Queue-North-Website/scripts/verify.d/30-doc-headers

61 lines
2.3 KiB
Plaintext
Raw Normal View History

chore: adopt template scripts and git hooks, retire phase-versioning Ten scripts from ~/.openclaw/Projects/Template, taken one at a time and configured against this deployment rather than copied wholesale. Configured, not just copied: - check-env.sh SPEC written from what server/index.js actually reads — 24 variables, each with the consequence of getting it wrong - secrets.sh plus this project's own shapes: a bare 60+ hex run, which is how the Zoho WebToLead tokens leaked into four commits, and a reCAPTCHA key shape as NOTED rather than a failure, because the site key and the secret key are indistinguishable by shape - status.sh nebula / qn-website-dev - healthcheck.sh /api/health, asserting 200 AND "status":"ok" AND "db":"ok". The template probed /healthz, which does not exist here - preflight.sh https://qn.isnull.dev, no --auth — there are no accounts - verify.sh GUARD_DIR=scripts/verify.d, since this project has no test runner and no typecheck for it to detect - backup.sh ENGINE block replaced for SQLite: better-sqlite3's online .backup() inside the container, verified with PRAGMA integrity_check before anything is renamed into place - restore-check.sh rewritten rather than configured — the template's is pg_restore/psql end to end with no seam. Replays the dump from SQL into a scratch database and times it Three guards in scripts/verify.d, because verify.sh would otherwise detect nothing and exit 2: the build, the tracked-tree secret scan, and a check that every document carries a valid Status, Governs and Review trigger. Every guard was proven to fail before being trusted, per GUARDS.md rule 1: healthcheck against a 200 that is not this app, secrets against the real historical leak replayed out of 033bdf6, doc-headers against both a missing Review trigger and the Status word "Historical", restore-check against a truncated dump, an empty database and a raised row floor. pre-commit is ADAPTED, not the template's. That one runs `npx tsc --noEmit` and `npx vitest run`; this project has neither, so unchanged it would refuse every commit. It runs the secret scan and `npm run build`. Hooks are not activated by this commit — `git config core.hooksPath .githooks` is a separate, per-clone act. package.json: adds `verify`, and corrects the version to 0.9.3. It said 0.8.3 while the last four commits said batch 0.9.0 through 0.9.3 — the second drift of the phase-versioning rule, which is retired in the following commit. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
2026-08-18 01:18:20 -05:00
#!/usr/bin/env bash
#
# Every document carries a complete, valid status header.
#
# ## Why this is a guard and not a convention
#
# `DOC_TRUST_MAP.md` makes two claims that nothing else enforces: the status
# word is one of exactly four, and `Review trigger` is the line that stops a
# document going quietly stale. A header carrying `Status` without
# `Review trigger` is the specific failure worth catching — it looks finished
# and is not.
#
# This repository is the reason. Before 2026-08-18 it had six markdown documents
# at its root with no headers at all, two of which described the project as
# being in "Phase 5" while the code was at 0.9.3. Nothing said so.
#
# Checked in the first sixteen lines, which is where a header lives.
#
# Exit 0 all conformant, 1 at least one is not, 2 no documents were found —
# which is not a pass, because it is what a moved docs/ directory looks like.
set -uo pipefail
cd "$(git rev-parse --show-toplevel)" || exit 1
VALID="Current Draft Superseded Archived"
bad=0
seen=0
# docs/** at any depth, plus the root one level deep — the same scope
# doc-triggers.py reads, so a document one tool checks the other fires on.
while IFS= read -r f; do
[ -n "$f" ] || continue
seen=$((seen + 1))
head16=$(head -16 "$f")
status=$(printf '%s\n' "$head16" | sed -nE 's/^Status:[[:space:]]*([A-Za-z]+).*/\1/p' | head -1)
trigger=$(printf '%s\n' "$head16" | grep -c '^Review trigger:' || true)
governs=$(printf '%s\n' "$head16" | grep -c '^Governs:' || true)
if [ -z "$status" ]; then
echo "no Status in the first 16 lines $f" >&2; bad=$((bad + 1)); continue
fi
case " $VALID " in
*" $status "*) ;;
*) echo "Status: '$status' is not one of the four $f" >&2; bad=$((bad + 1)) ;;
esac
[ "$trigger" -ge 1 ] || { echo "Status but no Review trigger — looks done $f" >&2; bad=$((bad + 1)); }
[ "$governs" -ge 1 ] || { echo "no Governs: line $f" >&2; bad=$((bad + 1)); }
done < <(git ls-files 'docs/**/*.md' 'docs/*.md' '*.md' 2>/dev/null)
if [ "$seen" -eq 0 ]; then
echo "doc-headers: no tracked markdown found. Nothing was checked — that is not a pass." >&2
exit 2
fi
if [ "$bad" -gt 0 ]; then
echo "doc-headers: $bad problem(s) across $seen document(s)." >&2
exit 1
fi
echo "doc-headers: $seen document(s), all with a valid Status, Governs and Review trigger."