refactor(ci): centralize binary scan config and remove policy bash bridges

Author: github-actions[bot]

tools/ci/bin/run.sh

@@ -46,6 +46,57 @@ run_or_fail() {
   fi
 }
 
+run_policy_runner_bridge() {
+  local policy_check_id="$1"
+  local policy_out_dir="$2"
+  local summary_message="$3"
+  local fallback_evidence="$4"
+
+  mkdir -p "${ROOT_DIR}/${policy_out_dir}"
+
+  local policy_exit=0
+  if ! ci_run_capture "${summary_message}" dotnet "${ROOT_DIR}/tools/ci/checks/PolicyRunner/bin/Release/net10.0/PolicyRunner.dll" --check-id "${policy_check_id}" --repo-root "${ROOT_DIR}" --out-dir "${policy_out_dir}"; then
+    policy_exit=1
+  fi
+
+  local policy_result_json="${ROOT_DIR}/${policy_out_dir}/result.json"
+  if [[ ! -f "${policy_result_json}" ]]; then
+    ci_result_add_violation "CI-POLICY-001" "fail" "PolicyRunner did not produce result.json" "${policy_out_dir}/result.json"
+    ci_result_append_summary "${summary_message} failed (missing result.json)."
+    return 1
+  fi
+
+  local findings=0
+  local has_fail=0
+  while IFS= read -r violation; do
+    local rule_id severity message
+    rule_id="$(jq -r '.rule_id' <<< "$violation")"
+    severity="$(jq -r '.severity' <<< "$violation")"
+    message="$(jq -r '.message' <<< "$violation")"
+
+    mapfile -t evidence_paths < <(jq -r '.evidence_paths[]' <<< "$violation")
+    if [[ "${#evidence_paths[@]}" -eq 0 ]]; then
+      evidence_paths=("${fallback_evidence}")
+    fi
+
+    ci_result_add_violation "$rule_id" "$severity" "$message" "${evidence_paths[@]}"
+    findings=$((findings + 1))
+    if [[ "$severity" == "fail" ]]; then
+      has_fail=1
+    fi
+  done < <(jq -c '.rule_violations[]' "${policy_result_json}")
+
+  if [[ "$findings" -eq 0 ]]; then
+    ci_result_append_summary "${summary_message} passed."
+  else
+    ci_result_append_summary "${summary_message} violations: ${findings}"
+  fi
+
+  if [[ "$policy_exit" -ne 0 || "$has_fail" -eq 1 ]]; then
+    return 1
+  fi
+}
+
 build_validators() {
   run_or_fail "CI-SETUP-001" "Restore validator projects (locked mode)" dotnet restore --locked-mode "${ROOT_DIR}/tools/ci/checks/ResultSchemaValidator/ResultSchemaValidator.csproj"
   run_or_fail "CI-SETUP-001" "Build ResultSchemaValidator" dotnet build -c Release "${ROOT_DIR}/tools/ci/checks/ResultSchemaValidator/ResultSchemaValidator.csproj"
@@ -63,7 +114,7 @@ run_preflight() {
   run_or_fail "CI-PREFLIGHT-001" "Docs check" python3 "${ROOT_DIR}/tools/check-docs.py"
   run_or_fail "CI-PREFLIGHT-001" "Versioning guard" bash "${ROOT_DIR}/tools/versioning/check-versioning.sh"
   run_or_fail "CI-PREFLIGHT-001" "Format check" dotnet format "${ROOT_DIR}/FileClassifier.sln" --verify-no-changes
-  if ! ci_run_capture "Policy shell safety" bash "${ROOT_DIR}/tools/ci/policies/policy_shell_safety.sh"; then
+  if ! run_policy_runner_bridge "preflight" "artifacts/ci/_policy_preflight" "Policy shell safety" "tools/ci/bin/run.sh"; then
     return 1
   fi
   run_or_fail "CI-GRAPH-001" "CI graph assertion" bash "${ROOT_DIR}/tools/ci/bin/assert_ci_graph.sh"

tools/ci/checks/PolicyRunner/Program.cs

@@ -259,9 +259,9 @@ void EvaluateRegexLineRule(PolicyRule rule)
     foreach (var file in files)
     {
         var relFile = Rel(repoRootPath, file);
-        if (IsKnownBinaryPath(file))
+        if (IsConfiguredBinaryPath(file, rule.Params.BinaryExtensions))
         {
-            logger.Add($"SCAN_SKIP|rule_id={rule.RuleId}|file={relFile}|reason=known_binary_extension");
+            logger.Add($"SCAN_SKIP|rule_id={rule.RuleId}|file={relFile}|reason=configured_binary_extension");
             continue;
         }
 
@@ -692,42 +692,21 @@ static int LeadingSpaces(string input)
     return count;
 }
 
-static bool IsKnownBinaryPath(string path)
+static bool IsConfiguredBinaryPath(string path, IReadOnlyList<string> configuredExtensions)
 {
+    if (configuredExtensions.Count == 0)
+    {
+        return false;
+    }
+
     var ext = Path.GetExtension(path);
     if (string.IsNullOrWhiteSpace(ext))
     {
         return false;
     }
 
-    return ext.ToLowerInvariant() switch
-    {
-        ".dll" => true,
-        ".exe" => true,
-        ".pdb" => true,
-        ".so" => true,
-        ".dylib" => true,
-        ".a" => true,
-        ".o" => true,
-        ".class" => true,
-        ".jar" => true,
-        ".zip" => true,
-        ".gz" => true,
-        ".7z" => true,
-        ".tar" => true,
-        ".png" => true,
-        ".jpg" => true,
-        ".jpeg" => true,
-        ".gif" => true,
-        ".bmp" => true,
-        ".ico" => true,
-        ".pdf" => true,
-        ".woff" => true,
-        ".woff2" => true,
-        ".ttf" => true,
-        ".otf" => true,
-        _ => false
-    };
+    var normalized = ext.StartsWith(".", StringComparison.Ordinal) ? ext.ToLowerInvariant() : $".{ext.ToLowerInvariant()}";
+    return configuredExtensions.Any(configured => string.Equals(configured, normalized, StringComparison.Ordinal));
 }
 
 static (bool Ok, string[] Lines, string? ErrorCode) TryReadUtf8Lines(string filePath)
@@ -904,6 +883,7 @@ static bool IsKnownBinaryPath(string path)
                     "check_ids" or
                     "artifact_root" or
                     "scan_paths" or
+                    "binary_extensions" or
                     "regex_pattern" or
                     "max_inline_run_lines" or
                     "docs_paths" or
@@ -922,6 +902,11 @@ static bool IsKnownBinaryPath(string path)
                 CheckIds: GetStringSequence(paramsNode, "check_ids").OrderBy(static x => x, StringComparer.Ordinal).Distinct(StringComparer.Ordinal).ToList(),
                 ArtifactRoot: GetScalar(paramsNode, "artifact_root"),
                 ScanPaths: GetStringSequence(paramsNode, "scan_paths").OrderBy(static x => x, StringComparer.Ordinal).Distinct(StringComparer.Ordinal).ToList(),
+                BinaryExtensions: GetStringSequence(paramsNode, "binary_extensions")
+                    .Select(static extension => extension.StartsWith(".", StringComparison.Ordinal) ? extension.ToLowerInvariant() : $".{extension.ToLowerInvariant()}")
+                    .OrderBy(static x => x, StringComparer.Ordinal)
+                    .Distinct(StringComparer.Ordinal)
+                    .ToList(),
                 RegexPattern: GetScalar(paramsNode, "regex_pattern"),
                 MaxInlineRunLines: GetIntScalar(paramsNode, "max_inline_run_lines"),
                 DocsPaths: GetStringSequence(paramsNode, "docs_paths").OrderBy(static x => x, StringComparer.Ordinal).Distinct(StringComparer.Ordinal).ToList(),
@@ -991,6 +976,7 @@ internal sealed record RuleParams(
     IReadOnlyList<string> CheckIds,
     string? ArtifactRoot,
     IReadOnlyList<string> ScanPaths,
+    IReadOnlyList<string> BinaryExtensions,
     string? RegexPattern,
     int? MaxInlineRunLines,
     IReadOnlyList<string> DocsPaths,

tools/ci/policies/policy_artifact_contract.sh

@@ -8,6 +8,31 @@ rules:
     applies_to:
       - preflight
     params:
+      binary_extensions: &binary_extensions
+        - dll
+        - exe
+        - pdb
+        - so
+        - dylib
+        - a
+        - o
+        - class
+        - jar
+        - zip
+        - gz
+        - 7z
+        - tar
+        - png
+        - jpg
+        - jpeg
+        - gif
+        - bmp
+        - ico
+        - pdf
+        - woff
+        - woff2
+        - ttf
+        - otf
       scan_paths:
         - .github/workflows
       regex_pattern: 'continue-on-error:\s*true'
@@ -20,6 +45,7 @@ rules:
     applies_to:
       - preflight
     params:
+      binary_extensions: *binary_extensions
       scan_paths:
         - .github/workflows
       regex_pattern: '\|\|\s*true'
@@ -32,6 +58,7 @@ rules:
     applies_to:
       - preflight
     params:
+      binary_extensions: *binary_extensions
       scan_paths:
         - .github/workflows
         - tools/ci

tools/ci/policies/policy_shell_safety.sh

@@ -84,6 +84,13 @@
                   "minLength": 1
                 }
               },
+              "binary_extensions": {
+                "type": "array",
+                "items": {
+                  "type": "string",
+                  "pattern": "^\\.?[a-zA-Z0-9]+$"
+                }
+              },
               "regex_pattern": {
                 "type": "string",
                 "minLength": 1