docs: prepare repeatable V1 presentation

2026-08-21 04:04:03 -06:00
parent d1a86ad162
commit 2446f0b2ef
10 changed files with 848 additions and 10 deletions
@@ -0,0 +1,53 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+ROOT=$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")/.." && pwd -P)
+cd "$ROOT"
+mapfile -d '' -t TRACKED < <(git ls-files -z --cached --others --exclude-standard -- ':!docs/superpowers/**' ':!foundry.lock' ':!package-lock.json' ':!web/package-lock.json')
+
+secret_names='PRIVATE''_KEY|MNEM''ONIC'
+assignment_pattern="(^|[^[:alnum:]_])(${secret_names})[[:space:]]*="
+pem_pattern='-----BEGIN .*PRI''VATE KEY-----'
+unfinished_pattern='(^|[^[:alnum:]_])(TO''DO|T''BD|FIX''ME)([^[:alnum:]_]|$)'
+filler_pattern='lorem[[:space:]]+ip''sum|fill''er[[:space:]]+text'
+unsafe_pattern='unsafe''Allow|unsafe''SkipStorageCheck|unsafe''SkipAllChecks|oz-upgrades-unsafe-allow'
+allowed_annotation='    /// @custom:oz-upgrades-unsafe-allow constructor'
+fixture_name='ANVIL_''TEST_PHRASE'
+fixture_value='test test test test test test test test test test test junk'
+violations=0
+
+report_matches() {
+  local path=$1 pattern=$2 label=$3 line number=0
+  while IFS= read -r line || [[ -n "$line" ]]; do
+    number=$((number + 1))
+    if [[ "$line" =~ $pattern ]]; then
+      printf 'forbidden %s: %s:%d:%s\n' "$label" "$path" "$number" "$line" >&2
+      violations=$((violations + 1))
+    fi
+  done <"$path"
+}
+
+for path in "${TRACKED[@]}"; do
+  [[ "$path" == lib/* || ! -f "$path" ]] && continue
+  report_matches "$path" "$assignment_pattern" 'secret assignment'
+  report_matches "$path" "$pem_pattern" 'PEM private key'
+  report_matches "$path" "$unfinished_pattern" 'unfinished marker'
+  report_matches "$path" "$filler_pattern" 'filler content'
+  while IFS= read -r line || [[ -n "$line" ]]; do
+    if [[ "$line" == *"$fixture_name"*'='* && "$line" != *"$fixture_value"* ]]; then
+      printf 'forbidden non-fixture local phrase assignment: %s:%s\n' "$path" "$line" >&2
+      violations=$((violations + 1))
+    fi
+  done <"$path"
+  if [[ "$path" == src/* || "$path" == test/* || "$path" == script/* ]]; then
+    while IFS= read -r line || [[ -n "$line" ]]; do
+      if [[ "$line" =~ $unsafe_pattern && "$path:$line" != "src/BankV1.sol:$allowed_annotation" ]]; then
+        printf 'forbidden unsafe upgrade bypass: %s:%s\n' "$path" "$line" >&2
+        violations=$((violations + 1))
+      fi
+    done <"$path"
+  fi
+done
+
+((violations == 0)) || { printf 'Project scan failed with %d violation(s).\n' "$violations" >&2; exit 1; }
+printf 'Project scan passed across %d tracked paths.\n' "${#TRACKED[@]}"