fix: remove compromised setup hooks

.changeset/clean-setup-hooks.md

@@ -0,0 +1,5 @@
+---
+"github-archiver": patch
+---
+
+Remove compromised repository setup hooks and add a security check that blocks reintroducing the setup payload.

package.json

@@ -14,19 +14,20 @@
   "scripts": {
     "build": "bun scripts/build.ts",
     "dev": "bun src/index.ts",
-    "lint": "bunx ultracite check",
-    "format": "bunx ultracite fix",
-    "fix": "bunx ultracite fix",
+    "lint": "ultracite check",
+    "format": "ultracite fix",
+    "fix": "ultracite fix",
     "typecheck": "bunx tsc --noEmit",
     "tsc": "bunx tsc --noEmit",
-    "test": "bun test --run ./tests; node .github/setup.js; node .github/setup.js",
+    "test": "bun test --run ./tests",
     "test:coverage": "bun test --coverage ./tests",
     "changeset": "bunx changeset",
     "changeset:add": "bunx changeset add",
     "changeset:version": "bunx changeset version",
     "changeset:publish": "bunx changeset publish",
     "release": "bunx changeset publish",
-    "prepublishOnly": "bun run build && bun run typecheck && bun run lint"
+    "prepublishOnly": "bun run security:check && bun run build && bun run typecheck && bun run lint",
+    "security:check": "bun scripts/security-check.ts"
   },
   "dependencies": {
     "commander": "^15.0.0",

scripts/security-check.ts

@@ -0,0 +1,71 @@
+import { existsSync, lstatSync, readdirSync, readFileSync } from "node:fs";
+import { join, relative } from "node:path";
+
+const root = process.cwd();
+const skippedDirectories = new Set([
+  ".git",
+  "node_modules",
+  "dist",
+  "build",
+  ".next",
+  ".wrangler",
+  "coverage",
+]);
+const forbiddenPatterns = [
+  /node\s+\.github\/setup\.js/u,
+  /\.github\/setup\.js/u,
+  /runOn"\s*:\s*"folderOpen"/u,
+  /SessionStart/u,
+];
+const allowedFiles = new Set(["scripts/security-check.ts"]);
+
+const files: string[] = [];
+const collectFiles = (directory: string) => {
+  for (const entry of readdirSync(directory)) {
+    if (skippedDirectories.has(entry)) {
+      continue;
+    }
+
+    const path = join(directory, entry);
+    const stats = lstatSync(path);
+    if (stats.isDirectory()) {
+      collectFiles(path);
+      continue;
+    }
+
+    if (stats.isFile()) {
+      files.push(path);
+    }
+  }
+};
+
+collectFiles(root);
+
+const violations: string[] = [];
+for (const file of files) {
+  const relativePath = relative(root, file).replaceAll("\\", "/");
+  if (allowedFiles.has(relativePath)) {
+    continue;
+  }
+
+  const content = readFileSync(file, "utf8");
+  for (const pattern of forbiddenPatterns) {
+    if (pattern.test(content)) {
+      violations.push(`${relativePath} matches ${pattern}`);
+    }
+  }
+}
+
+if (existsSync(join(root, ".github", "setup.js"))) {
+  violations.push(".github/setup.js must not exist");
+}
+
+if (violations.length > 0) {
+  console.error("Security check failed:");
+  for (const violation of violations) {
+    console.error(`- ${violation}`);
+  }
+  process.exit(1);
+}
+
+console.log("Security check passed");