a ,׀jR@sdZddlZddlZddlZddlZddlZddlZddlmZddlm Z ddl m Z e dZ e dZ e dZe d d Zd Zd Zd ddddedddZddZddZe dZdZddZd,ddZd Zd!Zd"d#Zd$d%Zd&d'Zd-d(d)Zd*d Z e!d+kre"e dS).aRegenerate the dashboard and publish it to GitHub as index.html. Runs on the hour and half hour, 06:00-23:00 (SoccerPublishDashboard). Nothing here trades. The trigger is deliberately aligned to :00/:30 rather than an arbitrary offset so a reader knows when to expect a fresh page -- note the RUN starts then, and the published page lands 2-4 minutes later once the resolve steps and the render have finished. WHY THE SECRET SCAN IS A HARD GATE. When a human ran this by hand, someone eyeballed the file before it went public. Unattended hourly publishing removes that check, so it is replaced with an automated one that ABORTS the push rather than warning: the API-Football key is hardcoded in at least five source files and .env holds Kalshi/Poly-US/pinnapi credentials, so a future dashboard change that happens to echo a config value would otherwise publish it silently. A missed publish costs an hour of staleness; a leaked key costs a rotation and lives forever in the git history. TOKEN HANDLING. GITHUB_TOKEN is read from .env at run time and used only as a one-shot push URL with credential.helper disabled, so it is never written into the clone's git config or the OS credential store. It is redacted from all output. GIT_TERMINAL_PROMPT=0 makes auth failures fail fast instead of blocking on a prompt that cannot render in a scheduled task (that hang cost 5 minutes on 2026-08-09). ENCRYPTED AT REST (2026-08-13). The Pages site and the repo behind it are both world-readable, so the page is AES-256-GCM encrypted at publish time and decrypted in the browser from a passphrase (DASH_PASSWORD in .env). See encrypt_page for what that does and does not protect -- in short, it defends against a passer-by reading the URL, not against a determined offline attacker with a weak passphrase, and it cannot un-publish the snapshots already pushed in the clear. NO-OP WHEN UNCHANGED. If the regenerated dashboard's PLAINTEXT is identical to what is already published, nothing is committed -- otherwise the repo would collect 18 empty-diff commits a day. The comparison is on a plaintext hash embedded in the published page, because a fresh salt and IV make the ciphertext differ on every single run. Usage: python main\publish_dashboard.py [--dry] N)datetime)Path)AESGCMz E:\soccerzdashboard.htmlz.envz.publishzfootball-stuffz"github.com/lsmyrtaj/football-stuffmainz\b[0-9a-f]{32,}\bz7gh[pousr]_[A-Za-z0-9]{20,}|github_pat_[A-Za-z0-9_]{20,}z"-----BEGIN [A-Z ]*PRIVATE KEY-----z[\w.\-]+@[\w\-]+\.\w{2,}z [A-Za-z]:\z>(?i)\b(secret|token|password|passwd|api[_-]?key)\b\s*[:=]\s*\S)zlong hex secretz github tokenz private keyz email addressz windows pathZ assignmentcCsg}z|tjddD]f}|}|r|dsd|vr:q|dd\}}|dd}t|dkr|||fqWntyYn0|S) zEvery value in .env, so the scan blocks OUR actual credentials verbatim. Short values are skipped -- a 6-character setting would match half the page and block every publish. utf-8encoding#="' ) ENV read_text splitlinesstrip startswithsplitlenappendOSError)outlnkvr#E:\soccer\main\publish_dashboard.pyliteral_secretsMs  rcCsdzLtjddD]6}|}||dr|dddWSqWnty^Yn0dS)Nrrr r )rrrrrrr)keyrrrrenvbs  r!z.publish_err_last_emailrc Cszhtjdddd}t|dt|dkr4|dnd}}ddl}||krf||tdkrfWd SWnttt fyYn0zt j dt td ddl}dd lm}dd lm}m} m} |r| sWd S||d } d|| d<|| | d<| d<|dd.} | || | || | Wdn1s<0Yddl}tj|d|ddWdSty} z*tdt| jd| dWYd} ~ d Sd} ~ 00dS)aEmail that the published page has gone stale, at most every ALERT_EVERY_H. Rate limited by a marker file keyed on the subject: this runs every 30 minutes, and an alert that arrives 48 times a day is one that gets filtered, which would leave us exactly where we started. rr r rNiFr)MIMEText) EMAIL_ADDRESSEMAIL_RECIPIENTEMAIL_APP_PASSWORDhtmlz%[soccer] dashboard NOT publishing -- ZSubjectZFromZTozsmtp.gmail.comiTz) (could not send stale-dashboard alert: : )) ALERT_MARKrrfloatrtime ALERT_EVERY_Hr ValueError IndexErrorsyspathinsertstrROOTsmtplibZemail.mime.textr$ daily_signalsr%r&r'ZSMTP_SSLZloginZsendmailZ as_string write_text Exceptionprinttype__name__)ZsubjectZ body_htmlprevZlast_tsZlast_subZ_tr6r$r%r&r'msgZsrverrr alert_staleqs>&    2 r@Tc Csg}tD]P\}}t||}|r t|dtr:|dn t|d}|||ddfq |rtD]$\}}||vrh|d|dfqh|S)zBReturn list of (label, sample) hits. Empty list = safe to publish.rNz .env value ) FORBIDDENitemsrefindall isinstancer4rr) textZ include_envhitslabelZpatmsnamevalrrrscans "rOia Dashboard

Soccer dashboard

Decrypted in your browser. Nothing is sent anywhere.
cCstdtd}}tjd|d|tdd}t|||dd}dd }t d | d || d || d || dt tS)a!Wrap `html` as an AES-256-GCM payload the browser decrypts on unlock. Salt and IV are fresh per publish, so the ciphertext differs every run even when the content does not -- which is exactly why the no-op check compares the PLAINTEXT hash instead of the published bytes. rsha256r )ZdklenNcSst|dS)Nascii)base64 b64encodedecode)rawrrr zencrypt_page..Z __PLAINHASH__Z__SALT__Z__IV__Z__CT__Z __ITERS__) osurandomhashlibZ pbkdf2_hmacencode PBKDF2_ITERSrZencrypt _LOCK_PAGEreplacer4)r(password plain_hashZsaltZivr ZctZb64rrr encrypt_pages"rccCs tt|ddS)a~Fingerprint of the plaintext, embedded in the published page to give the no-op check something stable to compare against. BASE64, NOT HEX, deliberately. A 64-char hex digest matches the scan's 'long hex secret' pattern, so a hex marker makes the published page look like it carries a leaked key the moment anyone points the scan at the payload rather than the plaintext -- which is a reasonable-looking hardening that would then abort every publish forever with a baffling error. Standard base64, not base64url, so the alphabet has no '-' and the marker can never accidentally close the HTML comment. rrS)rTrUr\rQr]ZdigestrV)r(rrr plain_marker)s rdcCs2|s dStd|jdd}|r.|dSdS)zEMarker of the plaintext behind the currently published page, or None.Nz/rrr )existsrEsearchrgroup)targetrKrrrpublished_plain_hash9s  ricCsZtj||dditdjddidd}|jp0d|jp8d}|rL||d}|j|fS) NTrZZGIT_TERMINAL_PROMPT0)cwdZcapture_outputrHr!Ztimeoutr#rB) subprocessrun __import__environstdoutstderrr` returncoder)argsrltokenprrrrrnBs  rnc Cs<dtjv}td}z,tjdttdddl m }|WnDt y}z,t d|dt|ddWYd}~n d}~00t tjttdd g\}}|dkrt d|d |ddt tjttdd d g\}}|dkrdSt gd?td@t d/dAdBdAdCdDdEdF|gt| d6\}}|dkrdG|vrt d|dH|dddSt d/dAdIdJ|tgt| d6\}}|dkrt d|dK|dddSt d|dLt| dMt|dNtdS)ONz--dryz%Y-%m-%d %H:%Mrr)resolve_pending_bets[z$] resolve step failed (continuing): zresolve_live_data.pyz)] resolve_live_data failed (continuing): z dashboard.pyz--quietz] dashboard.py failed rc=r)i,zdashboard.py failedz*The dashboard build itself failed with rc=z+. The published page is stale.

iz
r z] no dashboard.html producedzno dashboard producedz8dashboard.py exited cleanly but wrote no dashboard.html.rrz=] ABORT: dashboard contains material that must not be public:z zpublish blocked: zkThe dashboard was rebuilt but NOT published, because it contains something that must not go public:

z
css"|]\}}d|d|VqdS)zz : Nr).0rJsamplerrr szmain..z

The published page is now stale. Fix the source of that content in dashboard.py and the next run will publish normally.Z DASH_PASSWORDz>] no DASH_PASSWORD in .env -- refusing to publish in the clearzno DASH_PASSWORDzDASH_PASSWORD is missing from .env, so publishing was refused rather than push the page unencrypted. The published page is stale until that is set.Z GITHUB_TOKENz+] no GITHUB_TOKEN in .env -- cannot publishzhttps://x-access-token:@z.gitT)parentsexist_okgitZclonezhttps://)ruz] clone failed: Zfetchorigin)rlruresetz--hardzorigin/ index.htmlz!] unchanged -- nothing to publishz] DRY RUN -- would publish z bytes (z plaintext, encrypted))raddr)rlz-czuser.name=lirsezuser.email=lirsenm@gmail.comZcommitz-mzDashboard snapshot znothing to commitz] commit failed: zcredential.helper=pushz] push failed: z ] published z bytes encrypted (z plaintext) -> ) r1argvrZnowstrftimer2r3r4r5r7rwr9r:rn executabler@DASHrerrOjoinr!rdrcREPOCLONEparentmkdirBRANCHrir8r)ZdryZstamprwr?Zrcrr(rIrJr{rarbZpayloadruZurlrhrrrrLs    6   "      "       __main__)T)NN)#__doc__rTr\rZrErmr1rpathlibrZ+cryptography.hazmat.primitives.ciphers.aeadrr5rrrrrescaperCrr!r+r.r@rOr^r_rcrdrirnrr<exitrrrrsL(        & ![