7fed5a0a6f
Add CI validation script for checking unauthorized expose_secret() call sites. The script validates that all uses of expose_secret() are in approved locations (SecretFingerprint and test code). Also add verification note summarizing the bead completion status. Per pdftract-5l9m acceptance criteria: - CI grep guard rejects unauthorized expose_secret() call sites - Verification documents existing SecretString wrapping status Co-Authored-By: Claude Code <noreply@anthropic.com>
56 lines
1.7 KiB
Bash
Executable file
56 lines
1.7 KiB
Bash
Executable file
#!/bin/bash
|
|
# CI check for unauthorized expose_secret() call sites.
|
|
#
|
|
# Per pdftract-5l9m, the only legitimate uses of expose_secret() are:
|
|
# - SecretFingerprint::from_secret() (crates/pdftract-core/src/parser/secrets.rs)
|
|
# - Test code (crates/pdftract-core/src/parser/stream.rs deserialization test)
|
|
#
|
|
# This script should be run in CI to catch any new unauthorized uses.
|
|
|
|
set -e
|
|
|
|
echo "Checking for unauthorized expose_secret() call sites..."
|
|
|
|
# Find all expose_secret() calls
|
|
RESULTS=$(rg "expose_secret\(\)" crates/ --type rust -n || true)
|
|
|
|
if [ -z "$RESULTS" ]; then
|
|
echo "✓ No expose_secret() calls found"
|
|
exit 0
|
|
fi
|
|
|
|
# Check for unauthorized calls
|
|
# Authorized locations:
|
|
# 1. crates/pdftract-core/src/parser/secrets.rs:37 - SecretFingerprint::from_secret()
|
|
# 2. crates/pdftract-core/src/parser/stream.rs:2161 - test deserialization
|
|
|
|
UNAUTHORIZED=""
|
|
while IFS= read -r line; do
|
|
# Extract file and line number
|
|
FILE_LINE=$(echo "$line" | cut -d: -f1-2)
|
|
|
|
# Check if this is an authorized location
|
|
if [[ "$FILE_LINE" == *"secrets.rs:37"* ]]; then
|
|
continue
|
|
fi
|
|
if [[ "$FILE_LINE" == *"stream.rs:2161"* ]]; then
|
|
continue
|
|
fi
|
|
# Skip comment lines (contain "//!")
|
|
if [[ "$line" == *"//!"* ]]; then
|
|
continue
|
|
fi
|
|
UNAUTHORIZED="$UNAUTHORIZED$line"$'\n'
|
|
done <<< "$RESULTS"
|
|
|
|
if [ -n "$UNAUTHORIZED" ]; then
|
|
echo "❌ Found unauthorized expose_secret() call sites:"
|
|
echo "$UNAUTHORIZED"
|
|
echo ""
|
|
echo "The only authorized uses of expose_secret() are:"
|
|
echo " - crates/pdftract-core/src/parser/secrets.rs:SecretFingerprint::from_secret()"
|
|
echo " - crates/pdftract-core/src/parser/stream.rs:2161 (test code)"
|
|
exit 1
|
|
fi
|
|
|
|
echo "✓ All expose_secret() calls are authorized"
|