Add hardcoded URL checker

.github/workflows/check-hardcoded-urls.yml

@@ -0,0 +1,12 @@
+name: Check for hardcoded URLs
+
+on:
+  pull_request:
+
+jobs:
+  hardcoded-urls:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: List hardcoded URLs
+        run: ./scripts/list-hardcoded-urls.sh

README.md

@@ -129,6 +129,17 @@ We welcome contributions from the community! 🚀
 2. Create a feature branch
 3. Submit a pull request
 
+### Checking for hardcoded URLs
+
+Run the following script to detect any hardcoded `localhost` references before committing code:
+
+```bash
+./scripts/list-hardcoded-urls.sh
+```
+
+The script lists offending lines and exits with a nonzero status if any are found.
+Existing references known to be safe are tracked in `scripts/hardcoded-url-allowlist.txt`.
+
 ## License
 MIT License – Feel free to modify and share. 📜
 

scripts/hardcoded-url-allowlist.txt

@@ -0,0 +1,5 @@
+FEDERATION_GUIDE.md
+backend/federation/federationSyncJob.js
+frontend/user_login.js
+frontend/federationStatusCLI.js
+README.md

scripts/list-hardcoded-urls.sh

@@ -0,0 +1,20 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+ALLOWLIST_FILE="$(dirname "$0")/hardcoded-url-allowlist.txt"
+
+matches=$(grep -R --line-number --exclude-dir=node_modules --exclude-dir=.git -E "http://localhost|localhost:5000" || true)
+matches=$(echo "$matches" | grep -v 'scripts/list-hardcoded-urls.sh' || true)
+
+if [[ -f "$ALLOWLIST_FILE" ]]; then
+  matches=$(echo "$matches" | grep -F -v -f "$ALLOWLIST_FILE" || true)
+fi
+
+if [[ -n "$matches" ]]; then
+  echo "$matches"
+  echo "Hardcoded localhost URLs detected."
+  exit 1
+else
+  echo "No hardcoded localhost URLs found."
+  exit 0
+fi