| #!/bin/bash
|
|
|
|
|
|
|
|
|
| set -e
|
|
|
| REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
|
| ADR_DIR="$REPO_ROOT/docs/adr"
|
| ERRORS=0
|
|
|
| echo "=== ADR Validation ==="
|
| echo ""
|
|
|
|
|
| if [ ! -d "$ADR_DIR" ]; then
|
| echo "ERROR: $ADR_DIR does not exist"
|
| exit 1
|
| fi
|
|
|
| echo "[*] Validating ADRs in $ADR_DIR"
|
| echo ""
|
|
|
|
|
| for adr in "$ADR_DIR"/[0-9]*.md; do
|
| if [ ! -f "$adr" ]; then
|
| continue
|
| fi
|
|
|
| FILENAME=$(basename "$adr")
|
| ADR_ID=$(echo "$FILENAME" | sed 's/-.*//')
|
|
|
| echo "[*] Checking $FILENAME"
|
|
|
|
|
| if ! grep -q "^# ADR-[0-9]*:" "$adr"; then
|
| echo " ✗ Missing ADR title (# ADR-nnnn:)"
|
| ERRORS=$((ERRORS+1))
|
| fi
|
|
|
| if ! grep -q "**Status:**" "$adr"; then
|
| echo " ✗ Missing Status field"
|
| ERRORS=$((ERRORS+1))
|
| fi
|
|
|
| if ! grep -q "**Date:**" "$adr"; then
|
| echo " ✗ Missing Date field"
|
| ERRORS=$((ERRORS+1))
|
| fi
|
|
|
| if ! grep -q "## Context" "$adr"; then
|
| echo " ✗ Missing Context section"
|
| ERRORS=$((ERRORS+1))
|
| fi
|
|
|
| if ! grep -q "## Decision" "$adr"; then
|
| echo " ✗ Missing Decision section"
|
| ERRORS=$((ERRORS+1))
|
| fi
|
|
|
| if ! grep -q "## Rules" "$adr"; then
|
| echo " ✗ Missing Rules section"
|
| ERRORS=$((ERRORS+1))
|
| fi
|
|
|
| if ! grep -q "## Consequences" "$adr"; then
|
| echo " ✗ Missing Consequences section"
|
| ERRORS=$((ERRORS+1))
|
| fi
|
|
|
|
|
| STATUS=$(grep "**Status:**" "$adr" | sed 's/.*Status: *//' | sed 's/ .*//')
|
| if [[ ! "$STATUS" =~ ^(Accepted|Proposed|Superseded|Rejected)$ ]]; then
|
| echo " ✗ Invalid Status: $STATUS (must be: Accepted, Proposed, Superseded, Rejected)"
|
| ERRORS=$((ERRORS+1))
|
| fi
|
|
|
| echo " ✓ Valid ADR"
|
| done
|
|
|
| echo ""
|
|
|
|
|
| echo "[*] Scanning for private key patterns in repository..."
|
|
|
| PRIVATE_KEY_PATTERNS=(
|
| "-----BEGIN.*PRIVATE"
|
| "-----END.*PRIVATE"
|
| "private_key.*="
|
| "secret_key.*="
|
| "PRIVATE_KEY.*="
|
| )
|
|
|
| FOUND_KEYS=0
|
| for pattern in "${PRIVATE_KEY_PATTERNS[@]}"; do
|
| if grep -r "$pattern" "$REPO_ROOT" --include="*.py" --include="*.js" --include="*.sh" 2>/dev/null | grep -v "docs/adr" | grep -v ".gitignore" | head -1; then
|
| FOUND_KEYS=$((FOUND_KEYS+1))
|
| fi
|
| done
|
|
|
| if [ $FOUND_KEYS -gt 0 ]; then
|
| echo " ✗ Found private key patterns in code"
|
| ERRORS=$((ERRORS+1))
|
| else
|
| echo " ✓ No private key patterns found"
|
| fi
|
|
|
|
|
| echo "[*] Checking .gitignore for private key protection..."
|
|
|
| REQUIRED_IGNORES=(
|
| "sovereign/.node_sk"
|
| "*.pem"
|
| "*.key"
|
| )
|
|
|
| for pattern in "${REQUIRED_IGNORES[@]}"; do
|
| if grep -q "^$pattern$" "$REPO_ROOT/.gitignore" 2>/dev/null; then
|
| echo " ✓ $pattern in .gitignore"
|
| else
|
| echo " ⚠ $pattern not in .gitignore (may be intentional)"
|
| fi
|
| done
|
|
|
| echo ""
|
|
|
| if [ $ERRORS -eq 0 ]; then
|
| echo "=== VALIDATION PASSED ==="
|
| echo "All ADRs are valid and consistent"
|
| exit 0
|
| else
|
| echo "=== VALIDATION FAILED ==="
|
| echo "$ERRORS errors found"
|
| exit 1
|
| fi
|
|
|
