Add community scope gate

2026-06-20 17:59:58 +00:00
parent 0af60b1693
commit eaa369bf85
8 changed files with 240 additions and 27 deletions
@@ -0,0 +1,129 @@
+#!/usr/bin/env python3
+import argparse
+import re
+import subprocess
+import sys
+from pathlib import Path
+
+
+DEFAULT_EXCLUDED_PATHS = {
+    "LICENSE",
+    "Cargo.lock",
+    "apps/ui/package-lock.json",
+    "scripts/check-community-scope.py",
+    "tests/unit/test_check_community_scope.py",
+}
+
+DEFAULT_EXCLUDED_PREFIXES = {
+    "target/",
+    "apps/ui/node_modules/",
+    "apps/ui/dist/",
+}
+
+FORBIDDEN_PATTERNS = [
+    ("enterprise", re.compile(r"\benterprise\b", re.IGNORECASE)),
+    ("cloud", re.compile(r"\bcloud\b", re.IGNORECASE)),
+    ("commercial", re.compile(r"\bcommercial\b|коммер", re.IGNORECASE)),
+    ("cloud-russian", re.compile(r"облач", re.IGNORECASE)),
+    ("graphql", re.compile(r"\bgraphql\b", re.IGNORECASE)),
+    ("grpc", re.compile(r"\bgrpc\b", re.IGNORECASE)),
+    ("soap", re.compile(r"\bsoap\b", re.IGNORECASE)),
+    ("websocket", re.compile(r"\bwebsocket\b", re.IGNORECASE)),
+    ("short-lived-token", re.compile(r"short[-_ ]?lived", re.IGNORECASE)),
+    ("one-time-token", re.compile(r"one[-_ ]?time", re.IGNORECASE)),
+    ("sso", re.compile(r"\bsso\b", re.IGNORECASE)),
+    ("two-factor", re.compile(r"two[-_ ]?factor|\b2fa\b|\bmfa\b", re.IGNORECASE)),
+    ("billing", re.compile(r"\bbilling\b", re.IGNORECASE)),
+    ("tenant", re.compile(r"\btenant\b", re.IGNORECASE)),
+    ("stream-session", re.compile(r"stream session", re.IGNORECASE)),
+    ("async-job", re.compile(r"async job", re.IGNORECASE)),
+    ("mcp-auth", re.compile(r"mcp-auth", re.IGNORECASE)),
+    ("protocol-capabilities", re.compile(r"protocol-capabilities", re.IGNORECASE)),
+    ("machine-token", re.compile(r"machine token", re.IGNORECASE)),
+    ("token-issuer", re.compile(r"token issuer", re.IGNORECASE)),
+    ("request-variables", re.compile(r"request\.variables", re.IGNORECASE)),
+]
+
+
+def parse_args() -> argparse.Namespace:
+    parser = argparse.ArgumentParser(
+        description="Fail if Community repository contains out-of-scope product markers."
+    )
+    parser.add_argument(
+        "--root",
+        type=Path,
+        default=Path(__file__).resolve().parents[1],
+        help="Repository root. Defaults to parent of scripts/.",
+    )
+    parser.add_argument(
+        "--files",
+        nargs="*",
+        help="Optional explicit file list, relative to root. Defaults to git ls-files.",
+    )
+    return parser.parse_args()
+
+
+def git_tracked_files(root: Path) -> list[str]:
+    result = subprocess.run(
+        ["git", "ls-files"],
+        cwd=root,
+        check=True,
+        text=True,
+        stdout=subprocess.PIPE,
+        stderr=subprocess.PIPE,
+    )
+    return [line for line in result.stdout.splitlines() if line]
+
+
+def should_skip_path(path: str) -> bool:
+    if path in DEFAULT_EXCLUDED_PATHS:
+        return True
+    return any(path.startswith(prefix) for prefix in DEFAULT_EXCLUDED_PREFIXES)
+
+
+def is_binary(data: bytes) -> bool:
+    return b"\0" in data[:4096]
+
+
+def scan_file(root: Path, relative_path: str) -> list[str]:
+    if should_skip_path(relative_path):
+        return []
+
+    path = root / relative_path
+    if not path.is_file():
+        return []
+
+    data = path.read_bytes()
+    if is_binary(data):
+        return []
+
+    text = data.decode("utf-8", errors="replace")
+    findings: list[str] = []
+    for line_no, line in enumerate(text.splitlines(), start=1):
+        for label, pattern in FORBIDDEN_PATTERNS:
+            if pattern.search(line):
+                findings.append(f"{relative_path}:{line_no}: forbidden marker `{label}`")
+    return findings
+
+
+def main() -> int:
+    args = parse_args()
+    root = args.root.resolve()
+    files = args.files if args.files is not None else git_tracked_files(root)
+    findings: list[str] = []
+
+    for relative_path in sorted(files):
+        findings.extend(scan_file(root, relative_path))
+
+    if findings:
+        print("Community scope check failed:", file=sys.stderr)
+        for finding in findings:
+            print(f"error: {finding}", file=sys.stderr)
+        return 1
+
+    print(f"Community scope check passed ({len(files)} tracked files scanned)")
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())