push_to_github.py

#!/usr/bin/env python3
"""
push_to_github.py — One-shot, clean publisher for Just Obfuscate.

What it does
------------
1. Asks for your GitHub repo URL, username, email, and a Personal Access Token.
2. Copies the current project into a TEMP staging dir, **excluding**:
     - build/runtime junk  (node_modules, dist, .tanstack, .output, .wrangler,
       .sandbox-build, .nitro, *.log, *.tsbuildinfo, .DS_Store)
     - local secrets       (.env, .env.*, .dev.vars)
     - editor / OS noise   (.vscode, .idea, *.swp)
     - Lovable-internal    (.workspace/, .agents/, .claude/, AGENTS.md)
     - Existing .git/      (we start a fresh history with YOUR identity, so
                            no "lovable-bot" or any other author leaks)
3. Initialises a fresh git repo with YOUR name + email as the commit author,
   creates ONE clean commit on `main`, and **force-pushes** to your remote
   using the token (sent over HTTPS, never written to disk).

Run it
------
    python scripts/push_to_github.py

Tip: drop the values into env vars to skip the prompts:
    GH_REPO=https://github.com/me/just-obfuscate.git
    GH_USER=me
    GH_EMAIL=me@example.com
    GH_TOKEN=ghp_xxxxxxxxxxxx
    python scripts/push_to_github.py
"""

from __future__ import annotations

import os
import shutil
import subprocess
import sys
import tempfile
from getpass import getpass
from pathlib import Path
from urllib.parse import urlparse, urlunparse

# ---------- styling helpers --------------------------------------------------

C_RESET = "\033[0m"
C_DIM   = "\033[2m"
C_BOLD  = "\033[1m"
C_PINK  = "\033[38;5;213m"
C_CYAN  = "\033[38;5;87m"
C_GREEN = "\033[38;5;120m"
C_YELL  = "\033[38;5;221m"
C_RED   = "\033[38;5;203m"


def banner() -> None:
    print(f"""{C_PINK}{C_BOLD}
   ╭──────────────────────────────────────────────────────────────╮
   │                                                              │
   │   🛡️   Just Obfuscate  ·  Clean GitHub Publisher             │
   │        no bot authors · no internal files · one commit       │
   │                                                              │
   ╰──────────────────────────────────────────────────────────────╯
{C_RESET}""")


def info(msg: str)  -> None: print(f"{C_CYAN}›{C_RESET} {msg}")
def ok(msg: str)    -> None: print(f"{C_GREEN}✓{C_RESET} {msg}")
def warn(msg: str)  -> None: print(f"{C_YELL}!{C_RESET} {msg}")
def die(msg: str)   -> None: print(f"{C_RED}✗ {msg}{C_RESET}"); sys.exit(1)


# ---------- exclusion rules --------------------------------------------------

EXCLUDE_DIRS = {
    "node_modules", "dist", "dist-ssr", ".output", ".nitro", ".tanstack",
    ".wrangler", ".vinxi", ".sandbox-build", ".cache", ".turbo", ".next",
    ".git", ".vscode", ".idea", ".workspace", ".agents", ".claude",
    "__pycache__", ".pytest_cache", ".mypy_cache", ".ruff_cache",
    "justob.egg-info", "build", ".venv", "venv",
}
EXCLUDE_FILES_EXACT = {
    ".DS_Store", ".env", ".dev.vars", "AGENTS.md", "tsconfig.tsbuildinfo",
    "bun.lockb",
}
EXCLUDE_FILE_SUFFIXES = (
    ".log", ".swp", ".swo", ".pyc", ".tsbuildinfo",
)
EXCLUDE_FILE_PREFIXES = (
    ".env.",
)


def _should_skip(rel_parts: tuple[str, ...]) -> bool:
    for part in rel_parts:
        if part in EXCLUDE_DIRS:
            return True
    leaf = rel_parts[-1]
    if leaf in EXCLUDE_FILES_EXACT:
        return True
    if any(leaf.endswith(s) for s in EXCLUDE_FILE_SUFFIXES):
        return True
    if any(leaf.startswith(p) for p in EXCLUDE_FILE_PREFIXES):
        return True
    return False


def copy_clean(src_root: Path, dst_root: Path) -> tuple[int, int]:
    """Copy `src_root` into `dst_root` skipping anything in the exclusion rules."""
    copied, skipped = 0, 0
    for path in src_root.rglob("*"):
        rel = path.relative_to(src_root)
        parts = rel.parts
        if _should_skip(parts):
            skipped += 1
            continue
        target = dst_root / rel
        if path.is_dir():
            target.mkdir(parents=True, exist_ok=True)
        else:
            target.parent.mkdir(parents=True, exist_ok=True)
            shutil.copy2(path, target)
            copied += 1
    return copied, skipped


# ---------- git helpers ------------------------------------------------------

def run(cmd: list[str], cwd: Path, env: dict | None = None, check: bool = True) -> subprocess.CompletedProcess:
    full_env = os.environ.copy()
    if env:
        full_env.update(env)
    res = subprocess.run(cmd, cwd=cwd, env=full_env, capture_output=True, text=True)
    if check and res.returncode != 0:
        sys.stdout.write(res.stdout)
        sys.stderr.write(res.stderr)
        die(f"command failed: {' '.join(cmd)}")
    return res


def build_authed_url(repo_url: str, username: str, token: str) -> str:
    """Inject the token into an https URL — only kept in the local process memory."""
    parsed = urlparse(repo_url)
    if parsed.scheme not in ("http", "https"):
        die("repo URL must be https:// (SSH not supported by this script)")
    host = parsed.hostname or "github.com"
    port = f":{parsed.port}" if parsed.port else ""
    netloc = f"{username}:{token}@{host}{port}"
    return urlunparse(parsed._replace(netloc=netloc))


# ---------- main -------------------------------------------------------------

def ask(prompt: str, env_key: str, secret: bool = False) -> str:
    val = os.environ.get(env_key, "").strip()
    if val:
        info(f"{prompt}  {C_DIM}(from ${env_key}){C_RESET}")
        return val
    return (getpass(f"  {prompt}: ") if secret else input(f"  {prompt}: ")).strip()


def main() -> None:
    banner()

    project_root = Path(__file__).resolve().parent.parent
    info(f"Project root: {C_BOLD}{project_root}{C_RESET}")

    repo_url = ask("GitHub repo URL  (https://github.com/<you>/<repo>.git)", "GH_REPO")
    username = ask("GitHub username",                                         "GH_USER")
    email    = ask("Commit email     (used as git author)",                   "GH_EMAIL")
    token    = ask("Personal Access Token  (repo scope)",                     "GH_TOKEN", secret=True)
    branch   = os.environ.get("GH_BRANCH", "main").strip() or "main"
    message  = os.environ.get("GH_MESSAGE", "🛡️ Just Obfuscate — public release").strip()

    if not (repo_url and username and email and token):
        die("missing one of: repo URL / username / email / token")
    if not repo_url.startswith(("http://", "https://")):
        die("repo URL must start with https://")

    print()
    info("Staging a clean copy…")
    with tempfile.TemporaryDirectory(prefix="justob-publish-") as tmp:
        staging = Path(tmp) / "repo"
        staging.mkdir()
        copied, skipped = copy_clean(project_root, staging)
        ok(f"copied {copied} files · skipped {skipped} internal/build entries")

        info("Initialising fresh git history with YOUR identity…")
        env = {
            "GIT_AUTHOR_NAME": username,
            "GIT_AUTHOR_EMAIL": email,
            "GIT_COMMITTER_NAME": username,
            "GIT_COMMITTER_EMAIL": email,
        }
        run(["git", "init", "-q", "-b", branch], staging)
        run(["git", "config", "user.name",  username], staging)
        run(["git", "config", "user.email", email],    staging)
        run(["git", "add", "-A"],                       staging)
        run(["git", "commit", "-q", "-m", message],     staging, env=env)
        ok(f"created single commit on '{branch}' as {username} <{email}>")

        authed = build_authed_url(repo_url, username, token)
        run(["git", "remote", "add", "origin", authed], staging)

        info(f"Force-pushing → {repo_url}  (branch: {branch})")
        push = run(["git", "push", "-u", "origin", branch, "--force"], staging, check=False)
        if push.returncode != 0:
            sys.stdout.write(push.stdout)
            sys.stderr.write(push.stderr)
            die("push failed — check the token (needs `repo` scope) and that the repo exists")

        # scrub the authed URL from the remote so the token isn't left on disk anywhere
        run(["git", "remote", "set-url", "origin", repo_url], staging, check=False)
        ok("pushed cleanly — token wiped from local remote config")

    print()
    print(f"{C_GREEN}{C_BOLD}🎉 Done.{C_RESET}  Your repo now contains ONE commit by {C_BOLD}{username}{C_RESET}.")
    print(f"{C_DIM}   Open: {repo_url.replace('.git','')}{C_RESET}")
    print(f"{C_DIM}   Next: hit Deploy on Vercel → https://vercel.com/new{C_RESET}\n")


if __name__ == "__main__":
    try:
        main()
    except KeyboardInterrupt:
        print()
        die("cancelled")