Publish curated ITWorx_MCP_Hub source from 5d65966d0393e868ed5df1d95a21412a4c587d78

scripts/security_scan.py

@@ -11,6 +11,8 @@ from __future__ import annotations
 import argparse
 import json
 import re
+import shutil
+import subprocess
 from pathlib import Path
 from typing import Any
 
@@ -29,37 +31,36 @@ _PLACEHOLDER = re.compile(
 
 def _tracked_text_files() -> list[Path]:
     files: list[Path] = []
-    for path in ROOT.rglob("*"):
-        if not path.is_file() or set(path.parts) & {
-            ".git",
-            ".venv",
-            "node_modules",
-            "dist",
-            "coverage",
-        }:
+    git = shutil.which("git")
+    if git is None:
+        raise FileNotFoundError("git is required to enumerate tracked source files")
+    result = subprocess.run(  # noqa: S603
+        [git, "ls-files", "-z"],
+        cwd=ROOT,
+        capture_output=True,
+        check=True,
+    )
+    for relative in result.stdout.decode("utf-8").split("\0"):
+        if not relative:
             continue
-        relative_parts = path.relative_to(ROOT).parts
-        if relative_parts[:2] == (".claude", "worktrees"):
-            # Git-ignored linked worktrees (.git/info/exclude) are full nested
-            # checkouts of a branch's tracked content under a different path
-            # prefix, so a fixture file like tests/fixtures/secret-like.md
-            # reappears at .claude/worktrees/<name>/tests/fixtures/secret-like.md
-            # and fails the tests/-prefix fixture-placeholder match below even
-            # though it's the same already-tracked, already-scanned content.
-            continue
-        if path.suffix.lower() in {
-            ".py",
-            ".ts",
-            ".tsx",
-            ".js",
-            ".jsx",
-            ".json",
-            ".yaml",
-            ".yml",
-            ".md",
-            ".toml",
-            ".env",
-        }:
+        path = ROOT / relative
+        if (
+            path.suffix.lower()
+            in {
+                ".py",
+                ".ts",
+                ".tsx",
+                ".js",
+                ".jsx",
+                ".json",
+                ".yaml",
+                ".yml",
+                ".md",
+                ".toml",
+                ".env",
+            }
+            and path.is_file()
+        ):
             files.append(path)
     return sorted(files)