feat: prepare repo for release with sanitized docs, license, pre-commit hook, and CI/CD workflows

2026-08-23 14:47:05 -07:00
parent c48b1ebbd5
commit 3191f3239b
7 changed files with 374 additions and 34 deletions
@@ -0,0 +1,94 @@
+#!/usr/bin/env bash
+# ==============================================================================
+# Git Pre-Commit Hook: Anti-Data-Leak & Secrets Protection
+# ==============================================================================
+# Prevents accidental commits of personal media, child data, student UUIDs,
+# local paths, and credentials before code is committed or pushed.
+# ==============================================================================
+
+set -eo pipefail
+
+RED='\033[0;31m'
+GREEN='\033[0;32m'
+YELLOW='\033[1;33m'
+BOLD='\033[1m'
+NC='\033[0m'
+
+ERRORS_FOUND=0
+
+echo -e "${BOLD}🔍 Running pre-commit security & data leak checks...${NC}"
+
+# ------------------------------------------------------------------------------
+# 1. Check for forbidden staged files (Media, Archives, Real Exports)
+# ------------------------------------------------------------------------------
+STAGED_FILES=$(git diff --cached --name-only --diff-filter=ACM)
+
+if [ -n "$STAGED_FILES" ]; then
+  while IFS= read -r file; do
+    [ -z "$file" ] && continue
+
+    # Check for forbidden export data files & raw media
+    if [[ "$file" =~ (activities\.csv|activities\.json|exporter_job_info\.json|\.zip$|\.crx$|\.mp4$|\.mov$|\.webm$|\.heic$|\.jpg$|\.jpeg$) ]]; then
+      echo -e "${RED}❌ [DATA LEAK BLOCKED] Staged forbidden export/media file:${NC} $file"
+      ERRORS_FOUND=$((ERRORS_FOUND + 1))
+    fi
+
+    # Check for forbidden folder names
+    if [[ "$file" =~ ^(emmy|exports|data|test_data)/ ]]; then
+      echo -e "${RED}❌ [DATA LEAK BLOCKED] Staged file from sensitive directory:${NC} $file"
+      ERRORS_FOUND=$((ERRORS_FOUND + 1))
+    fi
+  done <<< "$STAGED_FILES"
+fi
+
+# ------------------------------------------------------------------------------
+# 2. Check diff content for sensitive patterns in staged changes
+#    (Excludes the pre-commit hook file itself from self-matching)
+# ------------------------------------------------------------------------------
+STAGED_DIFF=$(git diff --cached -U0 -- ':!.githooks/*' ':!.git/*' | grep -E "^\+[^+]" || true)
+
+if [ -n "$STAGED_DIFF" ]; then
+  # 2a. Check for local machine paths (e.g. /Users/<username> or /home/<username>)
+  LOCAL_PATH_MATCH=$(echo "$STAGED_DIFF" | grep -En "(/Users/|/home/)[a-zA-Z0-9_\.-]+" || true)
+  if [ -n "$LOCAL_PATH_MATCH" ]; then
+    echo -e "${RED}❌ [DATA LEAK BLOCKED] Detected local machine path (/Users/... or /home/...):${NC}"
+    echo "$LOCAL_PATH_MATCH" | head -n 3
+    ERRORS_FOUND=$((ERRORS_FOUND + 1))
+  fi
+
+  # 2b. Check for student UUIDs (e.g. 8-4-4-4-12 hex format)
+  UUID_MATCH=$(echo "$STAGED_DIFF" | grep -En "[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}" || true)
+  if [ -n "$UUID_MATCH" ]; then
+    echo -e "${RED}❌ [DATA LEAK BLOCKED] Detected hardcoded student/record UUID in diff:${NC}"
+    echo "$UUID_MATCH" | head -n 3
+    ERRORS_FOUND=$((ERRORS_FOUND + 1))
+  fi
+
+  # 2c. Check for AWS / Token credentials
+  AWS_KEY_MATCH=$(echo "$STAGED_DIFF" | grep -En "AKIA[0-9A-Z]{16}" || true)
+  if [ -n "$AWS_KEY_MATCH" ]; then
+    echo -e "${RED}❌ [SECURITY LEAK BLOCKED] Detected potential AWS Access Key:${NC}"
+    echo "$AWS_KEY_MATCH" | head -n 3
+    ERRORS_FOUND=$((ERRORS_FOUND + 1))
+  fi
+
+  SESSION_TOKEN_MATCH=$(echo "$STAGED_DIFF" | grep -En "(_brightwheel_session=|Bearer[[:space:]]+[A-Za-z0-9_\-\.]{20,})" || true)
+  if [ -n "$SESSION_TOKEN_MATCH" ]; then
+    echo -e "${RED}❌ [SECURITY LEAK BLOCKED] Detected session token or bearer credential:${NC}"
+    echo "$SESSION_TOKEN_MATCH" | head -n 3
+    ERRORS_FOUND=$((ERRORS_FOUND + 1))
+  fi
+fi
+
+# ------------------------------------------------------------------------------
+# 3. Verdict
+# ------------------------------------------------------------------------------
+if [ "$ERRORS_FOUND" -gt 0 ]; then
+  echo -e "\n${RED}${BOLD}🚨 COMMIT REJECTED:${NC} $ERRORS_FOUND security / data leak issue(s) detected."
+  echo -e "${YELLOW}Please remove sensitive files/tokens before committing.${NC}"
+  echo -e "${YELLOW}(If this is an intentional false positive, bypass with 'git commit --no-verify')${NC}\n"
+  exit 1
+fi
+
+echo -e "${GREEN}✅ Pre-commit leak check passed! No sensitive data detected.${NC}"
+exit 0