Initial MolForge release (v1.0.0) #1
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Verify demo data is public only | |
| # Runs on every push / PR to catch accidental commits of confidential data. | |
| # The repo ships with 10 PUBLIC example compounds (FDA-approved drugs) so new | |
| # visitors can try the app immediately. This workflow verifies that only | |
| # whitelisted public compound names appear in the embedded data block. | |
| on: | |
| push: | |
| branches: [ main ] | |
| pull_request: | |
| branches: [ main ] | |
| jobs: | |
| verify: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Embedded data block must only contain whitelisted public compounds | |
| run: | | |
| set -e | |
| line=$(grep -n 'MOLFORGE_DATA_START' molforge_database.html | head -1 | cut -d: -f1) | |
| if [ -z "$line" ]; then | |
| echo "No data block found" | |
| exit 0 | |
| fi | |
| data_line=$(( line + 1 )) | |
| content=$(sed -n "${data_line}p" molforge_database.html) | |
| # Compound count = number of top-level {"id":"..."} records | |
| count=$(echo "$content" | grep -oE '"id":"demo_' | wc -l) | |
| echo "Found $count demo compound records." | |
| if [ "$count" -gt 30 ]; then | |
| echo "::error::Data block contains more than 30 demo compounds ($count). Reject." | |
| exit 1 | |
| fi | |
| # Only public drug names are allowed | |
| ALLOWED="Gefitinib|Erlotinib|Lapatinib|Osimertinib|Afatinib|Imatinib|Dasatinib|Nilotinib|Bosutinib|Ponatinib|Sorafenib|Sunitinib|Regorafenib|Pazopanib|Axitinib|Ruxolitinib|Tofacitinib|Baricitinib|Ibrutinib|Acalabrutinib|Palbociclib|Ribociclib|Crizotinib|Aspirin|Ibuprofen" | |
| names=$(echo "$content" | grep -oE '"name":"[A-Za-z0-9 _-]+"' | sed 's/"name":"//;s/"//') | |
| for n in $names; do | |
| if ! echo "$n" | grep -qE "^($ALLOWED)$"; then | |
| echo "::error::Disallowed compound name in data block: $n" | |
| echo "::error::Only public FDA-approved drug names are permitted: $ALLOWED" | |
| exit 1 | |
| fi | |
| done | |
| echo "OK — only whitelisted public compounds present." | |
| - name: No confidential identifiers anywhere in the HTML | |
| run: | | |
| set -e | |
| # Project/lab-specific identifiers should never appear | |
| BLOCKED="Mount Sinai|DYRK1A|wangl50|acc_sbdd|Minerva HPC|Wang Lab|confidential|internal use only" | |
| # Grep case-insensitive; filter out anything in comments that explicitly mentions "not confidential" | |
| if grep -iE "$BLOCKED" molforge_database.html | grep -ivE "not.{0,5}confidential"; then | |
| echo "::error::Found blocked identifier in molforge_database.html" | |
| exit 1 | |
| fi | |
| echo "OK — no confidential identifiers found." | |
| - name: Embedded demo kinase panel is a synthetic fixture only | |
| run: | | |
| set -e | |
| # The embedded panel should only reference the three public FDA-approved drugs. | |
| # Real experimental assay values or confidential compound IDs are forbidden. | |
| line=$(grep -n 'MOLFORGE_DEMO_KINASE_PANEL_START' molforge_database.html | head -1 | cut -d: -f1 || true) | |
| if [ -z "$line" ]; then | |
| echo "OK — no embedded demo panel present (acceptable)." | |
| else | |
| data_line=$(( line + 1 )) | |
| panel=$(sed -n "${data_line}p" molforge_database.html) | |
| # Compound names in the embedded panel must be whitelisted | |
| DEMO_PANEL_ALLOWED="Imatinib|Dasatinib|Gefitinib" | |
| # Extract the values inside "compounds":[ ... ], drop the "compounds": key itself | |
| panel_cpds=$(echo "$panel" | grep -oE '"compounds":\[[^]]+\]' | sed 's/^"compounds":\[//;s/\]$//' | tr ',' '\n' | sed 's/^"//;s/"$//') | |
| for n in $panel_cpds; do | |
| if ! echo "$n" | grep -qE "^($DEMO_PANEL_ALLOWED)$"; then | |
| echo "::error::Demo kinase panel contains disallowed compound: $n" | |
| exit 1 | |
| fi | |
| done | |
| echo "OK — embedded demo kinase panel contains only whitelisted public drugs." | |
| fi | |
| - name: No file attachments embedded | |
| run: | | |
| set -e | |
| # base64 data URLs of attached files would be massive | |
| # Only flag lines that look like "dataUrl":"data:..." | |
| if grep -oE '"dataUrl":"data:[^"]{200,}"' molforge_database.html; then | |
| echo "::error::Found embedded attachment data (dataUrl). Reject." | |
| exit 1 | |
| fi | |
| echo "OK — no file attachments embedded." |