PTah
9e43de6fc1
Bump version, document security hardening in README, add github snapshot push script with URL/login/IP sanitization for public mirror.
87 lines
3.4 KiB
Bash
Executable File
87 lines
3.4 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# Публичный snapshot на github: без prod URL, доменов, логинов, имён и внутренних IP.
|
|
set -Eeuo pipefail
|
|
|
|
ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
|
|
WORK="$(mktemp -d "${TMPDIR:-/tmp}/sac-github-snapshot.XXXX")"
|
|
trap 'rm -rf "$WORK"' EXIT
|
|
|
|
REF="${1:-HEAD}"
|
|
MSG="${2:-chore: public release snapshot $(date +%F) (SAC $(git -C "$ROOT" show -s --format=%s "$REF" | sed -n 's/.*(\([0-9.]*\)).*/\1/p' | head -1))}"
|
|
|
|
echo "[snapshot] export $REF -> $WORK"
|
|
git -C "$ROOT" archive --format=tar "$REF" \
|
|
| tar -x -C "$WORK" \
|
|
--exclude='.cursor' \
|
|
--exclude='.venv' \
|
|
--exclude='frontend/node_modules' \
|
|
--exclude='frontend/dist' \
|
|
--exclude='.env' \
|
|
--exclude='deploy/.env'
|
|
|
|
apply_sed() {
|
|
local expr=$1
|
|
if [[ "$(uname -s)" == Darwin ]]; then
|
|
find "$WORK" -type f \( -name '*.py' -o -name '*.md' -o -name '*.ts' -o -name '*.vue' -o -name '*.sh' -o -name '*.ps1' -o -name '*.example' -o -name '*.yml' -o -name '*.json' -o -name '*.conf' \) \
|
|
-print0 | xargs -0 sed -i '' -E "$expr"
|
|
else
|
|
find "$WORK" -type f \( -name '*.py' -o -name '*.md' -o -name '*.ts' -o -name '*.vue' -o -name '*.sh' -o -name '*.ps1' -o -name '*.example' -o -name '*.yml' -o -name '*.json' -o -name '*.conf' \) \
|
|
-print0 | xargs -0 sed -i -E "$expr"
|
|
fi
|
|
}
|
|
|
|
echo "[snapshot] rewrite hosts, domains, logins, IPs"
|
|
apply_sed 's#https://git\.kalinamall\.ru/PapaTramp#https://github.com/PTah#g'
|
|
apply_sed 's#git\.kalinamall\.ru/PapaTramp#github.com/PTah#g'
|
|
apply_sed 's#git\.kalinamall\.ru/papatramp#github.com/PTah#g'
|
|
apply_sed 's#git\.papatramp\.ru/PapaTramp#github.com/PTah#g'
|
|
apply_sed 's#git\.papatramp\.lan:[0-9]+/PapaTramp#github.com/PTah#g'
|
|
apply_sed 's#sac\.kalinamall\.ru#sac.example.com#g'
|
|
apply_sed 's#git\.kalinamall\.lan#github.com#g'
|
|
apply_sed 's#kalinamall-sac\.conf#origin-sac.conf#g'
|
|
apply_sed 's#remote add kalinamall#remote add origin#g'
|
|
apply_sed 's#remote set-url kalinamall#remote set-url origin#g'
|
|
apply_sed 's#B26\\\\#CONTOSO\\\\#g'
|
|
apply_sed 's#B26\\#CONTOSO\\#g'
|
|
apply_sed 's#papatramp#example.user#g'
|
|
apply_sed 's#PapaTramp#PTah#g'
|
|
apply_sed 's#192\.168\.160\.#192.0.2.#g'
|
|
apply_sed 's#192\.168\.128\.#192.0.2.#g'
|
|
apply_sed 's#192\.168\.163\.#192.0.2.#g'
|
|
apply_sed 's#password="[^"]*"#password=_TEST_PASSWORD#g'
|
|
apply_sed "s#password='[^']*'#password=_TEST_PASSWORD#g"
|
|
|
|
if ! grep -q '_TEST_PASSWORD' "$WORK/backend/tests/conftest.py" 2>/dev/null; then
|
|
sed -i.bak '1a\
|
|
_TEST_PASSWORD = "test-only"
|
|
' "$WORK/backend/tests/conftest.py" && rm -f "$WORK/backend/tests/conftest.py.bak"
|
|
fi
|
|
|
|
echo "[snapshot] git commit in temp repo"
|
|
cd "$WORK"
|
|
git init -q
|
|
git checkout -q -b main
|
|
git add -A
|
|
git -c user.name="PTah" -c user.email="papatramp@gmail.com" commit -q -m "$MSG"
|
|
|
|
echo "[snapshot] secret scan (prod patterns, tests skipped)"
|
|
while IFS= read -r -d '' f; do
|
|
case "$f" in
|
|
*.example|*env.example|backend/tests/*) continue ;;
|
|
esac
|
|
if grep -qiE '\.env$|BEGIN (RSA |OPENSSH )?PRIVATE KEY|credentials\.json|google-services\.json' "$f"; then
|
|
echo " BLOCKED: $f"
|
|
exit 1
|
|
fi
|
|
if grep -qiE 'DATABASE_URL=postgresql.*:[^@]+@' "$f"; then
|
|
echo " BLOCKED: $f (DATABASE_URL with password)"
|
|
exit 1
|
|
fi
|
|
done < <(find . -type f -print0)
|
|
|
|
echo "[snapshot] push github main (force snapshot)"
|
|
git remote add github "$(git -C "$ROOT" remote get-url github)"
|
|
git push github main --force
|
|
|
|
echo "[snapshot] OK -> github/main @ $(git rev-parse --short HEAD)"
|