ci: fail the build on new internal references in this public repo #24
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "ci/internal-ref-audit"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Refs #23, #14.
Adds a CI gate so internal references cannot land in this public repo unnoticed.
Why
The rule in REPO-CONVENTIONS -- no hostnames, usernames, internal IPs, domain names or
credentials in public repos -- has been breaking silently. Three separate leaks turned up just
by reading files this week:
assets/base/config.json(#14)fastlane/.env.ncwFinding these by reading is not a control.
What
scripts/check-no-internal-refs.sh, modelled on slash-server'sscripts/check-branding.sh:FLAG-ALL-MINUS-ALLOWLIST over five classes (
hostname,email,private-ip,ct-ref,home-path), so anything new fails by default instead of having to be predicted.Two allowlists, deliberately separate:
www.ncwcom.com(required in the App Store listing),10.0.2.2(Android emulator hostalias), hosted CI runner homes.
scripts/internal-refs-baseline.txt-- the 11 leaks that exist today, each with a reasonand an issue where one exists. The check also fails on a baseline entry that no longer
matches, so fixing a leak forces its line to be deleted rather than quietly rotting.
To be explicit: this PR does not fix any existing leak. It stops new ones and turns the
existing ones into a visible, itemised list.
Scoping decisions worth reviewing
private-ipcovers only172.16/12and10/8, the ranges REPO-CONVENTIONS actually names.192.168/16is excluded: not NCW space, and upstream uses it for generic example addresses inits own tests, so including it produced only false positives.
home-pathmatches/Users/<name>/but not/home/<name>/, which collides with this repo'sown module paths (
@screens/home/search/...). The exposure that matters is the shared buildMac.
pull_requestas well aspush, becausebuild-android.ymlonlytriggers on pushes to
ncw/main-- a leak introduced in a PR would otherwise not surfaceuntil it had already been merged and published.
Verification
Table-tested both directions on the Linux host, using the same
git clone http://127.0.0.1:3000/...the runner uses:172.16.0.55,172.31.9.9,10.104.0.5chat.ncwcom.com,someone@ncwcom.com,CT#137,/Users/somebody/10.0.2.2,192.168.1.10,www.ncwcom.com, version strings like2.41.0Clean against the baseline as committed (
exit 0, 11 exceptions tracked); a probe leak failswith
exit 1. The committed script is mode100755with LF endings.One caveat: I could not lint the workflow YAML locally (no pyyaml available), so its first real
run is the check. It mirrors the structure of the existing Android workflow, and the runner has
python3 3.13.5.
After the upstream rebase
ADR-0003 notes this repo has no
DIVERGENCE.mdand no drift discipline. This check is a smallpiece of that gap closed; the baseline will need re-verifying once the Expo Router rebase moves
files around.
This repo is public. REPO-CONVENTIONS.md forbids hostnames, usernames, internal IPs, domain names and credentials here, and the rule has been breaking silently: an internal push hostname is hardcoded in Kotlin, the default server URL and a live dev webhook sit in assets/base/config.json, and fastlane/.env.ncw carries Apple account addresses plus an absolute path naming the build-Mac account. Three separate leaks found by reading, which is not a control. Adds scripts/check-no-internal-refs.sh, modelled on slash-server's scripts/check-branding.sh: FLAG-ALL-MINUS-ALLOWLIST across five classes (hostname, email, private-ip, ct-ref, home-path), so anything new fails by default rather than needing to be predicted in advance. Two allowlists, kept apart on purpose: - PERMANENT, in the script: values that are genuinely public and must never be flagged - www.ncwcom.com (required in the App Store listing), 10.0.2.2 (Android emulator host alias), hosted CI runner homes. - scripts/internal-refs-baseline.txt: the 11 leaks that exist today, each with a reason and, where one exists, an issue. The check also fails on a baseline entry that no longer matches, so fixing a leak forces its line to be deleted instead of quietly rotting. Scoping decisions worth recording: - private-ip covers only 172.16/12 and 10/8, the ranges the conventions document actually names. 192.168/16 is excluded: it is not NCW space and upstream uses it for generic example addresses in its own tests, so matching it produced only false positives. - home-path matches /Users/<name>/ but not /home/<name>/, which collides with this repo's own module paths (@screens/home/search/...). The exposure that matters is the shared build Mac. The workflow runs on pull_request as well as push, because build-android.yml only triggers on pushes to ncw/main - a leak introduced in a PR would otherwise go unnoticed until it had already been merged and published. Verified by table-testing both directions: 172.16.0.55, 172.31.9.9, 10.104.0.5, chat.ncwcom.com, someone@ncwcom.com, CT#137 and /Users/somebody/ all fail; 10.0.2.2, 192.168.1.10, www.ncwcom.com and version strings like 2.41.0 all pass. The tree is clean against the baseline as committed.