78 lines
2.4 KiB
Bash
Executable file
78 lines
2.4 KiB
Bash
Executable file
#!/usr/bin/env bash
|
|
# IP-FENCE smoke: fail on Nintendo / OpenKrush tokens outside allowlisted docs.
|
|
# See docs/IP-FENCE.md. Exit 0 → FENCE PASS; non-zero → FENCE FAIL.
|
|
set -euo pipefail
|
|
|
|
ROOT="$(cd "$(dirname "$0")/../.." && pwd)"
|
|
cd "$ROOT"
|
|
|
|
# Case-insensitive; word-ish Mario. OpenKrush = forbidden packs.
|
|
PATTERN='Magikoopa|Kamek|\bMario\b|Bowser|OpenKrush'
|
|
|
|
# Paths to scan (tracked-ish product / kitchen surfaces). Skip .git + kitchen/raw.
|
|
SCAN_PATHS=()
|
|
[[ -d scripts ]] && SCAN_PATHS+=(scripts)
|
|
[[ -d game ]] && SCAN_PATHS+=(game)
|
|
[[ -d assets ]] && SCAN_PATHS+=(assets)
|
|
[[ -f kitchen/ACTIVITY.md ]] && SCAN_PATHS+=(kitchen/ACTIVITY.md)
|
|
[[ -d kitchen/outbox ]] && SCAN_PATHS+=(kitchen/outbox)
|
|
# kitchen prose that must stay original (not raw model dumps)
|
|
for f in kitchen/PERSONAS.md kitchen/PLAYBOOK.md kitchen/STATUS.md kitchen/README.md; do
|
|
[[ -f "$f" ]] && SCAN_PATHS+=("$f")
|
|
done
|
|
|
|
# Allowlist: fence definition + README stop-line + docs that *ban* the names
|
|
allowlisted() {
|
|
local f="$1"
|
|
case "$f" in
|
|
docs/IP-FENCE.md|README.md|docs/FACTIONS.md|docs/CINEMATICS.md|docs/GAMEPLAY.md) return 0 ;;
|
|
scripts/smoke/ip_fence_check.sh|scripts/smoke/README.md|kitchen/patches/D2.md) return 0 ;;
|
|
*) return 1 ;;
|
|
esac
|
|
}
|
|
|
|
if [[ ${#SCAN_PATHS[@]} -eq 0 ]]; then
|
|
echo "FENCE FAIL: no scan paths under $ROOT"
|
|
exit 2
|
|
fi
|
|
|
|
# Collect matches: path:line:text (rg may be missing → grep -R fallback)
|
|
TMP="$(mktemp)"
|
|
trap 'rm -f "$TMP"' EXIT
|
|
|
|
if command -v rg >/dev/null 2>&1; then
|
|
rg -n -i -e "$PATTERN" \
|
|
--glob '!.git/**' \
|
|
--glob '!kitchen/raw/**' \
|
|
--glob '!*.mp4' --glob '!*.png' --glob '!*.jpg' --glob '!*.jpeg' \
|
|
--glob '!*.webp' --glob '!*.bin' --glob '!*.pak' --glob '!*.ogg' \
|
|
--glob '!*.wav' --glob '!*.webm' \
|
|
"${SCAN_PATHS[@]}" >"$TMP" 2>/dev/null || true
|
|
else
|
|
grep -R -n -I -i -E "$PATTERN" "${SCAN_PATHS[@]}" \
|
|
--exclude-dir=.git --exclude-dir=raw \
|
|
--exclude='*.mp4' --exclude='*.png' --exclude='*.jpg' \
|
|
>"$TMP" 2>/dev/null || true
|
|
fi
|
|
|
|
FAIL_LINES=()
|
|
while IFS= read -r line || [[ -n "${line:-}" ]]; do
|
|
[[ -z "$line" ]] && continue
|
|
# rg: path:lineno:content
|
|
path="${line%%:*}"
|
|
# strip leading ./
|
|
path="${path#./}"
|
|
if allowlisted "$path"; then
|
|
continue
|
|
fi
|
|
FAIL_LINES+=("$line")
|
|
done <"$TMP"
|
|
|
|
if [[ ${#FAIL_LINES[@]} -gt 0 ]]; then
|
|
echo "FENCE FAIL"
|
|
printf '%s\n' "${FAIL_LINES[@]}"
|
|
exit 1
|
|
fi
|
|
|
|
echo "FENCE PASS"
|
|
exit 0
|