diff --git a/.github/scripts/pr_security_scan.py b/.github/scripts/pr_security_scan.py deleted file mode 100644 index c2025a7..0000000 --- a/.github/scripts/pr_security_scan.py +++ /dev/null @@ -1,177 +0,0 @@ -import re, sys, os - -changed_files_raw = os.environ.get("CHANGED_FILES", "") -mcf_files = [ - f.strip() for f in changed_files_raw.splitlines() - if f.strip().endswith(".mcfunction") and os.path.isfile(f.strip()) -] - -# --- Bypass: repo admin PR açtıysa fail etme, sadece warn --- -PR_AUTHOR_IS_ADMIN = os.environ.get("PR_AUTHOR_IS_ADMIN", "false").lower() == "true" - -# --- Path whitelist --- -# Bu path'lerde eşleşen kurallar WARN'a düşer, fail etmez. -PATH_RULE_WHITELIST = [ - # datalib internal CB sistemi — koordinat macro'su ve storage temizliği normaldir - ("data/datalib/function/api/cb/", "MACRO_CHAIN"), - ("data/datalib/function/api/cb/", "DATA_REMOVE_ENGINE"), - ("data/datalib/function/systems/cb/", "MACRO_CHAIN"), - ("data/datalib/function/systems/cb/", "DATA_REMOVE_ENGINE"), - # load sırasında storage sıfırlama normaldir - ("data/dl_load/function/load/storages", "DATA_REMOVE_ENGINE"), -] - -def is_whitelisted(fpath: str, label: str) -> bool: - for path_prefix, rule_label in PATH_RULE_WHITELIST: - if path_prefix in fpath and rule_label == label: - return True - return False - -PATTERNS = [ - # Privilege escalation - ("OP_GRANT", r'(? 0: - report_lines.append(f"| ⚪ WHITELISTED (info) | {total_whitelisted} |") - -if PR_AUTHOR_IS_ADMIN: - report_lines += [ - "", - "> ℹ️ **Admin bypass active** — PR author is a repository admin. Scan findings are informational only; merge is not blocked.", - ] - -report_lines.append("") - -for entry in results: - if "error" in entry: - report_lines.append(f"### ❌ `{entry['file']}` — read error: {entry['error']}") - continue - report_lines.append(f"### `{entry['file']}`") - for hit in entry["hits"]: - if hit["whitelisted"]: - report_lines.append(f"- ⚪ **WHITELISTED** `{hit['label']}` (line {hit['line']}): {hit['desc']} *(internal path — expected)*") - else: - icon = {"CRITICAL": "🔴", "HIGH": "🟠", "MEDIUM": "🟡"}.get(hit["severity"], "⚪") - report_lines.append(f"- {icon} **{hit['severity']}** `{hit['label']}` (line {hit['line']}): {hit['desc']}") - report_lines.append(f" ```") - report_lines.append(f" {hit['content']}") - report_lines.append(f" ```") - report_lines.append("") - -report_lines += [ - "> **This scan is automated.** MEDIUM findings may be false positives.", - "> CRITICAL and HIGH findings must be reviewed before merge.", - "> Whitelisted findings are expected patterns in internal engine paths.", -] - -report = "\n".join(report_lines) - -github_step_summary = os.environ.get("GITHUB_STEP_SUMMARY") -if github_step_summary: - with open(github_step_summary, "a") as f: - f.write(report + "\n") - -with open("/tmp/scan_report.md", "w") as f: - f.write(report) - -github_output = os.environ.get("GITHUB_OUTPUT") -if github_output: - with open(github_output, "a") as f: - f.write(f"critical={total_critical}\nhigh={total_high}\nmedium={total_medium}\n") - -# Admin bypass: hiçbir zaman fail etme -if PR_AUTHOR_IS_ADMIN: - print("SCAN_WARNED (admin bypass)") - sys.exit(0) - -if total_critical > 0 or total_high > 0: - print("SCAN_FAILED") - sys.exit(1) - -print("SCAN_WARNED") -sys.exit(0) \ No newline at end of file