bb526cde80
Some checks failed
CICD Start / Sanity and Base Decision (pull_request) Failing after 10m34s
Add Dockerfile boundary checks and deployable image purity validation for backend/frontend runtime artifacts. Wire enforcement into CI workflows and document runtime-vs-validation ownership.
73 lines
1.5 KiB
Bash
73 lines
1.5 KiB
Bash
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
|
|
ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
|
|
cd "${ROOT_DIR}"
|
|
|
|
backend_file="Dockerfile.backend"
|
|
frontend_file="Dockerfile.frontend"
|
|
|
|
declare -a disallowed_references=(
|
|
"cicd-base"
|
|
"CICD_BASE_IMAGE"
|
|
"Dockerfile.cicd"
|
|
"Dockerfile.cicd-base"
|
|
"plex-playlist-cicd"
|
|
)
|
|
|
|
declare -a disallowed_runtime_tools=(
|
|
"ruff"
|
|
"pyright"
|
|
"pytest"
|
|
"pydoclint"
|
|
"xdoctest"
|
|
"pre-commit"
|
|
"yamllint"
|
|
"toml-sort"
|
|
"eslint"
|
|
"prettier"
|
|
"typescript"
|
|
"vitest"
|
|
"playwright"
|
|
)
|
|
|
|
check_absent() {
|
|
local file="$1"
|
|
local token="$2"
|
|
|
|
if grep -Eiv '^[[:space:]]*#' "${file}" | grep -Eiq "${token}"; then
|
|
echo "❌ Found disallowed token '${token}' in ${file}" >&2
|
|
return 1
|
|
fi
|
|
|
|
return 0
|
|
}
|
|
|
|
status=0
|
|
|
|
for token in "${disallowed_references[@]}"; do
|
|
check_absent "${backend_file}" "${token}" || status=1
|
|
check_absent "${frontend_file}" "${token}" || status=1
|
|
done
|
|
|
|
for token in "${disallowed_runtime_tools[@]}"; do
|
|
check_absent "${backend_file}" "${token}" || status=1
|
|
check_absent "${frontend_file}" "${token}" || status=1
|
|
done
|
|
|
|
if ! grep -Eq '^FROM[[:space:]]+python:3\.14-slim' "${backend_file}"; then
|
|
echo "❌ ${backend_file} must use python:3.14-slim as runtime base" >&2
|
|
status=1
|
|
fi
|
|
|
|
if ! grep -Eq '^FROM[[:space:]]+nginx:alpine[[:space:]]+AS[[:space:]]+production' "${frontend_file}"; then
|
|
echo "❌ ${frontend_file} must use nginx:alpine for production target" >&2
|
|
status=1
|
|
fi
|
|
|
|
if [[ "${status}" -ne 0 ]]; then
|
|
exit "${status}"
|
|
fi
|
|
|
|
echo "✅ Dockerfile runtime boundaries are valid"
|