fix: restrict data publish staging

This commit is contained in:
SHAREit
2026-10-16 15:16:40 +08:00
parent af245d2bab
commit b58dd67366
+10 -3
View File
@@ -176,11 +176,18 @@ def git_publish(repo: Path, start: str, end: str, no_push: bool) -> str:
if not (repo / ".git").exists(): if not (repo / ".git").exists():
raise RuntimeError("仓库尚未初始化") raise RuntimeError("仓库尚未初始化")
status = git_run(repo, ["status", "--porcelain", "--untracked-files=all"]).stdout.strip().splitlines() status = git_run(repo, ["status", "--porcelain", "--untracked-files=all"]).stdout.strip().splitlines()
allowed = re.compile(r"data/(?:index|[0-9]{8})\.json$") allowed = re.compile(r"data/(?:index\.json|[0-9]{8}\.json)$")
unexpected = [line for line in status if len(line) < 4 or not allowed.fullmatch(line[3:])] allowed_paths = []
unexpected = []
for line in status:
path = line[3:] if len(line) >= 4 else ""
if not allowed.fullmatch(path):
unexpected.append(line)
else:
allowed_paths.append(path)
if unexpected: if unexpected:
raise RuntimeError("工作区已有未预期改动: " + ", ".join(unexpected)) raise RuntimeError("工作区已有未预期改动: " + ", ".join(unexpected))
add = git_run(repo, ["add", "--", "data"]) add = git_run(repo, ["add", "--", *allowed_paths])
if add.returncode: if add.returncode:
raise RuntimeError("git add 失败: " + add.stderr.strip()) raise RuntimeError("git add 失败: " + add.stderr.strip())
staged = git_run(repo, ["diff", "--cached", "--name-only"]) staged = git_run(repo, ["diff", "--cached", "--name-only"])