Public release release-b8454b34d38c

Source commit: b8454b34d38cc2ba0bd278e842060db45d091e1c

Public tree identity: sha256:69d6c8143bf6227e1bb07852aa94e8af9c26793eca252bb46788894f728cb6d2

scripts/release-source-scan.sh

@@ -0,0 +1,73 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+repo="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+cd "$repo"
+
+release_paths=(
+  Cargo.toml
+  Cargo.lock
+  README.md
+  crates
+  examples
+  private
+  scripts
+  vscode-extension
+)
+
+existing_release_paths=()
+for path in "${release_paths[@]}"; do
+  if [[ -e "$path" ]]; then
+    existing_release_paths+=("$path")
+  fi
+done
+
+prose_scan_paths=(
+  README.md
+  crates
+  examples
+  private
+  scripts
+  vscode-extension
+)
+
+existing_prose_scan_paths=()
+for path in "${prose_scan_paths[@]}"; do
+  if [[ -e "$path" ]]; then
+    existing_prose_scan_paths+=("$path")
+  fi
+done
+
+scan_globs=(
+  --glob '!**/target/**'
+  --glob '!**/node_modules/**'
+  --glob '!scripts/release-source-scan.sh'
+  --glob '!scripts/rename-to-clusterflux.sh'
+  --glob '!scripts/check-docs.js'
+)
+
+placeholder_pattern='debugger-gate|experiments/debugger-gate|CLUSTERFLUX-DEMO|device-code-placeholder|artifact://demo|vp-local-demo'
+if rg -n "${scan_globs[@]}" "$placeholder_pattern" "${existing_release_paths[@]}"; then
+  echo "release source scan failed: stale experiment/demo placeholder reference found" >&2
+  exit 1
+fi
+
+demo_setup_pattern='undocumented manual state|hidden setup|demo-only credentials?|hard-coded local paths?'
+if rg -n "${scan_globs[@]}" "$demo_setup_pattern" "${existing_prose_scan_paths[@]}"; then
+  echo "release source scan failed: demo requires hidden setup or demo-only state" >&2
+  exit 1
+fi
+
+hidden_local_pattern='file://|/home/[[:alnum:]_.-]+/|/Users/[[:alnum:]_.-]+/|C:\\Users\\|https?://(localhost|127\.0\.0\.1)[^[:space:]]*/artifacts/'
+if rg -n "${scan_globs[@]}" "$hidden_local_pattern" "${existing_release_paths[@]}"; then
+  echo "release source scan failed: hidden local path or local artifact URL found" >&2
+  exit 1
+fi
+
+public_wording_pattern='reddit|hacker news|lobsters|launch forum|traffic source|free tier'
+if rg -n "${scan_globs[@]}" "$public_wording_pattern" "${existing_prose_scan_paths[@]}"; then
+  echo "release source scan failed: public-facing launch-forum/free-tier wording found" >&2
+  exit 1
+fi
+
+echo "Release source scan passed"