SHA256
Yuvomi Mobile Contributors
9088ee7e6a
Provide Android API 35/37 and Xcode jobs, dependency advisory checks, source invariants, and checksum-verified tools. Actions lint and available Linux static checks pass; hosted CI and all Apple-platform builds still require authorized runners. The manual release workflow never publishes and uses only owner-supplied signing credentials.
55 lines
3.0 KiB
Python
55 lines
3.0 KiB
Python
#!/usr/bin/env python3
|
|
"""Static release invariants; these checks do not replace platform/runtime tests."""
|
|
import json
|
|
from pathlib import Path
|
|
import plistlib
|
|
import re
|
|
import subprocess
|
|
import xml.etree.ElementTree as ET
|
|
|
|
ROOT = Path(__file__).resolve().parents[1]
|
|
required = ["README.md", "LICENSE", "THIRD_PARTY_NOTICES.md", "CONTRIBUTING.md", "SECURITY.md",
|
|
"CHANGELOG.md", "docs/architecture.md", "docs/build-android.md", "docs/build-ios.md",
|
|
"docs/server-compatibility.md", "docs/release-process.md", "docs/validation.md"]
|
|
for name in required:
|
|
assert (ROOT / name).is_file(), f"Missing {name}"
|
|
|
|
paths = subprocess.check_output(["git", "ls-files", "--cached", "--others", "--exclude-standard"], cwd=ROOT, text=True).splitlines()
|
|
for name in paths:
|
|
path = ROOT / name
|
|
if not path.is_file():
|
|
continue
|
|
assert not any(part in {"node_modules", "build", ".gradle", "DerivedData"} for part in path.relative_to(ROOT).parts), name
|
|
assert path.suffix not in {".jks", ".keystore", ".p12", ".mobileprovision", ".apk", ".aab"}, name
|
|
if path.suffix == ".xml":
|
|
ET.parse(path)
|
|
if path.suffix == ".xcprivacy":
|
|
with path.open("rb") as source:
|
|
assert plistlib.load(source)["NSPrivacyTracking"] is False
|
|
if path.suffix == ".json":
|
|
json.loads(path.read_text())
|
|
if path.suffix in {".swift", ".kt", ".kts", ".py", ".md", ".yml", ".xml", ".properties", ".mjs", ".sh"}:
|
|
text = path.read_text()
|
|
assert not re.search(r"-----BEGIN (?:RSA |EC |OPENSSH )?PRIVATE KEY-----", text), f"Private key in {name}"
|
|
if path.suffix == ".md":
|
|
for target in re.findall(r"\]\(([^)]+)\)", text):
|
|
if ":" not in target and not target.startswith("#"):
|
|
assert (path.parent / target.split("#")[0]).exists(), f"Broken link in {name}: {target}"
|
|
|
|
android = "{http://schemas.android.com/apk/res/android}"
|
|
manifest = ET.parse(ROOT / "android/app/src/main/AndroidManifest.xml").getroot()
|
|
app = manifest.find("application")
|
|
assert app.get(android + "usesCleartextTraffic") == "false"
|
|
assert app.get(android + "allowBackup") == "false"
|
|
assert app.get(android + "debuggable") != "true"
|
|
assert len(manifest.findall("application/activity/intent-filter")) == 1, "Unreviewed deep-link entry point"
|
|
network = ET.parse(ROOT / "android/app/src/main/res/xml/network_security_config.xml").getroot()
|
|
assert network.find("base-config").get("cleartextTrafficPermitted") == "false"
|
|
assert [node.get("src") for node in network.findall(".//certificates")] == ["system"]
|
|
assert "distributionSha256Sum=" in (ROOT / "android/gradle/wrapper/gradle-wrapper.properties").read_text()
|
|
for workflow in (ROOT / ".github/workflows").glob("*.yml"):
|
|
for action in re.findall(r"uses:\s*([^\s#]+)", workflow.read_text()):
|
|
assert re.fullmatch(r"[\w.-]+/[\w./-]+@[0-9a-f]{40}", action), f"Unpinned action: {action}"
|
|
assert "NSAllowsArbitraryLoads" not in (ROOT / "ios/project.yml").read_text()
|
|
print(f"Repository invariants: {len(paths)} source/documentation paths checked.")
|