releasekit/internal/validation/forbidden_files.go

package validation

import (
	"path"
	"strings"
)

func checkForbiddenFiles(tree *CandidateTree, names []string) error {
	var findings []Finding
	for _, name := range names {
		clean := path.Clean(name)
		if name == "" || path.IsAbs(name) || clean == "." || clean == ".." || strings.HasPrefix(clean, "../") {
			findings = append(findings, Finding{Path: name, Message: "expected a repository-relative file path"})
			continue
		}
		if _, exists := tree.Entry(clean); exists {
			findings = append(findings, Finding{Path: clean, Message: "file must be absent from the committed candidate"})
		}
	}
	if len(findings) == 0 {
		return nil
	}
	return &Failure{Check: ForbiddenFiles, Findings: findings}
}