humanethq / airgap-check

What it does

• Manifest & lockfile scan. Inspects requirements*.txt, pyproject.toml, Pipfile, package.json, Cargo.toml, go.mod, and Gemfile (promoting [tool.uv] default-groups, preserving [tool.setuptools.dynamic.optional-dependencies], skipping devDepend
• Source patterns & heuristics. Flags known runtime fetch calls (nltk.download(), spacy.load(), gtts.gTTS(), from_pretrained(), tiktoken.get_encoding(), whisper.load_model(), easyocr.Reader(), RapidOCR(), PaddleOCR(), FlagModel/FlagReranker,
• Python and Node --run. Runs your app or probe inside docker run --rm --network none (overriding baked ENTRYPOINT, logging to a fsync-backed bind-mounted host file with docker rm -f cleanup on timeout, and waiting briefly via /proc for detac
• --fix & custom rules. Prints Dockerfile ENV flags (including OPENAI_AGENTS_DISABLE_TRACING=1, CHROMA_TELEMETRY_IMPL=none) and pre-warming commands, and supports repo overrides via .airgap-check.json or --rules.
• .env keys. Classifies .env* key names and git ls-files status only (excluding non-secret LLM token-limit knobs); secret values are never read or logged.