🛡️ Sentinel: 검색 엔진 연동 정보 노출 방지 - #324

#!/usr/bin/env bash
set -euo pipefail

# JUnit 버전과 테스트 API 사용을 확인합니다.
rg -n -- 'junit:junit:' build.gradle
rg -n --glob '*.kt' \
  'Assert\.assertThrows|assertThrows|ExpectedException|`@RunWith`|`@Rule`|`@ClassRule`' .

# 필수 Security Scan gate와 Trivy 설정을 확인합니다.
fd --hidden --exclude .git -t f -e yml -e yaml . |
  xargs -r rg -n \
    'osv-scan|dependency-review|trivy-fs|--download-db-only|merge.*ref|base\.sha|continue-on-error|if:\s*false'

#!/usr/bin/env bash
set -u

printf '%s\n' '--- build.gradle ---'
cat -n build.gradle

printf '%s\n' '--- relevant diff ---'
git diff --unified=20 -- build.gradle

printf '%s\n' '--- JUnit-related test usage ---'
rg -n --glob '*.{java,kt,groovy}' \
  '(^|[^A-Za-z])(Assert\.)?(assertThrows|assertThat|assertTimeout|assertAll|assertDoesNotThrow|assertSame|assertNotEquals|assertArrayEquals|fail)\b|`@RunWith`|`@Rule`|`@ClassRule`|ExpectedException|org\.junit' . || true

printf '%s\n' '--- workflow and dependency files ---'
find . -path './.git' -prune -o -type f \( -name '*.yml' -o -name '*.yaml' -o -name 'build.gradle' -o -name 'gradle.properties' \) -print

printf '%s\n' '--- security workflow references ---'
find . -path './.git' -prune -o -type f \( -name '*.yml' -o -name '*.yaml' \) -print0 |
  xargs -0 -r rg -n -i \
  'osv[-_ ]scan|dependency[-_ ]review|trivy[-_ ]fs|download-db-only|merge[-_ ]ref|base\.sha|continue-on-error|if:\s*false' || true

printf '%s\n' '--- test files ---'
find . -path './.git' -prune -o -type f \( -name '*.java' -o -name '*.kt' \) -print

#!/usr/bin/env bash
set -u

printf '%s\n' '--- CI workflow ---'
cat -n .github/workflows/ci.yml

printf '%s\n' '--- complete test imports and JUnit calls ---'
rg -n --glob '*.kt' \
  '^(import org\.junit|import kotlin\.test)|\b(assert[A-Za-z]+|fail|Assume\.[A-Za-z]+)\s*\(' \
  src/test

printf '%s\n' '--- repository state ---'
git status --short
git branch --show-current
git diff --stat

printf '%s\n' '--- Kotlin test JUnit POM ---'
curl -fsSL \
  'https://repo1.maven.org/maven2/org/jetbrains/kotlin/kotlin-test-junit/1.3.72/kotlin-test-junit-1.3.72.pom' |
  sed -n '1,220p'

printf '%s\n' '--- JUnit 4.11 POM ---'
curl -fsSL \
  'https://repo1.maven.org/maven2/junit/junit/4.11/junit-4.11.pom' |
  sed -n '1,180p'

#!/usr/bin/env bash
set -u

printf '%s\n' '--- OSV findings for junit:junit ---'
curl -fsS -X POST 'https://api.osv.dev/v1/query' \
  -H 'Content-Type: application/json' \
  --data '{"package":{"ecosystem":"Maven","name":"junit:junit"},"version":"4.11"}' |
  jq -r '.vulns[]? | [.id, .summary, (.affected[].ranges[]?.events[]? | to_entries[] | "\(.key)=\(.value)")] | `@tsv`' || true

printf '%s\n' '--- OSV findings for junit:junit 4.12 ---'
curl -fsS -X POST 'https://api.osv.dev/v1/query' \
  -H 'Content-Type: application/json' \
  --data '{"package":{"ecosystem":"Maven","name":"junit:junit"},"version":"4.12"}' |
  jq -r '.vulns[]? | [.id, .summary, (.affected[].ranges[]?.events[]? | to_entries[] | "\(.key)=\(.value)")] | `@tsv`' || true

printf '%s\n' '--- Gradle wrapper version ---'
cat gradle/wrapper/gradle-wrapper.properties 2>/dev/null || true

printf '%s\n' '--- all GitHub workflow files ---'
find .github -type f -maxdepth 3 -print 2>/dev/null

curl -fsS 'https://api.osv.dev/v1/vulns/GHSA-269g-pwp5-87pp' |
  jq '{id, summary, severity, database_specific, affected}'