@@ -15,6 +15,24 @@ die() {
1515
1616command -v rg > /dev/null 2>&1 || die " ripgrep is required"
1717
18+ # A Rust `#[path]` can make a production module compile source outside the
19+ # roots scanned below. Permit exactly one such escape: the runtime module's
20+ # unit tests, guarded by `cfg(test)` and rooted under the repository test tree.
21+ # Keeping the declaration exact makes deleting the cfg guard or adding another
22+ # unscanned production input fail closed.
23+ external_module_paths=$( rg --with-filename --no-heading --color never \
24+ --glob ' *.rs' -- ' ^#\[path[[:space:]]*=[[:space:]]*"\.\./' src || true)
25+ [[ " $external_module_paths " == \
26+ ' src/runtime/module.rs:#[path = "../../tests/unit/runtime_module/tests.rs"]' ]] \
27+ || die ' production sources contain an unauthenticated external module path'
28+ rg --quiet --multiline --pcre2 -- \
29+ ' ^#\[cfg\(test\)\]\n#\[path = "\.\./\.\./tests/unit/runtime_module/tests\.rs"\]\nmod tests;$' \
30+ src/runtime/module.rs \
31+ || die ' external runtime unit tests are not protected by the exact cfg(test) boundary'
32+ [[ -f tests/unit/runtime_module/tests.rs \
33+ && ! -L tests/unit/runtime_module/tests.rs ]] \
34+ || die ' external runtime unit-test module must be a regular repository file'
35+
1836scan_roots=(src web/wasm/src Cargo.toml web/wasm/Cargo.toml)
1937while IFS= read -r build_script; do
2038 scan_roots+=(" $build_script " )
0 commit comments