Initial curated projectbrain source from 8a7b1e0651dbdab97d744cbd2e653ab3970ac6c5

scripts/check-release-hygiene.mjs

@@ -0,0 +1,165 @@
+#!/usr/bin/env node
+import { execFileSync } from 'node:child_process';
+import { existsSync, readdirSync, readFileSync, statSync } from 'node:fs';
+import { dirname, join, relative } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const root = dirname(dirname(fileURLToPath(import.meta.url)));
+const failures = [];
+const warnings = [];
+const ignoredArtifacts = [];
+const showLocalArtifacts =
+  process.env.PROJECTBRAIN_AUDIT_VERBOSE_LOCAL_ARTIFACTS === '1';
+
+const gitLines = (args) => {
+  try {
+    return execFileSync('git', args, { cwd: root, encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] })
+      .split(/\r?\n/)
+      .map((line) => line.trim())
+      .filter(Boolean);
+  } catch {
+    return [];
+  }
+};
+
+const isTracked = (path) => gitLines(['ls-files', '--', path]).length > 0;
+const isIgnored = (path) => gitLines(['check-ignore', '--', path]).length > 0;
+const reportArtifact = (path, kind = 'path') => {
+  const absolute = join(root, path);
+  if (!existsSync(absolute)) return;
+  if (isTracked(path)) {
+    failures.push(`Forbidden tracked release artifact/${kind} exists: ${path}`);
+  } else if (isIgnored(path)) {
+    ignoredArtifacts.push(`Ignored local artifact/${kind} present but not release-blocking: ${path}`);
+  } else {
+    failures.push(`Forbidden unignored release artifact/${kind} exists: ${path}`);
+  }
+};
+
+const forbiddenPaths = [
+  'node_modules',
+  'backend/node_modules',
+  'dist',
+  'backend/dist',
+  'checkpoints',
+  'src/App.css',
+  'src/globals.css',
+];
+
+for (const path of forbiddenPaths) {
+  reportArtifact(path);
+}
+
+const forbiddenFilePatterns = [/^vite-.*\.log$/, /\.zip$/i, /\.log$/i];
+const rootFiles = existsSync(root) ? readdirSync(root) : [];
+for (const file of rootFiles) {
+  if (forbiddenFilePatterns.some((pattern) => pattern.test(file))) {
+    reportArtifact(file, 'file');
+  }
+}
+
+const textFilesToScan = [
+  'package.json',
+  'vite.config.ts',
+  'index.html',
+  'README.md',
+  'backend/README.md',
+];
+const forbiddenText = [/componentTagger/i, /component-tagger/i];
+for (const path of textFilesToScan) {
+  const absolute = join(root, path);
+  if (!existsSync(absolute)) {
+    warnings.push(`Expected scan file missing: ${path}`);
+    continue;
+  }
+  const content = readFileSync(absolute, 'utf8');
+  for (const pattern of forbiddenText) {
+    if (pattern.test(content)) {
+      failures.push(`Forbidden branding/tooling text ${pattern} found in ${path}`);
+    }
+  }
+}
+
+const expectedFiles = [
+  '.env.example',
+  'backend/.env.example',
+  'Dockerfile.frontend',
+  'backend/Dockerfile',
+  'docker-compose.yml',
+  'docker-compose.dev.yml',
+  'docker-compose.release.yml',
+  'scripts/stage-release-oci.sh',
+  'docs/PROJECTBRAIN_DOCUMENTATION_INDEX.md',
+  'docs/PROJECTBRAIN_OPERATOR_RELEASE_GUIDE.md',
+  'docs/FULL_VERSION_ROADMAP.md',
+  'docs/VERTICAL_SLICE_CORE_FLOW_PLAN.md',
+  'public/site.webmanifest',
+  'public/favicon.svg',
+  'public/favicon.ico',
+];
+for (const path of expectedFiles) {
+  if (!existsSync(join(root, path))) {
+    warnings.push(`Expected project hygiene file missing: ${path}`);
+  }
+}
+
+const workflowPaths = ['.gitea/workflows/ci.yml', '.gitea/workflows/release.yml'];
+const workflow = workflowPaths
+  .map((path) => readFileSync(join(root, path), 'utf8'))
+  .join('\n');
+for (const marker of [
+  'file: Dockerfile.unraid',
+  'Record immutable archive digests',
+  'Scan Unraid release image',
+  'archive-sha256.txt',
+  'trivy-unraid.json',
+  'VITE_PROJECTBRAIN_COMMIT=${{ github.sha }}',
+  'org.opencontainers.image.revision=${{ github.sha }}',
+]) {
+  if (!workflow.includes(marker)) failures.push(`Release workflow is missing required artifact evidence marker: ${marker}`);
+}
+if (workflow.includes('Dockerfile.backend')) {
+  failures.push('Release workflow references nonexistent Dockerfile.backend; use backend/Dockerfile.');
+}
+if (/aquasec\/trivy(?::[\w.-]+)(?!@sha256:)/.test(workflow) || !workflow.includes('aquasec/trivy@sha256:')) {
+  failures.push('Trivy containers must be pinned to an immutable sha256 digest.');
+}
+if (/uses:\s+(?!docker:\/\/)[^\s@]+@(?![a-f0-9]{40}(?:\s|$))/.test(workflow)) {
+  failures.push('External workflow actions must be pinned to immutable 40-character commit SHAs.');
+}
+
+const maxLargeFileBytes = 5 * 1024 * 1024;
+const ignoredDirs = new Set(['.git', 'node_modules', 'backend/node_modules']);
+function walk(dir) {
+  for (const entry of readdirSync(dir)) {
+    const absolute = join(dir, entry);
+    const rel = relative(root, absolute).replaceAll('\\\\', '/');
+    if (ignoredDirs.has(rel) || ignoredDirs.has(entry)) continue;
+    const stat = statSync(absolute);
+    if (stat.isDirectory()) {
+      walk(absolute);
+    } else if (stat.size > maxLargeFileBytes) {
+      warnings.push(`Large file in source tree (${Math.round(stat.size / 1024 / 1024)}MB): ${rel}`);
+    }
+  }
+}
+walk(root);
+
+console.log('ProjectBrain release hygiene check');
+console.log('====================================');
+if (ignoredArtifacts.length) {
+  if (showLocalArtifacts) {
+    console.log('\nLocal ignored artifacts:');
+    for (const artifact of ignoredArtifacts) console.log(`- ${artifact}`);
+  }
+}
+if (warnings.length) {
+  console.log('\nWarnings:');
+  for (const warning of warnings) console.log(`- ${warning}`);
+}
+if (failures.length) {
+  console.log('\nFailures:');
+  for (const failure of failures) console.log(`- ${failure}`);
+  process.exit(1);
+}
+console.log('\nPASS: no blocking release hygiene issues found.');