.

* chore: add suspicious_patterns to .scripts/pre-hook and not-suspicious filter

* rm: kill annoying checkpatterns job

* chore: cleanup

---------

Co-authored-by: RichardAH <[email protected]>

.githooks/pre-commit

@@ -0,0 +1,12 @@
+#!/bin/bash
+
+# Pre-commit hook that runs the suspicious patterns check on staged files
+
+# Get the repository's root directory
+repo_root=$(git rev-parse --show-toplevel)
+
+# Run the suspicious patterns script in pre-commit mode
+"$repo_root/suspicious_patterns.sh" --pre-commit
+
+# Exit with the same code as the script
+exit $?

.githooks/setup.sh

@@ -0,0 +1,4 @@
+#!/bin/bash
+
+echo "Configuring git to use .githooks directory..."
+git config core.hooksPath .githooks

.github/workflows/checkpatterns.yml

@@ -1,20 +0,0 @@
-name: checkpatterns
-
-on: [push, pull_request]
-
-jobs:
-  checkpatterns:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-
-      - name: Check for suspicious patterns
-        run: |
-          if [ -f "suspicious_patterns.sh" ]; then
-            bash suspicious_patterns.sh
-          else
-            echo "Warning: suspicious_patterns.sh not found, skipping check"
-            # Still exit with success for compatibility with dependent jobs
-            exit 0
-          fi

README.md

@@ -69,3 +69,5 @@ git-subtree. See those directories' README files for more details.
 - **Supporting Wallets**: A list of wallets that support XAH and Xahau-based assets.
   - [Xaman](https://xaman.app)
   - [Crossmark](https://crossmark.io)
+
+test

src/ripple/beast/unit_test/match.hpp

@@ -94,6 +94,14 @@ selector::operator()(suite_info const& s)
             return ! s.manual();
         }
 
+        // check start of name
+        if (s.name().starts_with(pat_) || s.full_name().starts_with(pat_))
+        {
+            // Don't change the mode so that the partial pattern can match
+            // more than once
+            return !s.manual();
+        }
+
         return false;
 
     case suite:

src/test/app/NFTokenBurn_test.cpp

@@ -26,7 +26,7 @@
 
 namespace ripple {
 
-class NFTokenBurn_test : public beast::unit_test::suite
+class NFTokenBurn0_test : public beast::unit_test::suite
 {
     // Helper function that returns the owner count of an account root.
     static std::uint32_t
@@ -786,22 +786,69 @@ class NFTokenBurn_test : public beast::unit_test::suite
         testBurnTooManyOffers(features);
     }
 
+protected:
+    void
+    run(std::uint32_t instance, bool last = false)
+    {
+        using namespace test::jtx;
+        static FeatureBitset const all{
+            supported_amendments() - featureXahauGenesis};
+        static FeatureBitset const fixNFTDir{fixNFTokenDirV1};
+
+        static std::array<FeatureBitset, 4> const feats{
+            all - fixNonFungibleTokensV1_2 - fixNFTDir - fixNFTokenRemint,
+            all - fixNonFungibleTokensV1_2 - fixNFTokenRemint,
+            all - fixNFTokenRemint,
+            all};
+
+        if (BEAST_EXPECT(instance < feats.size()))
+        {
+            testWithFeats(feats[instance]);
+        }
+        BEAST_EXPECT(!last || instance == feats.size() - 1);
+    }
+
 public:
     void
     run() override
     {
-        using namespace test::jtx;
-        FeatureBitset const all{supported_amendments() - featureXahauGenesis};
-        FeatureBitset const fixNFTDir{fixNFTokenDirV1};
-
-        testWithFeats(
-            all - fixNonFungibleTokensV1_2 - fixNFTDir - fixNFTokenRemint);
-        testWithFeats(all - fixNonFungibleTokensV1_2 - fixNFTokenRemint);
-        testWithFeats(all - fixNFTokenRemint);
-        testWithFeats(all);
+        run(0);
     }
 };
 
-BEAST_DEFINE_TESTSUITE_PRIO(NFTokenBurn, tx, ripple, 3);
+class NFTokenBurn1_test : public NFTokenBurn0_test
+{
+public:
+    void
+    run() override
+    {
+        NFTokenBurn0_test::run(1);
+    }
+};
+
+class NFTokenBurn2_test : public NFTokenBurn0_test
+{
+public:
+    void
+    run() override
+    {
+        NFTokenBurn0_test::run(2);
+    }
+};
+
+class NFTokenBurn3_test : public NFTokenBurn0_test
+{
+public:
+    void
+    run() override
+    {
+        NFTokenBurn0_test::run(3, true);
+    }
+};
+
+BEAST_DEFINE_TESTSUITE_PRIO(NFTokenBurn0, tx, ripple, 3);
+BEAST_DEFINE_TESTSUITE_PRIO(NFTokenBurn1, tx, ripple, 3);
+BEAST_DEFINE_TESTSUITE_PRIO(NFTokenBurn2, tx, ripple, 3);
+BEAST_DEFINE_TESTSUITE_PRIO(NFTokenBurn3, tx, ripple, 3);
 
 }  // namespace ripple

src/test/app/NFToken_test.cpp

@@ -27,7 +27,7 @@
 
 namespace ripple {
 
-class NFToken_test : public beast::unit_test::suite
+class NFToken0_test : public beast::unit_test::suite
 {
     FeatureBitset const disallowIncoming{featureDisallowIncoming};
 
@@ -6843,23 +6843,74 @@ class NFToken_test : public beast::unit_test::suite
 
 public:
     void
-    run() override
+    run(std::uint32_t instance, bool last = false)
     {
         using namespace test::jtx;
-        FeatureBitset const all{supported_amendments()};
-        FeatureBitset const fixNFTDir{fixNFTokenDirV1};
+        static FeatureBitset const all{supported_amendments()};
+        static FeatureBitset const fixNFTDir{fixNFTokenDirV1};
 
-        testWithFeats(
-            all - fixNFTDir - fixNonFungibleTokensV1_2 - fixNFTokenRemint);
-        testWithFeats(
+        static std::array<FeatureBitset, 5> const feats{
+            all - fixNFTDir - fixNonFungibleTokensV1_2 - fixNFTokenRemint,
             all - disallowIncoming - fixNonFungibleTokensV1_2 -
-            fixNFTokenRemint);
-        testWithFeats(all - fixNonFungibleTokensV1_2 - fixNFTokenRemint);
-        testWithFeats(all - fixNFTokenRemint);
-        testWithFeats(all);
+                fixNFTokenRemint,
+            all - fixNonFungibleTokensV1_2 - fixNFTokenRemint,
+            all - fixNFTokenRemint,
+            all};
+
+        if (BEAST_EXPECT(instance < feats.size()))
+        {
+            testWithFeats(feats[instance]);
+        }
+        BEAST_EXPECT(!last || instance == feats.size() - 1);
+    }
+
+    void
+    run() override
+    {
+        run(0);
     }
 };
 
-BEAST_DEFINE_TESTSUITE_PRIO(NFToken, tx, ripple, 2);
+class NFToken1_test : public NFToken0_test
+{
+    void
+    run() override
+    {
+        NFToken0_test::run(1);
+    }
+};
+
+class NFToken2_test : public NFToken0_test
+{
+    void
+    run() override
+    {
+        NFToken0_test::run(2);
+    }
+};
+
+class NFToken3_test : public NFToken0_test
+{
+    void
+    run() override
+    {
+        NFToken0_test::run(3);
+    }
+};
+
+class NFToken4_test : public NFToken0_test
+{
+    void
+    run() override
+    {
+        NFToken0_test::run(4, true);
+    }
+};
+
+BEAST_DEFINE_TESTSUITE_PRIO(NFToken0, tx, ripple, 2);
+BEAST_DEFINE_TESTSUITE_PRIO(NFToken1, tx, ripple, 2);
+BEAST_DEFINE_TESTSUITE_PRIO(NFToken2, tx, ripple, 2);
+BEAST_DEFINE_TESTSUITE_PRIO(NFToken3, tx, ripple, 2);
+BEAST_DEFINE_TESTSUITE_PRIO(NFToken4, tx, ripple, 2);
 
 }  // namespace ripple

src/test/app/Offer_test.cpp

@@ -27,7 +27,7 @@
 namespace ripple {
 namespace test {
 
-class Offer_test : public beast::unit_test::suite
+class Offer0_test : public beast::unit_test::suite
 {
     XRPAmount
     reserve(jtx::Env& env, std::uint32_t count)
@@ -5394,26 +5394,77 @@ public:
     }
 
     void
-    run() override
+    run(std::uint32_t instance, bool last = false)
     {
         using namespace jtx;
-        FeatureBitset const all{supported_amendments() - featureXahauGenesis};
-        FeatureBitset const flowCross{featureFlowCross};
-        FeatureBitset const takerDryOffer{fixTakerDryOfferRemoval};
-        FeatureBitset const rmSmallIncreasedQOffers{fixRmSmallIncreasedQOffers};
-        FeatureBitset const immediateOfferKilled{featureImmediateOfferKilled};
+        static FeatureBitset const all{
+            supported_amendments() - featureXahauGenesis};
+        static FeatureBitset const flowCross{featureFlowCross};
+        static FeatureBitset const takerDryOffer{fixTakerDryOfferRemoval};
+        static FeatureBitset const rmSmallIncreasedQOffers{
+            fixRmSmallIncreasedQOffers};
+        static FeatureBitset const immediateOfferKilled{
+            featureImmediateOfferKilled};
 
-        testAll(all - takerDryOffer - immediateOfferKilled);
-        testAll(all - flowCross - takerDryOffer - immediateOfferKilled);
-        testAll(all - flowCross - immediateOfferKilled);
-        testAll(all - rmSmallIncreasedQOffers - immediateOfferKilled);
-        testAll(all);
+        static std::array<FeatureBitset, 5> const feats{
+            all - takerDryOffer - immediateOfferKilled,
+            all - flowCross - takerDryOffer - immediateOfferKilled,
+            all - flowCross - immediateOfferKilled,
+            all - rmSmallIncreasedQOffers - immediateOfferKilled,
+            all};
+
+        if (BEAST_EXPECT(instance < feats.size()))
+        {
+            testAll(feats[instance]);
+        }
+        BEAST_EXPECT(!last || instance == feats.size() - 1);
+    }
+
+    void
+    run() override
+    {
+        run(0);
         testFalseAssert();
-        testOfferID(all);
     }
 };
 
-class Offer_manual_test : public Offer_test
+class Offer1_test : public Offer0_test
+{
+    void
+    run() override
+    {
+        Offer0_test::run(1);
+    }
+};
+
+class Offer2_test : public Offer0_test
+{
+    void
+    run() override
+    {
+        Offer0_test::run(2);
+    }
+};
+
+class Offer3_test : public Offer0_test
+{
+    void
+    run() override
+    {
+        Offer0_test::run(3);
+    }
+};
+
+class Offer4_test : public Offer0_test
+{
+    void
+    run() override
+    {
+        Offer0_test::run(4, true);
+    }
+};
+
+class Offer_manual_test : public Offer0_test
 {
     void
     run() override
@@ -5433,7 +5484,11 @@ class Offer_manual_test : public Offer_test
     }
 };
 
-BEAST_DEFINE_TESTSUITE_PRIO(Offer, tx, ripple, 4);
+BEAST_DEFINE_TESTSUITE_PRIO(Offer0, tx, ripple, 4);
+BEAST_DEFINE_TESTSUITE_PRIO(Offer1, tx, ripple, 4);
+BEAST_DEFINE_TESTSUITE_PRIO(Offer2, tx, ripple, 4);
+BEAST_DEFINE_TESTSUITE_PRIO(Offer3, tx, ripple, 4);
+BEAST_DEFINE_TESTSUITE_PRIO(Offer4, tx, ripple, 4);
 BEAST_DEFINE_TESTSUITE_MANUAL_PRIO(Offer_manual, tx, ripple, 20);
 
 }  // namespace test

src/test/app/SetHookTSH_test.cpp

@@ -39,7 +39,7 @@ namespace test {
             return;          \
     }
 
-struct SetHookTSH_test : public beast::unit_test::suite
+struct SetHookTSH0_test : public beast::unit_test::suite
 {
 private:
     const uint64_t tshSTRONG = 0;
@@ -5537,18 +5537,48 @@ private:
 
 public:
     void
-    run() override
+    run(std::uint32_t instance, bool last = false)
     {
         using namespace test::jtx;
-        auto const sa = supported_amendments();
-        testTSH(sa - fixXahauV1 - fixXahauV2);
-        testTSH(sa - fixXahauV2);
-        testTSH(sa);
-        testEmittedTxn(sa);
+        static FeatureBitset const all{supported_amendments()};
+
+        static std::array<FeatureBitset, 3> const feats{
+            all,
+            all - fixXahauV1 - fixXahauV2,
+            all - fixXahauV2,
+        };
+
+        if (BEAST_EXPECT(instance < feats.size()))
+        {
+            testTSH(feats[instance]);
+        }
+        if (instance == 0)
+        {
+            testEmittedTxn(feats[instance]);
+        }
+        BEAST_EXPECT(!last || instance == feats.size() - 1);
+    }
+    void
+    run() override
+    {
+        run(0);
     }
 };
+#define SETHOOKTSH_TEST(i, last)                         \
+    class SetHookTSH##i##_test : public SetHookTSH0_test \
+    {                                                    \
+        void                                             \
+        run() override                                   \
+        {                                                \
+            SetHookTSH0_test::run(i, last);              \
+        }                                                \
+    };
+SETHOOKTSH_TEST(1, false)
+SETHOOKTSH_TEST(2, false)
 
-BEAST_DEFINE_TESTSUITE(SetHookTSH, app, ripple);
+BEAST_DEFINE_TESTSUITE_PRIO(SetHookTSH0, app, ripple, 2);
+BEAST_DEFINE_TESTSUITE_PRIO(SetHookTSH1, app, ripple, 2);
+BEAST_DEFINE_TESTSUITE_PRIO(SetHookTSH2, app, ripple, 2);
 
 }  // namespace test
-}  // namespace ripple
+}  // namespace ripple

src/test/app/SetHook_test.cpp

@@ -75,7 +75,7 @@ using JSSMap =
     [[maybe_unused]] std::string const x##_hash_str = to_string(x##_hash);     \
     [[maybe_unused]] Keylet const x##_keylet = keylet::hookDefinition(x##_hash);
 
-class SetHook_test : public beast::unit_test::suite
+class SetHook0_test : public beast::unit_test::suite
 {
 private:
     // helper
@@ -12847,20 +12847,33 @@ public:
         test_util_verify(features);   //
     }
 
+public:
+    void
+    run(std::uint32_t instance, bool last = false)
+    {
+        using namespace test::jtx;
+        static FeatureBitset const all{supported_amendments()};
+
+        static std::array<FeatureBitset, 6> const feats{
+            all,
+            all - fixXahauV2,
+            all - fixXahauV1 - fixXahauV2,
+            all - fixXahauV1 - fixXahauV2 - fixNSDelete,
+            all - fixXahauV1 - fixXahauV2 - fixNSDelete - fixPageCap,
+            all - fixXahauV1 - fixXahauV2 - fixNSDelete - fixPageCap -
+                featureHookCanEmit};
+
+        if (BEAST_EXPECT(instance < feats.size()))
+        {
+            testWithFeatures(feats[instance]);
+        }
+        BEAST_EXPECT(!last || instance == feats.size() - 1);
+    }
+
     void
     run() override
     {
-        using namespace test::jtx;
-        auto const sa = supported_amendments();
-        testWithFeatures(sa);
-        testWithFeatures(sa - fixXahauV2);
-        testWithFeatures(sa - fixXahauV1 - fixXahauV2);
-        testWithFeatures(sa - fixXahauV1 - fixXahauV2 - fixNSDelete);
-        testWithFeatures(
-            sa - fixXahauV1 - fixXahauV2 - fixNSDelete - fixPageCap);
-        testWithFeatures(
-            sa - fixXahauV1 - fixXahauV2 - fixNSDelete - fixPageCap -
-            featureHookCanEmit);
+        run(0);
     }
 
 private:
@@ -13000,7 +13013,29 @@ private:
 
     HASH_WASM(accept2);
 };
-BEAST_DEFINE_TESTSUITE(SetHook, app, ripple);
+
+#define SETHOOK_TEST(i, last)                      \
+    class SetHook##i##_test : public SetHook0_test \
+    {                                              \
+        void                                       \
+        run() override                             \
+        {                                          \
+            SetHook0_test::run(i, last);           \
+        }                                          \
+    };
+
+SETHOOK_TEST(1, false)
+SETHOOK_TEST(2, false)
+SETHOOK_TEST(3, false)
+SETHOOK_TEST(4, false)
+SETHOOK_TEST(5, true)
+
+BEAST_DEFINE_TESTSUITE_PRIO(SetHook0, app, ripple, 2);
+BEAST_DEFINE_TESTSUITE_PRIO(SetHook1, app, ripple, 2);
+BEAST_DEFINE_TESTSUITE_PRIO(SetHook2, app, ripple, 2);
+BEAST_DEFINE_TESTSUITE_PRIO(SetHook3, app, ripple, 2);
+BEAST_DEFINE_TESTSUITE_PRIO(SetHook4, app, ripple, 2);
+BEAST_DEFINE_TESTSUITE_PRIO(SetHook5, app, ripple, 2);
 }  // namespace test
 }  // namespace ripple
 #undef M

src/test/app/XahauGenesis_test.cpp

@@ -5715,7 +5715,7 @@ struct XahauGenesis_test : public beast::unit_test::suite
     }
 };
 
-BEAST_DEFINE_TESTSUITE(XahauGenesis, app, ripple);
+BEAST_DEFINE_TESTSUITE_PRIO(XahauGenesis, app, ripple, 2);
 
 }  // namespace test
 }  // namespace ripple

suspicious_patterns.sh

@@ -1,25 +1,123 @@
 #!/bin/bash
 
+# Exit on error, undefined variables, and pipe failures
+set -euo pipefail
+
+# Enable debug mode if DEBUG environment variable is set
+[[ "${DEBUG:-}" == "1" ]] && set -x
+
+# This script prevents accidental commits of XRPL/Ripple cryptographic keys
+# It searches for:
+#   - Secret seeds (s...) - can derive keypairs
+#   - Private keys (p...) - validator private keys! 
+#   - Raw key material (02/03/ED + hex) - compressed public keys or Ed25519 keys
+#
+# Usage:
+#   suspicious_patterns.sh           # Check last commit (for CI)
+#   suspicious_patterns.sh --pre-commit  # Check staged files (for pre-commit hook)
+#
+# WARNING: If this catches a real key in CI, that key is already compromised!
+# The key has been pushed to the git history and must be immediately decommissioned.
+# 
+# To mark keys as safe, add comment: // not-suspicious
+# Files excluded: See exclude_files array below
+# Lines excluded: Matching exclude_pattern regex below
+
+# Pattern for lines to exclude from checking
+exclude_pattern="public_key|not-suspicious"
+
+# Array of files to exclude from checking (paths relative to repo root)
+exclude_files=(
+  "src/test/app/Import_test.cpp"
+  "cfg/validators-example.txt"
+)
+
 # Get the repository's root directory
 repo_root=$(git rev-parse --show-toplevel)
 
-# Get a list of files changed in the last commit with their relative paths
-files_changed=$(git diff --name-only --relative HEAD~1 HEAD)
+# Determine which files to check based on context:
+# 1. Pre-commit hook: Check staged files before commit
+# 2. GitHub PR: Check all files changed in the PR (HEAD is a synthetic merge commit)
+# 3. Regular push/CI: Check files in the last real commit
+if [[ "${1:-}" == "--pre-commit" ]]; then
+  # Pre-commit mode: Check what's about to be committed
+  files_changed=$(git diff --cached --name-only --relative)
+  mode="staged files"
+else
+  # CI mode - need to handle two different scenarios
+  if [[ "${GITHUB_EVENT_NAME:-}" == "pull_request" ]]; then
+    # GitHub PR event: HEAD is a synthetic merge commit created by GitHub
+    # that merges PR branch into base. Must diff against base to get only PR files.
+    base_ref="${GITHUB_BASE_REF:-dev}"
+    
+    # Ensure we have the base branch (GitHub Actions shallow clone might not have it)
+    if ! git rev-parse --verify "origin/$base_ref" >/dev/null 2>&1; then
+      echo "Fetching base branch origin/$base_ref..."
+      git fetch --depth=1 origin "$base_ref"
+    fi
+    
+    # Since there's no merge base in shallow clones, we need to be creative
+    # Save current HEAD, switch to base, then diff the trees
+    current_head=$(git rev-parse HEAD)
+    echo "Comparing against base branch origin/$base_ref..."
+    
+    # Get the tree objects to compare (this works even without shared history)
+    base_tree=$(git rev-parse "origin/$base_ref^{tree}")
+    head_tree=$(git rev-parse "$current_head^{tree}")
+    
+    # Compare the two trees directly
+    files_changed=$(git diff --name-only "$base_tree" "$head_tree")
+    mode="PR changes"
+  else
+    # Regular push event: Check the actual commit that was pushed
+    # Using 'git show' works even with shallow clones (no HEAD~1 needed)
+    # See: https://github.com/Xahau/xahaud/actions/runs/15492442104/job/43620965462#step:3:11
+    files_changed=$(git show --name-only --pretty=format:'' HEAD)
+    mode="last commit"
+  fi
+fi
+
+echo "Checking $mode for suspicious patterns..."
+
+# Show additional info in CI or when verbose mode is enabled
+if [[ -n "${CI:-}" ]] || [[ "${VERBOSE:-}" == "1" ]]; then
+  if [[ "${1:-}" != "--pre-commit" ]]; then
+    echo "Commit: $(git rev-parse HEAD)"
+  fi
+  echo "Files to check:"
+  if [[ -n "$files_changed" ]]; then
+    echo "$files_changed" | nl
+  else
+    echo "  (none)"
+  fi
+fi
 
 # Loop through each file and search for the patterns
 for file in $files_changed; do
-  # Skip if the file is Import_test.cpp (exact filename match regardless of path)
-  if [[ "$(basename "$file")" == "Import_test.cpp" ]]; then
-    continue
-  fi
+  # Check if file should be excluded (exact path match)
+  for excluded in "${exclude_files[@]}"; do
+    if [[ "$file" == "$excluded" ]]; then
+      continue 2  # Continue outer loop
+    fi
+  done
 
   # Construct the absolute path
   absolute_path="$repo_root/$file"
 
   # Check if the file exists (it might have been deleted)
   if [ -f "$absolute_path" ]; then
-    # Search the file for the given patterns, but exclude lines containing 'public_key'
-    grep_output=$(grep -n -E '(([^rpshnaf39wBUDNEGHJKLM4PQRST7VWXYZ2bcdeCg65jkm8oFqi1tuvAxyz]|^)(s|p)[rpshnaf39wBUDNEGHJKLM4PQRST7VWXYZ2bcdeCg65jkm8oFqi1tuvAxyz]{25,60}([^(]|$)))|([^A-Fa-f0-9](02|03|ED)[A-Fa-f0-9]{64})' "$absolute_path" | grep -v "public_key")
+    # Get file content based on mode
+    if [[ "${1:-}" == "--pre-commit" ]]; then
+      # For staged files, use git show with the staging area
+      file_content=$(git show ":$file" 2>/dev/null)
+    else
+      # For committed files, read from disk
+      file_content=$(cat "$absolute_path")
+    fi
+    
+    # Search the file content for the given patterns, but exclude lines matching the exclusion pattern
+    # Use || true to prevent grep from failing the script when no matches are found
+    grep_output=$(echo "$file_content" | grep -n -E '(([^rpshnaf39wBUDNEGHJKLM4PQRST7VWXYZ2bcdeCg65jkm8oFqi1tuvAxyz]|^)(s|p)[rpshnaf39wBUDNEGHJKLM4PQRST7VWXYZ2bcdeCg65jkm8oFqi1tuvAxyz]{25,60}([^(]|$)))|([^A-Fa-f0-9](02|03|ED)[A-Fa-f0-9]{64})' | grep -vE "$exclude_pattern" || true)
 
     # Check if grep found any matches
     if [ ! -z "$grep_output" ]; then