| import { readFileSync, readdirSync, statSync } from 'node:fs'; |
| import { join, relative } from 'node:path'; |
| import assert from 'node:assert/strict'; |
| const root = process.cwd(), |
| isPublic = process.argv.includes('--public'); |
| const skip = new Set(['node_modules', '.git', '.wrangler', '.vinext', '.next']); |
| const forbidden = |
| /\b(?:sk-(?:proj-)?[A-Za-z0-9_-]{20,}|hf_[A-Za-z0-9]{20,}|ghp_[A-Za-z0-9]{20,}|github_pat_[A-Za-z0-9_]{20,})\b/; |
| const privatePattern = |
| /(?:appgprj|appgver|appgdep)_[A-Za-z0-9]+|https:\/\/[a-z0-9-]+\.[a-z0-9-]+\.chatgpt\.site/; |
| let checked = 0; |
| function visit(dir) { |
| for (const name of readdirSync(dir)) { |
| if ( |
| skip.has(name) || |
| name === 'PRIVATE_RELEASE.md' || |
| name.endsWith('.tsbuildinfo') |
| ) |
| continue; |
| const path = join(dir, name), |
| rel = relative(root, path); |
| if (name.startsWith('.env')) |
| throw new Error('Environment file must not be published: ' + rel); |
| if (statSync(path).isDirectory()) { |
| visit(path); |
| continue; |
| } |
| if (!/\.(?:tsx?|m?js|json|html|rsc|md|css|svg|txt|yml|yaml)$/.test(name)) |
| continue; |
| const text = readFileSync(path, 'utf8'); |
| assert.ok(!forbidden.test(text), 'Possible secret: ' + rel); |
| if (isPublic) |
| assert.ok( |
| !privatePattern.test(text), |
| 'Private hosting reference: ' + rel, |
| ); |
| checked++; |
| } |
| } |
| visit(root); |
| const hosting = JSON.parse(readFileSync('.openai/hosting.json', 'utf8')); |
| assert.equal(hosting.static.directory, 'dist/client'); |
| assert.equal(hosting.d1, null); |
| assert.equal(hosting.r2, null); |
| if (isPublic) assert.equal(hosting.project_id, undefined); |
| const html = readFileSync('dist/client/index.html', 'utf8'); |
| assert.ok(html.includes('DRIFT')); |
| assert.ok(html.includes('Run full experiment')); |
| assert.ok( |
| readdirSync('dist/client/_next/static').some((f) => |
| /^drift\.worker-.*\.js$/.test(f), |
| ), |
| ); |
| console.log( |
| 'Release check passed: ' + |
| checked + |
| ' text files; static entry, worker and ' + |
| (isPublic ? 'public sanitization' : 'local release') + |
| ' verified.', |
| ); |
|
|
