scripts/utilities/validate_gitignore.py

#!/usr/bin/env python3
"""
Validation script to ensure no sensitive files are tracked in git
and that .gitignore rules are working properly.
"""

import re
import subprocess
import sys
def run_command(cmd):
    """Run a shell command and return output."""
    try:
        result = subprocess.run(cmd, shell=True, capture_output=True, text=True)
        return result.stdout.strip(), result.returncode
    except Exception as e:
        print(f"Error running command '{cmd}': {e}")
        return "", 1

def check_sensitive_files():
    """Check if any sensitive files are currently tracked."""
    print("Checking for sensitive files in git...")
    
    # Patterns for sensitive files
    sensitive_patterns = [
        r'\.env$',
        r'\.key$', 
        r'\.pem$',
        r'api_keys',
        r'credentials',
        r'secrets',
        r'\.log$',
        r'__pycache__',
        r'\.pyc$'
    ]
    
    # Get all tracked files
    tracked_files, _ = run_command("git ls-files")
    
    issues = []
    for file in tracked_files.split('\n'):
        if file:
            for pattern in sensitive_patterns:
                if re.search(pattern, file):
                    issues.append(f"Sensitive file tracked: {file}")
    
    return issues

def check_gitignore_effectiveness():
    """Check that .gitignore is properly ignoring expected files."""
    print("Checking .gitignore effectiveness...")
    
    # Check if cache directories would be ignored
    test_cases = [
        "__pycache__/test.pyc",
        ".env.local", 
        "temp.log",
        ".DS_Store",
        ".vscode/settings.json"
    ]
    
    issues = []
    for test_file in test_cases:
        output, code = run_command(f"git check-ignore {test_file}")
        if code != 0:
            issues.append(f"File should be ignored but isn't: {test_file}")
    
    return issues

def main():
    """Main validation function."""
    print("=== Git Ignore Validation ===\n")
    
    all_issues = []
    
    # Check for sensitive files
    sensitive_issues = check_sensitive_files()
    all_issues.extend(sensitive_issues)
    
    # Check gitignore effectiveness  
    gitignore_issues = check_gitignore_effectiveness()
    all_issues.extend(gitignore_issues)
    
    # Report results
    if all_issues:
        print("❌ Issues found:")
        for issue in all_issues:
            print(f"  - {issue}")
        sys.exit(1)
    else:
        print("✅ All checks passed!")
        print("  - No sensitive files are tracked")
        print("  - .gitignore rules are working properly")
        sys.exit(0)

if __name__ == "__main__":
    main()