Node / ReticulumProjects / MeshChatX.git / files / scripts / ci / verify-workspace-clean.sh

Displaying Raw • Download

T8b949e#!/bin/sh

T8b949e# Recheck byte-level tree inventory and report unexpected runner mutations.

T8b949e#

T8b949e# By default mismatches print warnings and exit 0 so CI is not blocked when

T8b949e# signed inventories lag license refreshes or ephemeral runner dirt appears.

T8b949e# Set RNS_TREE_VERIFY_STRICT=1 to exit non-zero on failure.

T8b949e#

T8b949e# Usage:

T8b949e# verify-workspace-clean.sh <inventory-file>

T8b949e#

T8b949e# Env:

T8b949e# RNS_CLEAN_ALLOW space-separated path prefixes always ignored (optional)

T8b949e# RNS_TREE_VERIFY_STRICT if 1, fail the process on verify errors

Tffa657set -eu

Te6edf3ROOTTff7b72=Ta5d6ff"Tff7b72$(Te6edf3CDPATHTff7b72= Tffa657cd -- Ta5d6ff"Tff7b72$(dirname Ta5d6ff"Te6edf3$0Ta5d6ff"Tff7b72)Ta5d6ff/../..Ta5d6ff" Tff7b72&& Tffa657pwdTff7b72)Ta5d6ff"

Tffa657cd Ta5d6ff"Te6edf3$ROOTTa5d6ff"

Te6edf3STRICTTff7b72=Ta5d6ff"Tffd700${Te6edf3RNS_TREE_VERIFY_STRICTTff7b72:-Te6edf30Tffd700}Ta5d6ff"

warn_or_failTff7b72(Tff7b72) Tff7b72{

Te6edf3msgTff7b72=Ta5d6ff"Te6edf3$1Ta5d6ff"

Tff7b72if Tff7b72[ Ta5d6ff"Te6edf3$STRICTTa5d6ff" Tff7b72= Ta5d6ff"1" Tff7b72]Tb4b4b4; Tff7b72then

Tffa657echo Ta5d6ff"Ta5d6ffverify-workspace-clean.sh: Te6edf3$msgTa5d6ff" >Tb4b4b4&T79c0ff2

Tffa657exit T79c0ff1

Tff7b72fi

Tffa657echo Ta5d6ff"Ta5d6ffverify-workspace-clean.sh: WARNING: Te6edf3$msgTa5d6ff (non-blocking)Ta5d6ff" >Tb4b4b4&T79c0ff2

Tffa657exit T79c0ff0

Tff7b72}

Te6edf3INVTff7b72=Ta5d6ff"Tffd700${Te6edf31Tff7b72:-Tffd700}Ta5d6ff"

Tff7b72if Tff7b72[ -z Ta5d6ff"Te6edf3$INVTa5d6ff" Tff7b72] Tff7b72|| Tff7b72[ ! -f Ta5d6ff"Te6edf3$INVTa5d6ff" Tff7b72]Tb4b4b4; Tff7b72then

warn_or_fail Ta5d6ff"Ta5d6ffmissing inventory: Tffd700${Te6edf3INVTff7b72:-Tb4b4b4<unset>Tffd700}Ta5d6ff (tree verify may have been skipped)Ta5d6ff"

Tff7b72fi

Tff7b72if ! sh Ta5d6ff"Te6edf3$ROOTTa5d6ff/scripts/ci/tree-manifest.shTa5d6ff" verify Ta5d6ff"Te6edf3$INVTa5d6ff"Tb4b4b4; Tff7b72then

warn_or_fail Ta5d6ff"tree inventory hash check failed"

Tff7b72fi

T8b949e# Default ephemeral prefixes created by CI / local builds

Te6edf3ALLOWTff7b72=Ta5d6ff"node_modules/ .pnpm-store/ .venv/ .venv-x64/ dist/ build/ electron/build/ meshchatx/public/ python-dist/ playwright-report/ mutants/ coverage/ .flatpak-builder/ parts/ prime/ stage/ android/.gradle/ android/app/build/ android/build/ android/vendor/ .cache/ __pycache__/ .pytest_cache/ vendor/offline/"

Te6edf3ALLOWTff7b72=Ta5d6ff"Te6edf3$ALLOWTa5d6ff Tffd700${Te6edf3RNS_CLEAN_ALLOWTff7b72:-Tffd700}Ta5d6ff"

is_allowedTff7b72(Tff7b72) Tff7b72{

Te6edf3pTff7b72=Ta5d6ff"Te6edf3$1Ta5d6ff"

Tff7b72for a Tff7b72in Te6edf3$ALLOWTb4b4b4; Tff7b72do

Tff7b72case Ta5d6ff"Te6edf3$pTa5d6ff" Tff7b72in

Ta5d6ff"Te6edf3$aTa5d6ff" Tb4b4b4| Ta5d6ff"Te6edf3$aTa5d6ff"*Tff7b72)

Tff7b72return T79c0ff0

Tb4b4b4;Tb4b4b4;

Tff7b72esac

Tff7b72done

Tff7b72case Ta5d6ff"Te6edf3$pTa5d6ff" Tff7b72in

vendor Tb4b4b4| vendor/* Tb4b4b4| */vendor Tb4b4b4| */vendor/*Tff7b72)

Tff7b72return T79c0ff0

Tb4b4b4;Tb4b4b4;

*.log Tb4b4b4| *.tmp Tb4b4b4| *.swp Tb4b4b4| *.egg-info Tb4b4b4| *.pycTff7b72)

Tff7b72return T79c0ff0

Tb4b4b4;Tb4b4b4;

Tff7b72esac

Tff7b72return T79c0ff1

Tff7b72}

Te6edf3failTff7b72=T79c0ff0

Te6edf3tmpTff7b72=Ta5d6ff"Tff7b72$(mktemp Ta5d6ff"Tffd700${Te6edf3TMPDIRTff7b72:-Tb4b4b4/tmpTffd700}Ta5d6ff/ws-clean.XXXXXXTa5d6ff"Tff7b72)Ta5d6ff"

Tffa657trap Ta5d6ff'rm -f "$tmp"' EXIT INT

git status --porcelain -u --ignoredTff7b72=no >Ta5d6ff"Te6edf3$tmpTa5d6ff" T79c0ff2>/dev/null Tff7b72|| git status --porcelain -u >Ta5d6ff"Te6edf3$tmpTa5d6ff"

Tff7b72while Te6edf3IFSTff7b72= Tffa657read -r lineTb4b4b4; Tff7b72do

Tff7b72[ -z Ta5d6ff"Te6edf3$lineTa5d6ff" Tff7b72] Tff7b72&& Tff7b72continue

Te6edf3xyTff7b72=Ta5d6ff"Tff7b72$(Tffa657printf Ta5d6ff'%s\n' Ta5d6ff"Te6edf3$lineTa5d6ff" Tb4b4b4| cut -c1-2Tff7b72)Ta5d6ff"

Te6edf3pathTff7b72=Ta5d6ff"Tff7b72$(Tffa657printf Ta5d6ff'%s\n' Ta5d6ff"Te6edf3$lineTa5d6ff" Tb4b4b4| sed Ta5d6ff's/^.. //;s/.* -> //'Tff7b72)Ta5d6ff"

Tff7b72case Ta5d6ff"Te6edf3$xyTa5d6ff" Tff7b72in

Ta5d6ff"??"Tff7b72)

Tff7b72if is_allowed Ta5d6ff"Te6edf3$pathTa5d6ff"Tb4b4b4; Tff7b72then

Tff7b72continue

Tff7b72fi

Tffa657echo Ta5d6ff"Ta5d6ffverify-workspace-clean.sh: unexpected untracked: Te6edf3$pathTa5d6ff" >Tb4b4b4&T79c0ff2

Te6edf3failTff7b72=T79c0ff1

Tb4b4b4;Tb4b4b4;

*Tff7b72)

Tff7b72if Tff7b72[ Ta5d6ff"Te6edf3$pathTa5d6ff" Tff7b72= Ta5d6ff"meshchatx.rsm" Tff7b72]Tb4b4b4; Tff7b72then

Tff7b72continue

Tff7b72fi

Tff7b72if is_allowed Ta5d6ff"Te6edf3$pathTa5d6ff"Tb4b4b4; Tff7b72then

Tff7b72continue

Tff7b72fi

Tffa657echo Ta5d6ff"Ta5d6ffverify-workspace-clean.sh: unexpected change: Te6edf3$lineTa5d6ff" >Tb4b4b4&T79c0ff2

Te6edf3failTff7b72=T79c0ff1

Tb4b4b4;Tb4b4b4;

Tff7b72esac

Tff7b72done <Ta5d6ff"Te6edf3$tmpTa5d6ff"

Tff7b72if Tff7b72[ Ta5d6ff"Te6edf3$failTa5d6ff" -ne T79c0ff0 Tff7b72]Tb4b4b4; Tff7b72then

warn_or_fail Ta5d6ff"workspace not clean"

Tff7b72fi

Tffa657echo Ta5d6ff"verify-workspace-clean.sh: OK"