ace-git-secrets 0.13.3 → 0.15.5

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: d06686caf614eebf4e043e56c62db163171282382dd316111b2711a96e65daa0
-  data.tar.gz: 63569b69b08623283e2a3c0fb64577fb16f9b575c0ab3b12907af281bdab1c5b
+  metadata.gz: b2677579d3a4647ed578e0f420a7cdbab110d23c49a75d26a2b8027d65f1e26b
+  data.tar.gz: b6642ecb7c0cfebb8a54992bb505d7dd1952ad2098e375a7b3c9bea7977a9f54
 SHA512:
-  metadata.gz: 8e9502c0c010c389a6eab1199b019aed3330df84cec17dcee39cf176fbfcff46636c04704f8a737b977c48c1d5ec5305412d1f6f67115ce0b964fe434ad71028
-  data.tar.gz: bb408abe20607d0a8e4842a069f7a16e09cee0e33204537e0e9e5dc9d5bb8b7229466c02b137f1521b67291af23c89827f3c4d10679e920d6532dde7fbfd7dab
+  metadata.gz: df5160c60b3989700faa7a67f1e4f8c32f27b7e7dfbc35206693a81813382a9fcabeddd79f5429187444bc66220428341b5d8db429be648591438b6740eca3c0
+  data.tar.gz: 10d33ab4bb871ae5e96b7d058ec4c5d14785d62671714b91fc6f8619311e548c476bea32a58dec9a927de5a83530b7096ac315ef096822713209899c3138c078

data/CHANGELOG.md

@@ -7,6 +7,64 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.15.5] - 2026-04-20
+
+### Technical
+- Stabilized `TS-SECRETS-001` help-survey verification by checking explicit public-surface facts instead of an arbitrary observation line count.
+- Relaxed `TS-SECRETS-001` rewrite dry-run verification to reuse the canonical saved report captured by the prior scan goal instead of requiring a duplicate copy.
+- Clarified `TS-SECRETS-001` config-cascade verification so table/plain CLI override output is recognized as distinct from config-driven JSON output.
+- Allowed `TS-SECRETS-001` history-persistence verification to use later real scan artifacts as fallback post-removal evidence when the dedicated rescan capture is missing.
+
+## [0.15.4] - 2026-04-19
+
+### Fixed
+- Corrected the usage guide for JSON release-gate output and config-driven format defaults so docs match the current `scan` and `check-release` public output behavior.
+
+## [0.15.3] - 2026-04-18
+
+### Technical
+- Relaxed the retained help-survey verifier to accept the current five-line parity summary when it is grounded in captured help output and still proves `check-release` discovery plus config-driven whitelist behavior.
+
+## [0.15.2] - 2026-04-16
+
+### Fixed
+- Stopped forcing table output defaults in `scan` and `check-release`, allowing configured `output.format` values to drive the public CLI output contract consistently across normal and release checks.
+
+## [0.15.1] - 2026-04-16
+
+### Fixed
+- Tightened the focused config-cascade E2E to run `scan --verbose`, making output-format config effects visible and proving CLI precedence over user config with concrete stdout evidence.
+
+## [0.15.0] - 2026-04-15
+
+### Changed
+- Rewrote `TS-SECRETS-001` to public-surface goal style by aligning help/docs parity, narrowing brittle broad checks, shifting rewrite validation to saved-report artifacts, and removing the legacy error-handling TC from retained scope.
+- Added `TS-SECRETS-002-remediation-path` to validate the saved-report remediation flow (`scan -> revoke --scan-file -> rewrite-history --dry-run --scan-file`) with impact-first verification.
+
+## [0.14.3] - 2026-04-13
+
+### Fixed
+- Reworked `TS-SECRETS-001` history-persistence coverage to judge the repo outcome and runner observations instead of synthetic helper summaries, while still capturing the explicit removal/commit evidence needed for diagnosis.
+
+## [0.14.2] - 2026-04-13
+
+### Fixed
+- Hardened `TS-SECRETS-001` history-persistence capture so the removal/commit step emits the explicit evidence files required before the history rescan oracle runs.
+
+## [0.14.1] - 2026-04-13
+
+### Changed
+- Completed the batch i05 migration follow-through for this package and aligned it with the restarted `fast` / `feat` / `e2e` verification model.
+
+### Technical
+- Included in the coordinated assignment-driven patch release for batch i05 package updates.
+
+
+## [0.14.0] - 2026-04-12
+
+### Changed
+- Migrated package tests to the `fast` / `feat` / `e2e` model, moved deterministic coverage into `test/fast`, and updated scenario/docs testing contract guidance.
+
 ## [0.13.3] - 2026-03-29
 
 ### Technical

data/README.md

@@ -36,5 +36,13 @@
 
 **Coordinate with git workflow tools** - pair with [ace-bundle](../ace-bundle) for loading remediation workflows, [ace-git](../ace-git) for repository context before cleanup, and [ace-git-commit](../ace-git-commit) for follow-up commits after remediation work.
 
+## Testing Contract
+
+`ace-git-secrets` uses the restarted package testing model:
+
+- `ace-test ace-git-secrets` runs deterministic package tests (`test/fast`).
+- `ace-test ace-git-secrets feat` is reserved for deterministic feature-layer tests (`test/feat`) when present.
+- `ace-test-e2e ace-git-secrets` runs retained workflow scenarios (`test/e2e`).
+
 ---
 [Getting Started](docs/getting-started.md) | [Usage Guide](docs/usage.md) | [Handbook - Skills, Agents, Templates](docs/handbook.md) | Part of [ACE](https://github.com/cs3b/ace)

data/docs/getting-started.md

@@ -101,6 +101,14 @@ This is the simplest command to drop into release workflows or pre-publish check
 | Preview cleanup | `ace-git-secrets rewrite-history --dry-run --scan-file .ace-local/git-secrets/sessions/abc123-report.json` |
 | Block a release on findings | `ace-git-secrets check-release --strict` |
 
+## Package Testing
+
+When validating package changes:
+
+- `ace-test ace-git-secrets` runs deterministic `test/fast` coverage.
+- `ace-test ace-git-secrets feat` runs deterministic `test/feat` coverage when present.
+- `ace-test-e2e ace-git-secrets` runs retained workflow scenarios in `test/e2e`.
+
 ## What to try next
 
 - Add whitelist rules in `.ace/git-secrets/config.yml` for known documentation examples or test fixtures

data/docs/usage.md

@@ -3,8 +3,8 @@ doc-type: user
 title: ace-git-secrets Usage Guide
 purpose: CLI reference for ace-git-secrets
 ace-docs:
-  last-updated: 2026-03-22
-  last-checked: 2026-03-22
+  last-updated: 2026-04-19
+  last-checked: 2026-04-19
 ---
 
 # ace-git-secrets Usage Guide
@@ -42,6 +42,7 @@ Behavior:
 - Summary output goes to stdout by default
 - A full report is always saved to `.ace-local/git-secrets/sessions/`
 - The saved JSON report includes raw token values needed by `revoke` and `rewrite-history`
+- When `--format` is omitted, verbose stdout uses `output.format` from config before falling back to `table`
 
 Options:
 
@@ -171,8 +172,8 @@ ace-git-secrets check-release --strict
 ace-git-secrets check-release --format json
 ```
 
-Prefer exit codes for automation. `check-release --format json` currently includes banner text, so it is better suited to
-inspection than strict machine parsing.
+Prefer exit codes for pass/fail automation. Use `check-release --format json` when automation also needs the structured
+release-gate result; JSON output is emitted without banner text.
 
 ## Configuration
 
@@ -198,6 +199,9 @@ github:
   api_url: https://github.mycompany.com/api/v3
 ```
 
+The `output.format` value is used as the default stdout format for commands that support formatted output when their
+`--format` option is not provided.
+
 Use whitelist rules for known safe examples or fixtures. Keep real credentials out of the whitelist and revoke them
 instead.
 
@@ -251,6 +255,15 @@ Limit the scan scope for triage work:
 ace-git-secrets scan --since "6 months ago"
 ```
 
+## Package Test Commands
+
+Use the package-level test contract when validating this gem:
+
+- `ace-test ace-git-secrets` for deterministic `test/fast` coverage
+- `ace-test ace-git-secrets feat` for deterministic `test/feat` coverage when present
+- `ace-test ace-git-secrets all` for full package deterministic coverage
+- `ace-test-e2e ace-git-secrets` for retained workflow scenarios in `test/e2e`
+
 ## Exit Codes
 
 | Code | Meaning |

data/lib/ace/git/secrets/cli/commands/check_release.rb

@@ -18,7 +18,7 @@ module Ace
 
             option :strict, type: :boolean, default: false,
               desc: "Fail on medium confidence matches"
-            option :format, type: :string, aliases: ["f"], default: "table",
+            option :format, type: :string, aliases: ["f"],
               desc: "Output format (table, json)"
             option :debug, type: :boolean, default: false,
               desc: "Show debug output"

data/lib/ace/git/secrets/cli/commands/scan.rb

@@ -19,7 +19,7 @@ module Ace
             desc "Scan Git history for authentication tokens"
 
             option :since, type: :string, desc: "Start scanning from commit or date"
-            option :format, type: :string, aliases: ["f"], default: "table",
+            option :format, type: :string, aliases: ["f"],
               desc: "Stdout format when --verbose is used (table, json, yaml)"
             option :report_format, type: :string, aliases: ["r"], default: "json",
               desc: "Format for saved report file (json, markdown)"

data/lib/ace/git/secrets/commands/check_release_command.rb

@@ -33,7 +33,8 @@ module Ace
             result = gate.check
 
             # Output formatted result
-            puts gate.format_result(result, format: @options[:format] || "table")
+            format = @options[:format] || Ace::Git::Secrets.config.dig("output", "format") || "table"
+            puts gate.format_result(result, format: format)
 
             result[:exit_code]
           rescue => e

data/lib/ace/git/secrets/organisms/security_auditor.rb

@@ -78,7 +78,7 @@ module Ace
           def format_report(report)
             case output_format
             when "json"
-              report.to_json
+              report.to_json(include_raw: true)
             when "yaml"
               report.to_yaml
             else

data/lib/ace/git/secrets/version.rb

@@ -3,7 +3,7 @@
 module Ace
   module Git
     module Secrets
-      VERSION = '0.13.3'
+      VERSION = '0.15.5'
     end
   end
 end

metadata

@@ -1,13 +1,13 @@
 --- !ruby/object:Gem::Specification
 name: ace-git-secrets
 version: !ruby/object:Gem::Version
-  version: 0.13.3
+  version: 0.15.5
 platform: ruby
 authors:
 - Michal Czyz
 bindir: exe
 cert_chain: []
-date: 2026-03-29 00:00:00.000000000 Z
+date: 2026-04-20 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: ace-support-config