v0.5.3-pre.002
This commit is contained in:
@@ -1,6 +1,6 @@
|
||||
#!/usr/bin/env python3
|
||||
# file: scripts/audit_khadhroony_workspace_rules.py
|
||||
# version: 28
|
||||
# version: 31
|
||||
|
||||
"""Audit mechanically verifiable rules specific to khadhroony-bot3."""
|
||||
|
||||
@@ -1097,6 +1097,38 @@ def audit_configuration_split(root: pathlib.Path) -> list[Violation]:
|
||||
violations.append(Violation("KH_CFG013", relative, index, "resolved/source configuration contracts must not derive Serialize because they may contain resolved secrets"))
|
||||
if re.search(r"\bDebug\b", line):
|
||||
violations.append(Violation("KH_CFG014", relative, index, "resolved/source configuration contracts must not derive Debug because they may contain resolved secrets or internal values"))
|
||||
config_lib = root / "ks-config/src/lib.rs"
|
||||
if config_lib.is_file():
|
||||
config_exported_types = {
|
||||
match.group(1)
|
||||
for match in re.finditer(
|
||||
r"(?m)^pub(?:\(crate\))? use self::[^;]+::([A-Z][A-Za-z0-9_]*)\s*;",
|
||||
config_lib.read_text(encoding="utf-8"),
|
||||
)
|
||||
}
|
||||
for path in sorted((root / "ks-config/src").glob("*.rs")):
|
||||
if path.name == "lib.rs":
|
||||
continue
|
||||
relative = path.relative_to(root).as_posix()
|
||||
for index, line in enumerate(path.read_text(encoding="utf-8").splitlines(), 1):
|
||||
stripped = line.lstrip()
|
||||
if stripped.startswith("//") or stripped.startswith("#["):
|
||||
continue
|
||||
code = re.sub(r'"(?:\\.|[^"\\])*"', '""', line)
|
||||
for type_name in sorted(config_exported_types):
|
||||
declaration_pattern = rf"\bpub(?:\([^)]*\))?\s+(?:struct|enum|type|trait)\s+{re.escape(type_name)}\b"
|
||||
if re.search(declaration_pattern, code):
|
||||
continue
|
||||
if re.search(rf"(?<![A-Za-z0-9_:]){re.escape(type_name)}\b", code) is None:
|
||||
continue
|
||||
violations.append(
|
||||
Violation(
|
||||
"KH_CFG015",
|
||||
relative,
|
||||
index,
|
||||
f"crate-owned public configuration type `{type_name}` must be referenced through `crate::{type_name}`",
|
||||
)
|
||||
)
|
||||
return violations
|
||||
|
||||
|
||||
@@ -1309,6 +1341,105 @@ def audit_sensitive_transport_surfaces(root: pathlib.Path) -> list[Violation]:
|
||||
)
|
||||
return violations
|
||||
|
||||
|
||||
def audit_store_backend_boundary(root: pathlib.Path) -> list[Violation]:
|
||||
"""Keep concrete storage backends private to `ks-store`."""
|
||||
|
||||
violations: list[Violation] = []
|
||||
forbidden_external = {
|
||||
"sqlx::": "SQLx must not cross the public ks-store boundary",
|
||||
"PgPool": "PostgreSQL pool types must remain private to ks-store",
|
||||
"PostgresStore": "PostgresStore must remain private to ks-store",
|
||||
"PostgresStoreOptions": "PostgresStoreOptions must remain private to ks-store",
|
||||
"PostgresReplay": "Postgres-prefixed replay contracts must not escape ks-store",
|
||||
"ks_store::postgres": "backend module paths must not escape ks-store",
|
||||
}
|
||||
for path in sorted(root.glob("*/src/**/*.rs")):
|
||||
relative_path = path.relative_to(root)
|
||||
if relative_path.parts[0] == "ks-store":
|
||||
continue
|
||||
text = path.read_text(encoding="utf-8")
|
||||
relative = relative_path.as_posix()
|
||||
for fragment, message in forbidden_external.items():
|
||||
start = 0
|
||||
while True:
|
||||
offset = text.find(fragment, start)
|
||||
if offset < 0:
|
||||
break
|
||||
violations.append(
|
||||
Violation(
|
||||
"KH_STORE001",
|
||||
relative,
|
||||
text[:offset].count("\n") + 1,
|
||||
message,
|
||||
)
|
||||
)
|
||||
start = offset + len(fragment)
|
||||
crate_root = root / "ks-store/src/lib.rs"
|
||||
if crate_root.is_file():
|
||||
text = crate_root.read_text(encoding="utf-8")
|
||||
for index, line in enumerate(text.splitlines(), 1):
|
||||
if line.startswith("pub use ") and any(fragment in line for fragment in ("Postgres", "PgPool", "sqlx")):
|
||||
violations.append(
|
||||
Violation(
|
||||
"KH_STORE002",
|
||||
"ks-store/src/lib.rs",
|
||||
index,
|
||||
"public ks-store exports must remain backend-agnostic",
|
||||
)
|
||||
)
|
||||
postgres_root = root / "ks-store/src/postgres"
|
||||
if postgres_root.is_dir():
|
||||
for path in sorted(postgres_root.rglob("*.rs")):
|
||||
text = path.read_text(encoding="utf-8")
|
||||
relative = path.relative_to(root).as_posix()
|
||||
for match in re.finditer(r"tracing::(?:trace|debug|info|warn|error)!\(", text):
|
||||
end = text.find(");", match.start())
|
||||
fragment = text[match.start():] if end < 0 else text[match.start(): end + 2]
|
||||
line = text[:match.start()].count("\n") + 1
|
||||
if "target: crate::TRACING_TARGET" not in fragment:
|
||||
violations.append(
|
||||
Violation(
|
||||
"KH_STORE003",
|
||||
relative,
|
||||
line,
|
||||
"PostgreSQL tracing must use the canonical `crate::TRACING_TARGET`",
|
||||
)
|
||||
)
|
||||
continue
|
||||
if 'backend = "postgres"' not in fragment or 'domain = "ks-store.pg"' not in fragment:
|
||||
violations.append(
|
||||
Violation(
|
||||
"KH_STORE004",
|
||||
relative,
|
||||
line,
|
||||
"PostgreSQL tracing must declare `backend = \"postgres\"` and `domain = \"ks-store.pg\"`",
|
||||
)
|
||||
)
|
||||
if "action =" not in fragment:
|
||||
violations.append(
|
||||
Violation(
|
||||
"KH_STORE006",
|
||||
relative,
|
||||
line,
|
||||
"PostgreSQL tracing must declare one structured `action` field",
|
||||
)
|
||||
)
|
||||
cargo = root / "ks-store/Cargo.toml"
|
||||
if cargo.is_file():
|
||||
data = tomllib.loads(cargo.read_text(encoding="utf-8"))
|
||||
if "ks-config" in data.get("dependencies", {}):
|
||||
violations.append(
|
||||
Violation(
|
||||
"KH_STORE005",
|
||||
"ks-store/Cargo.toml",
|
||||
1,
|
||||
"ks-store must not depend on ks-config",
|
||||
)
|
||||
)
|
||||
return violations
|
||||
|
||||
|
||||
def audit_wincode_resolution(root: pathlib.Path) -> list[Violation]:
|
||||
"""Require the currently compatible Solana wincode dependency family."""
|
||||
|
||||
@@ -1395,6 +1526,7 @@ def main() -> int:
|
||||
+audit_ts_rs_boundaries(root)
|
||||
+audit_configuration_split(root)
|
||||
+audit_sensitive_transport_surfaces(root)
|
||||
+audit_store_backend_boundary(root)
|
||||
+audit_wincode_resolution(root)
|
||||
)
|
||||
violations.sort(key=lambda item: (item.code, item.path, item.line, item.message))
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
#!/usr/bin/env python3
|
||||
# file: scripts/audit_rust_general_rules.py
|
||||
# version: 10
|
||||
# version: 11
|
||||
|
||||
"""Audit mechanically verifiable Rust rules shared by all Rust projects."""
|
||||
|
||||
@@ -77,6 +77,15 @@ def audit_file(root: pathlib.Path, path: pathlib.Path) -> list[Violation]:
|
||||
violations.append(Violation("RUST003", relative, max(len(lines), 1), "file must end with exactly one newline"))
|
||||
for index, line in enumerate(lines, 1):
|
||||
stripped = line.strip()
|
||||
if "pub(in " in stripped or "pub(super)" in stripped:
|
||||
violations.append(
|
||||
Violation(
|
||||
"RUST027",
|
||||
relative,
|
||||
index,
|
||||
"restricted public visibility is forbidden; use private or `pub(crate)` with crate-root re-export",
|
||||
)
|
||||
)
|
||||
if stripped.startswith("pub mod "):
|
||||
violations.append(
|
||||
Violation(
|
||||
|
||||
Reference in New Issue
Block a user