Archive MaleCNS research sources, provenance, bibliography and immutable data inventory

tools/repo_guard.py

@@ -0,0 +1,46 @@
+#!/usr/bin/env python3
+"""Check staged Git blobs, not working-tree copies. Does not alter the index."""
+import json
+import re
+import subprocess
+import sys
+
+def git(*args):
+    return subprocess.check_output(["git", *args])
+
+def main():
+    errors, total, count = [], 0, 0
+    for row in git("ls-files", "--stage", "-z").split(b"\0"):
+        if not row:
+            continue
+        meta, rawpath = row.split(b"\t", 1)
+        mode, oid, stage = meta.decode().split()
+        path = rawpath.decode("utf-8")
+        count += 1
+        if mode == "160000" or path.startswith(("datasets/", "experiments/")) or any(p in path.split("/") for p in (".venv", ".git", "__pycache__")):
+            errors.append({"path":path, "rule":"forbidden data/environment/submodule"})
+            continue
+        size = int(git("cat-file", "-s", oid))
+        total += size
+        if size > 25 * 1024 * 1024:
+            errors.append({"path":path, "rule":"blob exceeds 25 MiB policy"})
+            continue
+        if re.search(r"(^|/)(?:\.env(?:\..*)?|id_rsa|id_ed25519)$|\.(?:pem|key|p12)$", path, re.I):
+            errors.append({"path":path, "rule":"credential filename"})
+        if path.endswith(".gz"):
+            continue  # generated hash-only inventory, validated separately
+        data = git("cat-file", "blob", oid).decode("utf-8", errors="replace")
+        rules = {
+            "private key": r"-----BEGIN (?:OPENSSH |RSA |EC )?PRIVATE KEY-----",
+            "access token": r"(?:gh[pousr]_[A-Za-z0-9]{30,}|github_pat_[A-Za-z0-9_]{30,}|AKIA[A-Z0-9]{16})",
+            "credential URL": r"https?://[^\s/]+:[^\s/@]+@",
+            "literal password": r"(?i)(?:password|passwd|api_key|secret_key)\s*[:=]\s*['\"][^'\"\n]{6,}['\"]",
+        }
+        for rule, pattern in rules.items():
+            if re.search(pattern, data):
+                errors.append({"path":path, "rule":rule})
+    print(json.dumps({"pass":not errors, "files":count, "logical_bytes":total, "issues":errors}, indent=2))
+    return int(bool(errors))
+
+if __name__ == "__main__":
+    sys.exit(main())