verify-boundaries.sh (1016B)
1 #!/usr/bin/env bash 2 set -euo pipefail 3 4 repo_root="$(git rev-parse --show-toplevel)" 5 cd "$repo_root" 6 7 tools/verify-repository-boundary.sh 8 scripts/verify-source-lock.sh 9 test "$(cargo public-api --version)" = "cargo-public-api 0.52.0" 10 temporary_api="$(mktemp)" 11 trap 'rm -f "$temporary_api"' EXIT 12 cargo +nightly-2026-07-16 public-api --all-features -sss -p radroots_cli >"$temporary_api" 13 cmp "$temporary_api" contracts/api_baselines/radroots_cli.txt 14 15 if git ls-files | grep -E -i '(^|/)(\.env|id_rsa|id_ed25519|credentials|[^/]+\.(pem|key|p12|pfx|jks|keystore))$' >/dev/null; then 16 echo "boundary_invalid: sensitive credential path is tracked" >&2 17 exit 1 18 fi 19 if git grep -I -n -E -e '-----BEGIN ([A-Z0-9 ]+ )?PRIVATE KEY-----|AKIA[0-9A-Z]{16}|gh[pousr]_[A-Za-z0-9_]{36,}|nsec1[023456789acdefghjklmnpqrstuvwxyz]{40,}' -- src >/dev/null; then 20 echo "boundary_invalid: production source contains credential material" >&2 21 exit 1 22 fi 23 24 echo "boundary ok: root-only API, fresh baseline, no forbidden or credential surface"