sentinel-ci 1.0.0 → 1.0.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 4afefad30650b21315fce711323ed0d39a2046a472e5e62b081d2b4b83476cf7
-  data.tar.gz: 36fa211355533de0fe72265ef44878b0ad14604f0d309a7b00f50e55ebd59517
+  metadata.gz: d80229adb1733c9bd79d6770c46d0b117702fc4ff1fe71e99d1afa5fe3b78ffe
+  data.tar.gz: 2592ada1faa0fbf3917431c6baf4b341ab34a5d9d424a7caee20ec7a701e2779
 SHA512:
-  metadata.gz: 70cbe3787c1ddd1e7227beac14373b0826ea108c5b985cf16f12159c55be3f41076341d22fed0bd6845d4e75eae1fd1fd8ae16ceef31b0966b1b9cd95aaa0160
-  data.tar.gz: edf35ebd84e3c162e82be1ad57b04b0f6d25ad96f3c50201db57d49847bea87b507ef7188efd30c65a62b50e248dcf1405c6cf6aff761d5601394ea035aca867
+  metadata.gz: ccd23b049b0582c04b90baa5a9112197fb7c0407078edfd043c3ddcf93857a9adade4a9c83a1a46c6fe9dcc2ea1cd2c133664dc3c6f19a0a79617fe741dc163d
+  data.tar.gz: da385d744d1897516f8422bc80701076c972a82014175ba1a6c0b4eac2b86852169b5635b7ad30a25008b45fe903dfcf5346a89e3f3f2f275fdca32454d51f00

data/CHANGELOG.md

@@ -1,5 +1,9 @@
 # Changelog
 
+## 1.0.1 (2026-05-17)
+
+- Smart clone auth: try HTTPS, SSH, then gh token — no manual GITHUB_TOKEN needed for private repos
+
 ## 1.0.0 (2026-05-16)
 
 ### New Features

data/lib/clone_client.rb

@@ -19,25 +19,16 @@ class CloneClient
 
         @tmpdir = Dir.mktmpdir("sentinel-")
 
-        # Shallow sparse clone — only .github/ directory
-        success = system(
-            "git", "clone", "--depth", "1", "--filter=blob:none", "--sparse",
-            "https://github.com/#{repo}.git", @tmpdir,
-            [:out, :err] => File::NULL
-        )
+        success = try_clone(repo)
 
         unless success
             $stderr.puts ""
             $stderr.puts "ERROR: Could not access #{repo}"
             $stderr.puts ""
-            $stderr.puts "This repo may be private. To scan private repos:"
-            $stderr.puts ""
-            $stderr.puts "  export GITHUB_TOKEN=$(gh auth token)"
-            $stderr.puts "  sentinel scan #{repo}"
-            $stderr.puts ""
-            $stderr.puts "Or pass a token directly:"
-            $stderr.puts ""
-            $stderr.puts "  sentinel scan --token ghp_xxx #{repo}"
+            $stderr.puts "If this is a private repo, make sure git can authenticate:"
+            $stderr.puts "  - SSH key configured (git clone git@github.com:#{repo})"
+            $stderr.puts "  - Or: gh auth login"
+            $stderr.puts "  - Or: export GITHUB_TOKEN=$(gh auth token)"
             $stderr.puts ""
             exit 2
         end
@@ -63,4 +54,40 @@ class CloneClient
     def cleanup
         FileUtils.rm_rf(@tmpdir) if @tmpdir
     end
+
+    private
+
+    CLONE_ARGS = %w[--depth 1 --filter=blob:none --sparse].freeze
+
+    def try_clone(repo)
+        # 1. HTTPS — works for public repos and if credential helper is configured
+        return true if try_url("https://github.com/#{repo}.git")
+
+        # 2. SSH — works if SSH key is configured
+        return true if try_url("git@github.com:#{repo}.git")
+
+        # 3. HTTPS with gh auth token — works if gh CLI is authenticated
+        token = detect_gh_token
+        if token
+            return true if try_url("https://x-access-token:#{token}@github.com/#{repo}.git")
+        end
+
+        false
+    end
+
+    def try_url(url)
+        FileUtils.rm_rf(Dir.children(@tmpdir)) if @tmpdir && File.directory?(@tmpdir)
+        system("git", "clone", *CLONE_ARGS, url, @tmpdir, [:out, :err] => File::NULL)
+    end
+
+    def detect_gh_token
+        return ENV["GITHUB_TOKEN"] if ENV["GITHUB_TOKEN"]
+
+        gh_path = `which gh 2>/dev/null`.strip
+        return nil if gh_path.empty?
+        return nil unless system("gh", "auth", "status", [:out, :err] => File::NULL)
+
+        token = `gh auth token 2>/dev/null`.strip
+        token.empty? ? nil : token
+    end
 end

data/lib/version.rb

@@ -1,3 +1,3 @@
 module Sentinel
-    VERSION = "1.0.0"
+    VERSION = "1.0.1"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: sentinel-ci
 version: !ruby/object:Gem::Version
-  version: 1.0.0
+  version: 1.0.1
 platform: ruby
 authors:
 - Jordan Ritter
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-05-16 00:00:00.000000000 Z
+date: 2026-05-17 00:00:00.000000000 Z
 dependencies: []
 description: Scan GitHub Actions workflows for 28 security vulnerabilities. SHA pinning,
   shell injection, credential exposure, dangerous triggers. Optional AI-powered remediation