fix: harden community gate — discover meta-less dirs, broaden secret scan, utf-8, escape table pipes

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: LeoRoccoBreedt

community/scripts/build_index.py

@@ -47,23 +47,33 @@ def load_entries(community_dir: Path) -> list[dict]:
     return entries
 
 
+def _escape_pipes(value: str) -> str:
+    return value.replace("|", "\\|")
+
+
 def _links_cell(links: dict) -> str:
-    parts = [f"[{label}]({url})" for label, url in links.items() if str(url).startswith("http")]
+    parts = [
+        f"[{_escape_pipes(str(label))}]({url})"
+        for label, url in links.items()
+        if str(url).startswith("http")
+    ]
     return "<br>".join(parts) if parts else ""
 
 
 def _row(entry: dict) -> str:
-    project = f"[{entry['title']}]({entry['slug']}/)"
+    project = f"[{_escape_pipes(entry['title'])}]({entry['slug']}/)"
     author = (
-        f"[@{entry['author']}](https://github.com/{entry['author']})" if entry["author"] else ""
+        f"[@{_escape_pipes(entry['author'])}](https://github.com/{entry['author']})"
+        if entry["author"]
+        else ""
     )
-    tags = ", ".join(str(t) for t in entry["tags"])
+    tags = _escape_pipes(", ".join(str(t) for t in entry["tags"]))
     hosted = "hosted" if entry["hosted"] else ""
     cells = [
         project,
         author,
-        entry["description"],
-        entry["opik_platform"],
+        _escape_pipes(entry["description"]),
+        _escape_pipes(entry["opik_platform"]),
         _links_cell(entry["links"]),
         hosted,
         tags,
@@ -83,12 +93,14 @@ def render_index(entries: list[dict]) -> str:
 
 
 def write_index(community_dir: Path) -> None:
-    (community_dir / "README.md").write_text(render_index(load_entries(community_dir)))
+    (community_dir / "README.md").write_text(
+        render_index(load_entries(community_dir)), encoding="utf-8"
+    )
 
 
 def check_index(community_dir: Path) -> bool:
     readme = community_dir / "README.md"
-    current = readme.read_text() if readme.is_file() else ""
+    current = readme.read_text(encoding="utf-8") if readme.is_file() else ""
     return current == render_index(load_entries(community_dir))
 
 

community/scripts/check_entry.py

@@ -17,12 +17,11 @@
 
 
 def discover_entries(community_dir: Path) -> list[Path]:
-    entries = [
+    return [
         child
         for child in sorted(community_dir.iterdir())
-        if child.is_dir() and child.name not in RESERVED_DIRS and (child / "meta.yaml").is_file()
+        if child.is_dir() and child.name not in RESERVED_DIRS
     ]
-    return entries
 
 
 def check_entry(entry: Path) -> list[str]:

community/scripts/entry_rules.py

@@ -121,6 +121,7 @@ def validate_proof(entry: Path) -> list[str]:
 _FOLDER_NAME_RE = re.compile(r"^[a-z0-9]+(?:_[a-z0-9]+)+$")
 _SECRET_PATTERNS = [
     re.compile(r"sk-ant-[A-Za-z0-9_-]{20,}"),
+    re.compile(r"sk-(?:proj|svcacct)-[A-Za-z0-9_-]{20,}"),
     re.compile(r"sk-[A-Za-z0-9]{20,}"),
     re.compile(r"""OPIK_API_KEY\s*[=:]\s*["'][^"']+["']"""),
 ]

community/scripts/tests/test_build_index.py

@@ -42,3 +42,20 @@ def test_check_index_detects_stale(tmp_path: Path):
     write_entry(tmp_path, slug="jane_agent")
     (tmp_path / "README.md").write_text("# stale\n")
     assert check_index(tmp_path) is False
+
+
+def test_pipe_in_description_is_escaped_in_table_row(tmp_path: Path):
+    write_entry(
+        tmp_path,
+        slug="jane_agent",
+        meta={"description": "Handles A | B and C | D cases"},
+    )
+    out = render_index(load_entries(tmp_path))
+    table_line = next(line for line in out.splitlines() if line.startswith("| [Real"))
+    assert "A \\| B and C \\| D" in table_line
+    # Stripping the leading/trailing "| " and splitting on " | " must yield
+    # exactly 7 columns; escaped pipes must not be miscounted as separators.
+    stripped = table_line.strip()
+    assert stripped.startswith("| ") and stripped.endswith(" |")
+    inner = stripped[2:-2]
+    assert len(inner.split(" | ")) == 7

community/scripts/tests/test_check_entry.py

@@ -28,6 +28,29 @@ def test_discover_skips_reserved_dirs(tmp_path: Path):
     assert found == {"jane_agent"}
 
 
+def test_discover_includes_dir_without_meta_yaml(tmp_path: Path):
+    entry = write_entry(tmp_path, slug="no_meta_here")
+    (entry / "meta.yaml").unlink()
+    found = {p.name for p in discover_entries(tmp_path)}
+    assert "no_meta_here" in found
+
+
+def test_check_entry_flags_missing_meta_yaml(tmp_path: Path):
+    entry = write_entry(tmp_path, slug="no_meta_here")
+    (entry / "meta.yaml").unlink()
+    errors = check_entry(entry)
+    assert any("missing meta.yaml" in e for e in errors)
+
+
+def test_main_no_args_returns_one_when_entry_missing_meta_yaml(tmp_path: Path, monkeypatch):
+    entry = write_entry(tmp_path, slug="no_meta_here")
+    (entry / "meta.yaml").unlink()
+    import check_entry as check_entry_module
+
+    monkeypatch.setattr(check_entry_module, "COMMUNITY_DIR", tmp_path)
+    assert main([]) == 1
+
+
 def test_main_returns_zero_for_valid_entry(tmp_path: Path):
     entry = write_entry(tmp_path)
     assert main([str(entry)]) == 0

community/scripts/tests/test_entry_rules.py

@@ -158,6 +158,14 @@ def test_hardcoded_key_is_flagged(tmp_path: Path):
     assert any("hardcoded" in e.lower() or "key" in e.lower() for e in validate_no_secrets(entry))
 
 
+def test_sk_proj_key_is_flagged(tmp_path: Path):
+    entry = write_entry(
+        tmp_path,
+        code={"app.py": 'client = OpenAI(api_key="sk-proj-abcdefghijklmnopqrstuvwxyz012345")\n'},
+    )
+    assert any("hardcoded" in e.lower() or "key" in e.lower() for e in validate_no_secrets(entry))
+
+
 def test_hosted_without_opik_usage_is_error(tmp_path: Path):
     entry = write_entry(
         tmp_path,