gensokyo-dev
21f9af9d93
fix(ci): isolate packed Python syntax checks from ambient imports Keep caller-local modules and site startup hooks from replacing the standard-library AST/tar readers or executing during package validation. Assisted-by: Reimu (gensokyo-skills:reimu-incident-triage) Assisted-by: Kogasa (gensokyo-skills:kogasa-surprise-testing)
40 lines
1.5 KiB
JavaScript
40 lines
1.5 KiB
JavaScript
import { execFile } from "node:child_process";
|
|
import { promisify } from "node:util";
|
|
import { GHIDRA_BRIDGE_SOURCES } from "../src/ghidra/GhidraBridgeSources.ts";
|
|
|
|
const exec = promisify(execFile);
|
|
const packedHopperBridge = "package/bridge/hopper_bridge.py";
|
|
const packedCutterBridge = "package/bridge/cutter/rea_bridge.py";
|
|
|
|
/** Check shipped bridge files; real-provider lanes verify runtime behavior. */
|
|
export async function verifyPackedBridge({ tarball, packedFiles }) {
|
|
for (const path of [
|
|
packedHopperBridge,
|
|
packedCutterBridge,
|
|
...Object.values(GHIDRA_BRIDGE_SOURCES).map(
|
|
(name) => `package/bridge/ghidra/${name}`,
|
|
),
|
|
]) {
|
|
if (!packedFiles.includes(path)) throw new Error(`package omitted ${path}`);
|
|
}
|
|
// Read the packed source without extracting into the caller's leased root.
|
|
// Only the interpreter's standard library is needed; caller-local modules
|
|
// and site startup hooks must not replace the parser or execute here.
|
|
await exec("python3", [
|
|
"-I",
|
|
"-S",
|
|
"-c",
|
|
[
|
|
"import ast, sys, tarfile",
|
|
"with tarfile.open(sys.argv[1]) as archive:",
|
|
" member = archive.getmember(sys.argv[2])",
|
|
" if not member.isfile():",
|
|
" raise ValueError(f'{member.name} is not a regular file')",
|
|
" with archive.extractfile(member) as source:",
|
|
" ast.parse(source.read().decode('utf-8'), filename=sys.argv[2])",
|
|
].join("\n"),
|
|
tarball,
|
|
packedHopperBridge,
|
|
]);
|
|
}
|