@windyroad/risk-scorer 0.18.14 → 0.18.15
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
package/hooks/git-push-gate.sh
CHANGED
|
@@ -52,7 +52,11 @@ if echo "$COMMAND" | grep -qE '(^|;|&&|\|\|)\s*npm run push:watch(\s|$)'; then
|
|
|
52
52
|
MARK_TIME=$(_mtime "${RDIR}/reducing-push")
|
|
53
53
|
AGE=$(( NOW - MARK_TIME ))
|
|
54
54
|
TTL_SECONDS="${RISK_TTL:-3600}"
|
|
55
|
-
if [ "$AGE" -lt "$TTL_SECONDS" ] &&
|
|
55
|
+
if [ "$AGE" -lt "$TTL_SECONDS" ] && ! _checkout_matches "${RDIR}/checkout-id"; then
|
|
56
|
+
risk_gate_deny "Push blocked: this event resolved to a different Git checkout than the valid risk assessment. Retry the same command with an explicit leading \`cd /absolute/path/to/the/assessed-checkout && npm run push:watch\`; the marker was preserved, so do not rescore unless that checkout changed."
|
|
57
|
+
exit 0
|
|
58
|
+
fi
|
|
59
|
+
if [ "$AGE" -lt "$TTL_SECONDS" ] && [ -f "${RDIR}/state-hash" ]; then
|
|
56
60
|
STORED_HASH=$(cat "${RDIR}/state-hash")
|
|
57
61
|
CURRENT_HASH=$("$SCRIPT_DIR/lib/pipeline-state.sh" --hash-inputs 2>/dev/null | _hashcmd | cut -d' ' -f1)
|
|
58
62
|
if [ "$STORED_HASH" = "$CURRENT_HASH" ]; then
|
|
@@ -129,7 +133,11 @@ if echo "$COMMAND" | grep -qE '(^|;|&&|\|\|)\s*npm run release:watch(\s|$)'; the
|
|
|
129
133
|
MARK_TIME=$(_mtime "${RDIR}/reducing-release")
|
|
130
134
|
AGE=$(( NOW - MARK_TIME ))
|
|
131
135
|
TTL_SECONDS="${RISK_TTL:-3600}"
|
|
132
|
-
if [ "$AGE" -lt "$TTL_SECONDS" ] &&
|
|
136
|
+
if [ "$AGE" -lt "$TTL_SECONDS" ] && ! _checkout_matches "${RDIR}/checkout-id"; then
|
|
137
|
+
risk_gate_deny "Release blocked: this event resolved to a different Git checkout than the valid risk assessment. Retry the same command with an explicit leading \`cd /absolute/path/to/the/assessed-checkout && npm run release:watch\`; the marker was preserved, so do not rescore unless that checkout changed."
|
|
138
|
+
exit 0
|
|
139
|
+
fi
|
|
140
|
+
if [ "$AGE" -lt "$TTL_SECONDS" ] && [ -f "${RDIR}/state-hash" ]; then
|
|
133
141
|
STORED_HASH=$(cat "${RDIR}/state-hash")
|
|
134
142
|
CURRENT_HASH=$("$SCRIPT_DIR/lib/pipeline-state.sh" --hash-inputs 2>/dev/null | _hashcmd | cut -d' ' -f1)
|
|
135
143
|
if [ "$STORED_HASH" = "$CURRENT_HASH" ]; then
|
|
@@ -96,7 +96,11 @@ if [ -f "${RDIR}/reducing-commit" ]; then
|
|
|
96
96
|
MARK_TIME=$(_mtime "${RDIR}/reducing-commit")
|
|
97
97
|
AGE=$(( NOW - MARK_TIME ))
|
|
98
98
|
TTL_SECONDS="${RISK_TTL:-3600}"
|
|
99
|
-
if [ "$AGE" -lt "$TTL_SECONDS" ] &&
|
|
99
|
+
if [ "$AGE" -lt "$TTL_SECONDS" ] && ! _checkout_matches "${RDIR}/checkout-id"; then
|
|
100
|
+
risk_gate_deny "Commit blocked: this event resolved to a different Git checkout than the valid risk assessment. Retry the same command with an explicit leading \`cd /absolute/path/to/the/assessed-checkout && git commit ...\`; the marker was preserved, so do not rescore unless that checkout changed."
|
|
101
|
+
exit 0
|
|
102
|
+
fi
|
|
103
|
+
if [ "$AGE" -lt "$TTL_SECONDS" ] && [ -f "${RDIR}/state-hash" ]; then
|
|
100
104
|
STORED_HASH=$(cat "${RDIR}/state-hash")
|
|
101
105
|
CURRENT_HASH=$("$SCRIPT_DIR/lib/pipeline-state.sh" --hash-inputs 2>/dev/null | _hashcmd | cut -d' ' -f1)
|
|
102
106
|
if [ "$STORED_HASH" = "$CURRENT_HASH" ]; then
|
package/package.json
CHANGED