test: strengthen launch security and capacity gates

scripts/repo-security-scan-test.js

@@ -0,0 +1,59 @@
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { spawnSync } from 'node:child_process';
+
+const repoRoot = process.cwd();
+const scriptPath = path.join(repoRoot, 'scripts', 'repo-security-scan.js');
+
+function run(cwd) {
+  return spawnSync(process.execPath, [scriptPath, '--json'], {
+    cwd,
+    encoding: 'utf8',
+    env: {
+      PATH: process.env.PATH || '',
+      Path: process.env.Path || '',
+      SystemRoot: process.env.SystemRoot || '',
+      ComSpec: process.env.ComSpec || '',
+      TEMP: process.env.TEMP || os.tmpdir(),
+      TMP: process.env.TMP || os.tmpdir(),
+    },
+  });
+}
+
+const clean = run(repoRoot);
+assert.equal(clean.status, 0, `current repository should pass security scan: ${clean.stdout} ${clean.stderr}`);
+const cleanPayload = JSON.parse(clean.stdout);
+assert.equal(cleanPayload.summary.critical, 0);
+assert.equal(cleanPayload.summary.high, 0);
+
+const tempDir = fs.mkdtempSync(path.join(os.tmpdir(), 'tiku-security-scan-'));
+try {
+  fs.mkdirSync(path.join(tempDir, 'apps', 'taro', 'src'), { recursive: true });
+  fs.writeFileSync(
+    path.join(tempDir, 'apps', 'taro', 'src', 'unsafe.ts'),
+    "export const headers = { 'x-user-id': '123' };\n",
+    'utf8',
+  );
+  fs.writeFileSync(
+    path.join(tempDir, 'secret.env'),
+    [
+      'DATABASE_URL=postgresql://postgres:real-password@db.example.com:5432/postgres',
+      'SUPABASE_SERVICE_ROLE_KEY=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.fake-service-role-token-that-should-not-ship',
+      '',
+    ].join('\n'),
+    'utf8',
+  );
+
+  const unsafe = run(tempDir);
+  assert.notEqual(unsafe.status, 0, 'unsafe fixture should fail security scan');
+  const payload = JSON.parse(unsafe.stdout);
+  assert.ok(payload.findings.some(item => item.id === 'frontend-legacy-user-header'), 'x-user-id should be detected');
+  assert.ok(payload.findings.some(item => item.id === 'postgres-url'), 'database URL should be detected');
+  assert.ok(payload.findings.some(item => item.id === 'supabase-service-role'), 'service role key should be detected');
+} finally {
+  fs.rmSync(tempDir, { recursive: true, force: true });
+}
+
+console.log('[PASS] repository security scan');