| |
| """Exit nonzero when publication candidates contain credential-shaped text.""" |
|
|
| from __future__ import annotations |
|
|
| import argparse |
| import json |
| from dataclasses import asdict |
| from pathlib import Path |
|
|
| from br_sovereign_llm.publication.secret_scan import ( |
| SecretScanError, |
| scan_release_directory, |
| scan_repository, |
| ) |
|
|
|
|
| def main() -> int: |
| parser = argparse.ArgumentParser() |
| parser.add_argument("root", nargs="?", default=Path.cwd(), type=Path) |
| parser.add_argument( |
| "--release", |
| action="store_true", |
| help="scan every file under an exact release root without exclusions", |
| ) |
| arguments = parser.parse_args() |
| try: |
| findings = ( |
| scan_release_directory(arguments.root) |
| if arguments.release |
| else scan_repository(arguments.root) |
| ) |
| except SecretScanError as error: |
| print( |
| json.dumps( |
| {"ok": False, "finding_count": None, "error": str(error)}, |
| indent=2, |
| sort_keys=True, |
| ) |
| ) |
| return 2 |
| print( |
| json.dumps( |
| { |
| "ok": not findings, |
| "finding_count": len(findings), |
| "findings": [asdict(finding) for finding in findings], |
| }, |
| indent=2, |
| sort_keys=True, |
| ) |
| ) |
| return 0 if not findings else 1 |
|
|
|
|
| if __name__ == "__main__": |
| raise SystemExit(main()) |
|
|
