feat: establish Quant OS production-80 architecture

tools/check_tracked_secrets.py

@@ -0,0 +1,68 @@
+#!/usr/bin/env python3
+"""Reject obvious reusable credentials without printing their values."""
+
+from __future__ import annotations
+
+import re
+import subprocess
+import sys
+from pathlib import Path
+
+
+PROJECT = Path(__file__).resolve().parents[1]
+PATTERNS = (
+    re.compile(r"-----BEGIN (?:RSA |EC |OPENSSH )?PRIVATE KEY-----"),
+    re.compile(r"\b(?:ghp|github_pat|glpat|gitea)_[A-Za-z0-9_-]{16,}\b"),
+    re.compile(r"https?://[^/\s:@]+:[^/\s@]{8,}@"),
+    re.compile(
+        r"(?i)\b(?:password|passwd|api[_-]?key|access[_-]?token|secret)"
+        r"\s*[:=]\s*[\"'][A-Za-z0-9+/=_-]{12,}[\"']"
+    ),
+)
+
+
+def tracked_files() -> list[Path]:
+    result = subprocess.run(
+        ["git", "ls-files", "-z"],
+        cwd=PROJECT,
+        check=True,
+        capture_output=True,
+    )
+    return [
+        PROJECT / item.decode("utf-8")
+        for item in result.stdout.split(b"\0")
+        if item
+    ]
+
+
+def main() -> int:
+    findings: list[tuple[str, int, int]] = []
+    for path in tracked_files():
+        try:
+            text = path.read_text(encoding="utf-8")
+        except (OSError, UnicodeDecodeError):
+            continue
+        for line_number, line in enumerate(text.splitlines(), start=1):
+            for pattern_number, pattern in enumerate(PATTERNS, start=1):
+                if pattern.search(line):
+                    findings.append(
+                        (
+                            path.relative_to(PROJECT).as_posix(),
+                            line_number,
+                            pattern_number,
+                        )
+                    )
+    if findings:
+        for path, line_number, pattern_number in findings:
+            print(
+                f"credential-like content: {path}:{line_number} "
+                f"(rule {pattern_number})",
+                file=sys.stderr,
+            )
+        return 1
+    print("tracked secret scan: OK")
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())