Files
tailscale-custom/.agent/scripts/checklist.py
T
huanld 2fb067ecbf
checklocks / checklocks (push) Has been cancelled
CodeQL / Analyze (go) (push) Has been cancelled
natlab-integrationtest / natlab-integrationtest (push) Has been cancelled
CI / gomod-cache (push) Has been cancelled
CI / race-root-integration (1/4) (push) Has been cancelled
CI / race-root-integration (2/4) (push) Has been cancelled
CI / race-root-integration (3/4) (push) Has been cancelled
CI / race-root-integration (4/4) (push) Has been cancelled
CI / test (-race, amd64, 1/3) (push) Has been cancelled
CI / test (-race, amd64, 2/3) (push) Has been cancelled
CI / test (-race, amd64, 3/3) (push) Has been cancelled
CI / test (386) (push) Has been cancelled
CI / test (amd64) (push) Has been cancelled
CI / Windows (benchmarks) (push) Has been cancelled
CI / Windows (1/2) (push) Has been cancelled
CI / Windows (2/2) (push) Has been cancelled
CI / macos (push) Has been cancelled
CI / privileged (push) Has been cancelled
CI / vm (push) Has been cancelled
CI / cross (386, linux) (push) Has been cancelled
CI / cross (amd64, darwin) (push) Has been cancelled
CI / cross (amd64, freebsd) (push) Has been cancelled
CI / cross (amd64, openbsd) (push) Has been cancelled
CI / cross (amd64, windows) (push) Has been cancelled
CI / cross (arm, 5, linux) (push) Has been cancelled
CI / cross (arm, 7, linux) (push) Has been cancelled
CI / cross (arm64, darwin) (push) Has been cancelled
CI / cross (arm64, linux) (push) Has been cancelled
CI / cross (arm64, windows) (push) Has been cancelled
CI / cross (loong64, linux) (push) Has been cancelled
CI / ios (push) Has been cancelled
CI / crossmin (amd64, illumos) (push) Has been cancelled
CI / crossmin (amd64, plan9) (push) Has been cancelled
CI / crossmin (amd64, solaris) (push) Has been cancelled
CI / crossmin (ppc64, aix) (push) Has been cancelled
CI / android (push) Has been cancelled
CI / wasm (push) Has been cancelled
CI / tailscale_go (push) Has been cancelled
CI / fuzz (push) Has been cancelled
CI / depaware (push) Has been cancelled
CI / go_generate (push) Has been cancelled
CI / make_tidy (push) Has been cancelled
CI / licenses (push) Has been cancelled
CI / staticcheck (macOS) (push) Has been cancelled
CI / staticcheck (Linux) (push) Has been cancelled
CI / staticcheck (Windows) (push) Has been cancelled
CI / staticcheck (Portable (1/4)) (push) Has been cancelled
CI / staticcheck (Portable (2/4)) (push) Has been cancelled
CI / staticcheck (Portable (3/4)) (push) Has been cancelled
CI / staticcheck (Portable (4/4)) (push) Has been cancelled
CI / notify_slack (push) Has been cancelled
CI / merge_blocker (push) Has been cancelled
CI / check_mergeability_strict (push) Has been cancelled
CI / check_mergeability (push) Has been cancelled
Dockerfile build / deploy (push) Has been cancelled
test installer.sh / test (curl, alpine:3.21) (push) Has been cancelled
test installer.sh / test (curl, alpine:edge) (push) Has been cancelled
test installer.sh / test (curl, alpine:latest) (push) Has been cancelled
test installer.sh / test (curl, amazonlinux:latest) (push) Has been cancelled
test installer.sh / test (curl, archlinux:latest) (push) Has been cancelled
test installer.sh / test (curl, debian:oldstable-slim) (push) Has been cancelled
test installer.sh / test (curl, debian:sid-slim) (push) Has been cancelled
test installer.sh / test (curl, debian:stable-slim, 1.80.0) (push) Has been cancelled
test installer.sh / test (curl, debian:testing-slim) (push) Has been cancelled
test installer.sh / test (curl, elementary/docker:stable) (push) Has been cancelled
test installer.sh / test (curl, elementary/docker:unstable) (push) Has been cancelled
test installer.sh / test (curl, fedora:latest, 1.80.0) (push) Has been cancelled
test installer.sh / test (curl, kalilinux/kali-dev) (push) Has been cancelled
test installer.sh / test (curl, kalilinux/kali-rolling) (push) Has been cancelled
test installer.sh / test (curl, opensuse/leap:latest) (push) Has been cancelled
test installer.sh / test (curl, opensuse/tumbleweed:latest) (push) Has been cancelled
test installer.sh / test (curl, oraclelinux:8) (push) Has been cancelled
test installer.sh / test (curl, oraclelinux:9) (push) Has been cancelled
test installer.sh / test (curl, parrotsec/core:latest) (push) Has been cancelled
test installer.sh / test (curl, rockylinux:8.7) (push) Has been cancelled
test installer.sh / test (curl, rockylinux:9) (push) Has been cancelled
test installer.sh / test (curl, ubuntu:20.04) (push) Has been cancelled
test installer.sh / test (curl, ubuntu:22.04) (push) Has been cancelled
test installer.sh / test (curl, ubuntu:24.04, 1.80.0) (push) Has been cancelled
test installer.sh / test (wget, debian:oldstable-slim) (push) Has been cancelled
test installer.sh / test (wget, debian:sid-slim) (push) Has been cancelled
update-flake / update-flake (push) Has been cancelled
tailscale.com/cmd/vet / vet (push) Has been cancelled
test installer.sh / notify-slack (push) Has been cancelled
feat: security hardening, production roadmap, admin panel v1
Client security fixes (cmd/tailscale-tray/main.go):
- SSRF protection in Add Server dialog (validateControlURL): reject
  private/loopback/link-local/cloud-metadata IPs via DNS resolution
- RCE gate on AuthURL/BrowseToURL exec paths (validateAuthURL)
- Sanitized URL logging (sanitizeURLForLog drops query auth tokens)
- Error handling on exec.Command with user-facing showError()

Admin panel security (web-admin):
- Bcrypt password hashing (replaces SHA256)
- Rate limiting: 5 failed logins → 15-min lockout
- Session + login attempt cleanup goroutine (hourly)
- url.QueryEscape / encodeURIComponent for all API params
- Fail-hard startup when no TLS and non-loopback bind
- ADMIN_PASSWORD required (no default), password min 12 chars
- Username regex whitelist

Installer hardening (Setup.wxs):
- util:PermissionEx restricts SCM access: only Administrators +
  SYSTEM can start/stop/reconfigure service. Authenticated Users
  limited to QueryStatus/QueryConfig/Interrogate
- Vital="yes" on ServiceInstall

Docs & roadmap:
- PRODUCTION_ROADMAP.md: 5-milestone plan (security + features +
  distribution + ops) with granular tasks, effort, done-when
- CLIENT_SECURITY_AUDIT.md, SECURITY_FIXES.md, DEPLOYMENT.md
- AI assistant rules (.cursorrules, .antigravityrules, etc.)

Build & distribution:
- build-msi.ps1, deploy-and-sign.ps1, sign-release.ps1
- redeploy.ps1, tray-deploy.ps1, test-msi.ps1
- installer/msi/ alternative WXS setup
- Restored .github/workflows/ removed in mirror cleanup

.gitignore hardened: *.pfx, *.p12, *.key, *.pem, .env*
2026-04-22 15:18:11 +07:00

218 lines
7.4 KiB
Python

#!/usr/bin/env python3
"""
Master Checklist Runner - Antigravity Kit
==========================================
Orchestrates all validation scripts in priority order.
Use this for incremental validation during development.
Usage:
python scripts/checklist.py . # Run core checks
python scripts/checklist.py . --url <URL> # Include performance checks
Priority Order:
P0: Security Scan (vulnerabilities, secrets)
P1: Lint & Type Check (code quality)
P2: Schema Validation (if database exists)
P3: Test Runner (unit/integration tests)
P4: UX Audit (psychology laws, accessibility)
P5: SEO Check (meta tags, structure)
P6: Performance (lighthouse - requires URL)
"""
import sys
import subprocess
import argparse
from pathlib import Path
from typing import List, Tuple, Optional
# ANSI colors for terminal output
class Colors:
HEADER = '\033[95m'
BLUE = '\033[94m'
CYAN = '\033[96m'
GREEN = '\033[92m'
YELLOW = '\033[93m'
RED = '\033[91m'
ENDC = '\033[0m'
BOLD = '\033[1m'
def print_header(text: str):
print(f"\n{Colors.BOLD}{Colors.CYAN}{'='*60}{Colors.ENDC}")
print(f"{Colors.BOLD}{Colors.CYAN}{text.center(60)}{Colors.ENDC}")
print(f"{Colors.BOLD}{Colors.CYAN}{'='*60}{Colors.ENDC}\n")
def print_step(text: str):
print(f"{Colors.BOLD}{Colors.BLUE}🔄 {text}{Colors.ENDC}")
def print_success(text: str):
print(f"{Colors.GREEN}{text}{Colors.ENDC}")
def print_warning(text: str):
print(f"{Colors.YELLOW}⚠️ {text}{Colors.ENDC}")
def print_error(text: str):
print(f"{Colors.RED}{text}{Colors.ENDC}")
# Define priority-ordered checks
CORE_CHECKS = [
("Security Scan", ".agent/skills/vulnerability-scanner/scripts/security_scan.py", True),
("Lint Check", ".agent/skills/lint-and-validate/scripts/lint_runner.py", True),
("Schema Validation", ".agent/skills/database-design/scripts/schema_validator.py", False),
("Test Runner", ".agent/skills/testing-patterns/scripts/test_runner.py", False),
("UX Audit", ".agent/skills/frontend-design/scripts/ux_audit.py", False),
("SEO Check", ".agent/skills/seo-fundamentals/scripts/seo_checker.py", False),
]
PERFORMANCE_CHECKS = [
("Lighthouse Audit", ".agent/skills/performance-profiling/scripts/lighthouse_audit.py", True),
("Playwright E2E", ".agent/skills/webapp-testing/scripts/playwright_runner.py", False),
]
def check_script_exists(script_path: Path) -> bool:
"""Check if script file exists"""
return script_path.exists() and script_path.is_file()
def run_script(name: str, script_path: Path, project_path: str, url: Optional[str] = None) -> dict:
"""
Run a validation script and capture results
Returns:
dict with keys: name, passed, output, skipped
"""
if not check_script_exists(script_path):
print_warning(f"{name}: Script not found, skipping")
return {"name": name, "passed": True, "output": "", "skipped": True}
print_step(f"Running: {name}")
# Build command
cmd = ["python", str(script_path), project_path]
if url and ("lighthouse" in script_path.name.lower() or "playwright" in script_path.name.lower()):
cmd.append(url)
# Run script
try:
result = subprocess.run(
cmd,
capture_output=True,
text=True,
timeout=300 # 5 minute timeout
)
passed = result.returncode == 0
if passed:
print_success(f"{name}: PASSED")
else:
print_error(f"{name}: FAILED")
if result.stderr:
print(f" Error: {result.stderr[:200]}")
return {
"name": name,
"passed": passed,
"output": result.stdout,
"error": result.stderr,
"skipped": False
}
except subprocess.TimeoutExpired:
print_error(f"{name}: TIMEOUT (>5 minutes)")
return {"name": name, "passed": False, "output": "", "error": "Timeout", "skipped": False}
except Exception as e:
print_error(f"{name}: ERROR - {str(e)}")
return {"name": name, "passed": False, "output": "", "error": str(e), "skipped": False}
def print_summary(results: List[dict]):
"""Print final summary report"""
print_header("📊 CHECKLIST SUMMARY")
passed_count = sum(1 for r in results if r["passed"] and not r.get("skipped"))
failed_count = sum(1 for r in results if not r["passed"] and not r.get("skipped"))
skipped_count = sum(1 for r in results if r.get("skipped"))
print(f"Total Checks: {len(results)}")
print(f"{Colors.GREEN}✅ Passed: {passed_count}{Colors.ENDC}")
print(f"{Colors.RED}❌ Failed: {failed_count}{Colors.ENDC}")
print(f"{Colors.YELLOW}⏭️ Skipped: {skipped_count}{Colors.ENDC}")
print()
# Detailed results
for r in results:
if r.get("skipped"):
status = f"{Colors.YELLOW}⏭️ {Colors.ENDC}"
elif r["passed"]:
status = f"{Colors.GREEN}{Colors.ENDC}"
else:
status = f"{Colors.RED}{Colors.ENDC}"
print(f"{status} {r['name']}")
print()
if failed_count > 0:
print_error(f"{failed_count} check(s) FAILED - Please fix before proceeding")
return False
else:
print_success("All checks PASSED ✨")
return True
def main():
parser = argparse.ArgumentParser(
description="Run Antigravity Kit validation checklist",
formatter_class=argparse.RawDescriptionHelpFormatter,
epilog="""
Examples:
python scripts/checklist.py . # Core checks only
python scripts/checklist.py . --url http://localhost:3000 # Include performance
"""
)
parser.add_argument("project", help="Project path to validate")
parser.add_argument("--url", help="URL for performance checks (lighthouse, playwright)")
parser.add_argument("--skip-performance", action="store_true", help="Skip performance checks even if URL provided")
args = parser.parse_args()
project_path = Path(args.project).resolve()
if not project_path.exists():
print_error(f"Project path does not exist: {project_path}")
sys.exit(1)
print_header("🚀 ANTIGRAVITY KIT - MASTER CHECKLIST")
print(f"Project: {project_path}")
print(f"URL: {args.url if args.url else 'Not provided (performance checks skipped)'}")
results = []
# Run core checks
print_header("📋 CORE CHECKS")
for name, script_path, required in CORE_CHECKS:
script = project_path / script_path
result = run_script(name, script, str(project_path))
results.append(result)
# If required check fails, stop
if required and not result["passed"] and not result.get("skipped"):
print_error(f"CRITICAL: {name} failed. Stopping checklist.")
print_summary(results)
sys.exit(1)
# Run performance checks if URL provided
if args.url and not args.skip_performance:
print_header("⚡ PERFORMANCE CHECKS")
for name, script_path, required in PERFORMANCE_CHECKS:
script = project_path / script_path
result = run_script(name, script, str(project_path), args.url)
results.append(result)
# Print summary
all_passed = print_summary(results)
sys.exit(0 if all_passed else 1)
if __name__ == "__main__":
main()