Check committed file sizes

check.go

@@ -55,6 +55,19 @@ type ValidationSpec struct {
 	// ModuleDistribution selects checks for files that affect module-source
 	// distribution. Its zero value disables those checks.
 	ModuleDistribution ModuleDistributionValidationSpec
+	// FileSize selects a committed-file size check. Nil disables it; an empty
+	// object selects the 1,000,000-byte default.
+	FileSize *FileSizeValidationSpec
+}
+
+// FileSizeValidationSpec selects a maximum size for each committed blob.
+type FileSizeValidationSpec struct {
+	// LimitBytes is the maximum decimal byte count. Nil selects 1,000,000;
+	// zero is a zero-byte limit, and negative values are invalid.
+	LimitBytes *int64
+	// Exclusions are literal repository-relative file or directory paths.
+	// A directory exclusion includes committed descendants.
+	Exclusions []string
 }
 
 // ModuleDistributionValidationSpec selects independent module-source
@@ -99,6 +112,9 @@ type GoValidationSpec struct {
 // Validation.ModuleDistribution.LocalReplacements parses committed go.mod
 // declarations, including nested modules, and rejects filesystem replacements
 // after workspace-file inspection. Its zero value disables that check.
+// Validation.FileSize checks each selected committed blob after module
+// distribution checks. Its nil value disables size checks; an empty object
+// enables the default limit.
 // The zero values of all selections preserve the ordinary suite. If
 // Build selects targets, Check builds them after validation in temporary
 // storage outside the worktree, then rechecks
@@ -117,6 +133,7 @@ func Check(ctx context.Context, request ReleaseRequest) (Candidate, error) {
 }
 
 func candidateRequest(request ReleaseRequest) candidate.Request {
+	fileSize := internalFileSizeSettings(request.Validation.FileSize)
 	result := candidate.Request{
 		RepositoryDir: request.RepositoryDir,
 		Product:       request.Product,
@@ -130,6 +147,7 @@ func candidateRequest(request ReleaseRequest) candidate.Request {
 				WorkspaceFiles:    request.Validation.ModuleDistribution.WorkspaceFiles,
 				LocalReplacements: request.Validation.ModuleDistribution.LocalReplacements,
 			},
+			FileSize: fileSize,
 		},
 		AdditionalChecks: candidateChecks(request.AdditionalChecks),
 		AfterValidate:    internalbuild.CandidateCallback(internalBuildSpec(request.Build), request.Output),
@@ -141,6 +159,21 @@ func candidateRequest(request ReleaseRequest) candidate.Request {
 	return result
 }
 
+func internalFileSizeSettings(spec *FileSizeValidationSpec) *validation.FileSizeSettings {
+	if spec == nil {
+		return nil
+	}
+	var limitBytes *int64
+	if spec.LimitBytes != nil {
+		limit := *spec.LimitBytes
+		limitBytes = &limit
+	}
+	return &validation.FileSizeSettings{
+		LimitBytes: limitBytes,
+		Exclusions: append([]string(nil), spec.Exclusions...),
+	}
+}
+
 func candidateChecks(checks func(context.Context, Candidate) error) func(context.Context, candidate.Candidate) error {
 	if checks == nil {
 		return nil