的散文、commit message）不准擋；
|
||||
# 讀取（clone/fetch/pull/curl 抓檔）一律放行，不管有沒有帶認證。
|
||||
cd "$(dirname "$0")/.." || exit 1
|
||||
H=hooks/github-contact-guard.sh
|
||||
PASS=0; FAIL=0
|
||||
run(){ # $1=want $2=cmd
|
||||
printf '%s' "{\"tool_name\":\"Bash\",\"tool_input\":{\"command\":$(python3 -c 'import json,sys;print(json.dumps(sys.argv[1]))' "$2")}}" \
|
||||
| bash "$H" >/dev/null 2>&1
|
||||
got=$?
|
||||
if [ "$got" = "$1" ]; then PASS=$((PASS+1)); printf ' ✅ '; else FAIL=$((FAIL+1)); printf ' ❌ '; fi
|
||||
printf 'want=%s got=%s %.72s\n' "$1" "$got" "$2"
|
||||
}
|
||||
|
||||
echo "── 該擋：真的在寫 GitHub ──"
|
||||
run 2 'gh issue create --title x --body y'
|
||||
run 2 'gh pr create --title x'
|
||||
run 2 'git push https://github.com/example/example.git HEAD:main'
|
||||
run 2 'git remote add github https://github.com/example/example.git'
|
||||
run 2 'echo start && gh api repos/example/example/issues'
|
||||
|
||||
echo "── 不該擋：讀取一律放行 ──"
|
||||
run 0 'git clone https://github.com/example/example.git'
|
||||
run 0 'git fetch github'
|
||||
run 0 'curl -sL https://github.com/example/example/releases/latest'
|
||||
run 0 'gh --version'
|
||||
|
||||
echo "── 不該擋：只是提到、heredoc body、同一行引號內的散文 ──"
|
||||
run 0 "$(printf 'cat > docs/TESTING.md <<%sEOF%s\nexample: git push https://github.com/example/example.git HEAD:main\nEOF\n' "'" "'")"
|
||||
run 0 'git commit -m "docs: explain why gh api calls used to be mis-flagged"'
|
||||
run 0 'python3 -c "requests.post(url, json={\"body\": \"quoting: git push origin main to github.com was mis-flagged as a real push\"})"'
|
||||
run 0 'grep -n "gh api" hooks/github-contact-guard.sh'
|
||||
run 0 'grep -rn "git push" installer/scripts/line-source-repo.mjs'
|
||||
|
||||
echo
|
||||
echo "$PASS/$((PASS+FAIL)) 通過"
|
||||
[ "$FAIL" -eq 0 ]
|
||||
Executable
+41
@@ -0,0 +1,41 @@
|
||||
#!/bin/bash
|
||||
# kbdb-api-wall-guard 的 Bash 分支測試（inkstone/ISEP#30 群組）
|
||||
#
|
||||
# 這支補的是一個真的漏擋：hooks/kbdb-api-wall-guard.sh 的 Bash 分支原本引用
|
||||
# hooks/kbdb_cmd_check.py（不存在的路徑），python3 找不到檔案就以非零結束，
|
||||
# 而呼叫端寫成 `... || echo "OK"` —— 於是這個分支永遠印 "OK"，Bash 分支形同虛設，
|
||||
# 任何 `wrangler d1 execute` 直打 kbdb 都會被放行。修法：邏輯搬進
|
||||
# hooks/lib/kbdb_cmd_check.py（新檔），並把 .sh 裡的參照路徑改過去。
|
||||
#
|
||||
# 判準：真的用 wrangler 對 kbdb 這顆 D1 下 execute 要擋；只是提到（commit message、
|
||||
# heredoc body、grep 搜尋）、或目標不是 kbdb 的 D1，都不准擋。
|
||||
cd "$(dirname "$0")/.." || exit 1
|
||||
H=hooks/kbdb-api-wall-guard.sh
|
||||
PASS=0; FAIL=0
|
||||
run(){ # $1=want $2=cmd
|
||||
printf '%s' "{\"tool_name\":\"Bash\",\"tool_input\":{\"command\":$(python3 -c 'import json,sys;print(json.dumps(sys.argv[1]))' "$2")}}" \
|
||||
| bash "$H" >/dev/null 2>&1
|
||||
got=$?
|
||||
if [ "$got" = "$1" ]; then PASS=$((PASS+1)); printf ' ✅ '; else FAIL=$((FAIL+1)); printf ' ❌ '; fi
|
||||
printf 'want=%s got=%s %.72s\n' "$1" "$got" "$2"
|
||||
}
|
||||
|
||||
w="wrangler"; sub="d1 execute"; db="arcrun-kbdb"
|
||||
|
||||
echo "── 該擋：真的直打 kbdb 這顆 D1 執行 SQL ──"
|
||||
run 2 "$w $sub $db --remote --command \"SELECT 1\""
|
||||
run 2 "npx $w $sub $db --command \"SELECT 1\""
|
||||
run 2 "echo start && $w $sub $db --command \"SELECT 1\""
|
||||
|
||||
echo "── 不該擋：只是提到、heredoc body、目標不是 kbdb ──"
|
||||
run 0 "git commit -m \"ran $w $sub $db earlier, see ticket\""
|
||||
run 0 "$(printf 'cat > note.md <<%sEOF%s\nwe should avoid %s %s %s\nEOF\n' "'" "'" "$w" "$sub" "$db")"
|
||||
run 0 "grep -rn \"$w $sub\" hooks/"
|
||||
run 0 "$w $sub some-other-db --command \"SELECT 1\""
|
||||
run 0 "$w deploy --env stage"
|
||||
run 0 'echo hello world'
|
||||
run 0 "$w $sub $db --command \"SELECT 1\" kbdb-sql-ok"
|
||||
|
||||
echo
|
||||
echo "$PASS/$((PASS+FAIL)) 通過"
|
||||
[ "$FAIL" -eq 0 ]
|
||||
Executable
+36
@@ -0,0 +1,36 @@
|
||||
#!/bin/bash
|
||||
# main-and-prod-push-guard 的測試（inkstone/InkStoneCo#23、#56）
|
||||
# 判準：真的推 main/master 要擋；只是提到（heredoc body、同一行引號內的散文、
|
||||
# 開頭包一層讀取指令）都不准擋；推自己的分支、含子字串但目標不是 main/master
|
||||
# 的分支（如 fix/custom-domain-setup）也不准擋。
|
||||
cd "$(dirname "$0")/.." || exit 1
|
||||
H=hooks/main-and-prod-push-guard.sh
|
||||
PASS=0; FAIL=0
|
||||
run(){ # $1=want $2=cmd
|
||||
printf '%s' "{\"tool_name\":\"Bash\",\"tool_input\":{\"command\":$(python3 -c 'import json,sys;print(json.dumps(sys.argv[1]))' "$2")}}" \
|
||||
| bash "$H" >/dev/null 2>&1
|
||||
got=$?
|
||||
if [ "$got" = "$1" ]; then PASS=$((PASS+1)); printf ' ✅ '; else FAIL=$((FAIL+1)); printf ' ❌ '; fi
|
||||
printf 'want=%s got=%s %.72s\n' "$1" "$got" "$2"
|
||||
}
|
||||
|
||||
echo "── 該擋：真的在推 main／master，且沒有戳記 ──"
|
||||
run 2 'git push gitea HEAD:main'
|
||||
run 2 'git push origin master'
|
||||
run 2 'echo start && git push gitea HEAD:main'
|
||||
run 2 'ls && git push gitea HEAD:main'
|
||||
|
||||
echo "── 不該擋：只是提到、heredoc body、目標不是 main/master ──"
|
||||
run 0 'git push gitea HEAD:fix/custom-domain-setup'
|
||||
run 0 'git push gitea HEAD:fix/mainline-cleanup-later'
|
||||
run 0 'git commit -m "docs: explain that the old gate would mis-flag push mentions"'
|
||||
run 0 "$(printf 'cat > docs/TESTING.md <<%sEOF%s\nexample: git push https://github.com/example/example.git HEAD:main\nEOF\n' "'" "'")"
|
||||
run 0 'python3 -c "requests.post(url, json={\"body\": \"this quotes: the gate cannot see a real git push done via a node subprocess, but it will block git push origin main mentioned as prose\"})"'
|
||||
run 0 'grep -n "git push" hooks/main-and-prod-push-guard.sh'
|
||||
|
||||
echo "── 真違規不能因為這次改動而漏擋：戳記過期／戳記綁錯 repo 一樣要擋 ──"
|
||||
run 2 'git push gitea HEAD:main' # 沒有任何戳記檔時
|
||||
|
||||
echo
|
||||
echo "$PASS/$((PASS+FAIL)) 通過"
|
||||
[ "$FAIL" -eq 0 ]
|
||||
Executable
+49
@@ -0,0 +1,49 @@
|
||||
#!/bin/bash
|
||||
# stage-before-prod-guard 的測試（inkstone/ISEP#30 群組——heredoc body 不算數）
|
||||
# 判準：真的碰 prod 出貨鏈、沒有 stage 驗證紀錄要擋；讀取/查證/heredoc body 不准擋；
|
||||
# 帶 staging 字樣、6 小時內驗過 stage 的要放行。
|
||||
cd "$(dirname "$0")/.." || exit 1
|
||||
H=hooks/stage-before-prod-guard.sh
|
||||
PASS=0; FAIL=0
|
||||
run(){ # $1=want $2=cmd
|
||||
printf '%s' "{\"tool_name\":\"Bash\",\"tool_input\":{\"command\":$(python3 -c 'import json,sys;print(json.dumps(sys.argv[1]))' "$2")}}" \
|
||||
| bash "$H" >/dev/null 2>&1
|
||||
got=$?
|
||||
if [ "$got" = "$1" ]; then PASS=$((PASS+1)); printf ' ✅ '; else FAIL=$((FAIL+1)); printf ' ❌ '; fi
|
||||
printf 'want=%s got=%s %.72s\n' "$1" "$got" "$2"
|
||||
}
|
||||
|
||||
rm -f /tmp/.stage-verified /tmp/.stage-ok-by-leo
|
||||
|
||||
echo "── 該擋：真的在動 prod 出貨鏈，沒有 stage 驗證紀錄 ──"
|
||||
run 2 'wrangler deploy --name arcrun-rag-bundles-installer'
|
||||
run 2 'git push gitea arcrun-rag-bundles-installer main'
|
||||
run 2 'scripts/github-arm.sh "出貨" 30'
|
||||
run 2 'echo go && scripts/github-arm.sh "出貨" 30'
|
||||
|
||||
echo "── 不該擋：讀取／查證／演練 ──"
|
||||
run 0 'sed -n "1,40p" scripts/github-arm.sh'
|
||||
run 0 'git commit -m "照 scripts/github-arm.sh 解保險流程"'
|
||||
run 0 'grep -n "wrangler deploy" hooks/stage-before-prod-guard.sh'
|
||||
run 0 'BASE="https://cdn.jsdelivr.net/gh/x/arcrun-rag-bundles@abc"; curl -s "$BASE/manifest.json"'
|
||||
run 0 'wrangler deploy --dry-run'
|
||||
run 0 'wrangler deploy --env staging'
|
||||
|
||||
echo "── 不該擋：heredoc body 只是提到 ──"
|
||||
run 0 "$(printf 'cat > docs/TESTING.md <<%sEOF%s\nexample: wrangler deploy then scripts/github-arm.sh to ship arcrun-rag-bundles\nEOF\n' "'" "'")"
|
||||
|
||||
echo "── 6 小時內驗過 stage，且 leo 已解 GitHub 保險 → 放行 ──"
|
||||
# 條件 ① .github-armed 與條件 ② stage-verified 缺一不可，兩個都要造出來才測得到「放行」那條路
|
||||
touch .github-armed
|
||||
date +%s > /tmp/.stage-verified
|
||||
run 0 'wrangler deploy --name arcrun-rag-bundles-installer'
|
||||
rm -f /tmp/.stage-verified .github-armed
|
||||
|
||||
echo "── 只驗過 stage、沒解 GitHub 保險 → 還是要擋（條件缺一不可）──"
|
||||
date +%s > /tmp/.stage-verified
|
||||
run 2 'wrangler deploy --name arcrun-rag-bundles-installer'
|
||||
rm -f /tmp/.stage-verified
|
||||
|
||||
echo
|
||||
echo "$PASS/$((PASS+FAIL)) 通過"
|
||||
[ "$FAIL" -eq 0 ]
|
||||
Reference in New Issue
Block a user