sentinel-ci 1.2.0 → 1.3.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 1c9ce31656462acc9215c1915b25884158ad03b6c50ba5772f71b048767cb5ce
-  data.tar.gz: 86d764b299a9df2bd2f02c10b263d0dbf9e679a893ed87192572bcfe67792a99
+  metadata.gz: 23aa715c0e322cb64a295126e1c7ea6d799b5e2160b1f9afb6781c70d6d67e74
+  data.tar.gz: 4dcef6fdb0ce75cc6df95b875c184bb2eac4664cfaa3cc08c887cba17b01544b
 SHA512:
-  metadata.gz: 3b306657cecd361b0649291ff7c62b9e339b0cc6a4c38baaab9cea223b9a5b94952b1c953a95be98c0b7f0cbd71944130e2d625cd94fc4e39c36d215340cfc58
-  data.tar.gz: 42f6ae9c304e4e87db9c3568f4bcdafa027c9134890f2721c9e7354e5c40122f5e33a49b49f32ca41d063617fcb9d9a8bb92c8dc06eb14459d732728329734e7
+  metadata.gz: a73ae7c6c62199f997171d442a4f34b5f8ba01d57606e9b4a95be3841a9b4939860dfeb4f240c6f3e1aa766d8416dc13a9b40aaeef8cd09cad96db3770caf5a2
+  data.tar.gz: 7db22bcd42d182031dbb1d2adfa9da5e6073d9655ac58900065afd37be674bc4d477ba9ab775756c067569b0f02ec1a6d7730dfd81f0a87298d49cea796315cb

data/CHANGELOG.md

@@ -1,5 +1,22 @@
 # Changelog
 
+## 1.3.0 (2026-05-18)
+
+### New Features
+- PR lifecycle tracker (state model, GitHub sync, bootstrap, CLI + web dashboards)
+- jq-arg-escape-sequences rule (rule 32, total now 32)
+- Audit trail wiring (12 audit calls across all bot decision points)
+- Gist-based state backup (--backup/--restore, auto-backup after runs)
+
+### Testing & CI
+- Bot integration tests (19 tests covering decision flow)
+- CI workflow (Ruby 3.2+3.3 matrix, self-scan on all PRs)
+- 646 total tests
+
+### Infrastructure
+- Stable file locking for concurrent bot/web access
+- PST/PDT timezone handling (correct year-round)
+
 ## 1.2.0 (2026-05-18)
 
 ### Bot Hardening

data/README.md

@@ -7,7 +7,7 @@
 ![Ruby](https://img.shields.io/badge/ruby-3.2%2B-red)
 ![License](https://img.shields.io/badge/license-MIT-blue)
 
-Scan GitHub Actions workflows for 31 security vulnerabilities. Optional AI-powered remediation via Claude. Pure Ruby stdlib.
+Scan GitHub Actions workflows for 32 security vulnerabilities. Optional AI-powered remediation via Claude. Pure Ruby stdlib.
 
 Documentation: https://sentinel.copilotkit.dev
 
@@ -102,7 +102,7 @@ medium as warnings, low as notices.
 | Name | Default | Description |
 |------|---------|-------------|
 | `fix` | `false` | Auto-fix findings. Pushes to PR branch, or creates fix PR on main. |
-| `anthropic-key` | -- | Anthropic API key -- enables AI-powered fixes for all 31 rules |
+| `anthropic-key` | -- | Anthropic API key -- enables AI-powered fixes for all 32 rules |
 
 **Fix mode outputs:**
 
@@ -208,10 +208,11 @@ sentinel scan --local . --platform bitbucket # Bitbucket only
 | 29 | `ide-config-injection` | critical | Workflow writes to IDE/AI config files (.claude/, .vscode/tasks.json) |
 | 30 | `dangerous-lifecycle-scripts` | medium | Package install without --ignore-scripts in workflows with secrets |
 | 31 | `github-dependency-refs` | medium | Direct GitHub commit/branch ref in package install |
+| 32 | `jq-arg-escape-sequences` | medium | jq `--arg` value contains backslash escape sequences that won't be interpreted |
 
 ## Auto-Fix
 
-Sentinel can automatically fix findings -- 6 rules mechanically, all 31 with AI:
+Sentinel can automatically fix findings -- 6 rules mechanically, all 32 with AI:
 
 ```bash
 # Mechanical fixes (free, deterministic)

data/lib/rules/jq_arg_escape.rb

@@ -0,0 +1,27 @@
+module Rules
+    class JqArgEscape < Base
+        def name = "jq-arg-escape-sequences"
+        def description = "jq --arg value contains backslash escape sequences that won't be interpreted"
+        def severity = :medium
+
+        PATTERN = /jq\s.*--arg\s+\w+\s+"[^"]*\\[nt\\][^"]*"/
+
+        def check(workflow)
+            findings = []
+
+            workflow.raw_lines.each_with_index do |line, i|
+                next if line.strip.start_with?("#")
+                next unless line.match?(PATTERN)
+
+                findings << finding(workflow,
+                    line: i + 1,
+                    code: line.strip,
+                    message: "jq --arg treats values as raw literals — \\n becomes literal backslash-n, not a newline",
+                    fix: "Use real newlines via $'\\n' or multi-line variable, or use --argjson with pre-escaped JSON"
+                )
+            end
+
+            findings
+        end
+    end
+end

data/lib/version.rb

@@ -1,3 +1,3 @@
 module Sentinel
-    VERSION = "1.2.0"
+    VERSION = "1.3.0"
 end

metadata

@@ -1,16 +1,16 @@
 --- !ruby/object:Gem::Specification
 name: sentinel-ci
 version: !ruby/object:Gem::Version
-  version: 1.2.0
+  version: 1.3.0
 platform: ruby
 authors:
 - Jordan Ritter
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-05-18 00:00:00.000000000 Z
+date: 2026-05-19 00:00:00.000000000 Z
 dependencies: []
-description: Scan GitHub Actions workflows for 31 security vulnerabilities. SHA pinning,
+description: Scan GitHub Actions workflows for 32 security vulnerabilities. SHA pinning,
   shell injection, credential exposure, dangerous triggers. Optional AI-powered remediation
   via Claude. Pure Ruby stdlib.
 email: jpr5@darkridge.com
@@ -59,6 +59,7 @@ files:
 - lib/rules/github_script_injection.rb
 - lib/rules/hardcoded_secrets.rb
 - lib/rules/ide_config_injection.rb
+- lib/rules/jq_arg_escape.rb
 - lib/rules/missing_env_protection.rb
 - lib/rules/missing_frozen_lockfile.rb
 - lib/rules/missing_permissions.rb