commit-shield 0.2.0__py3-none-any.whl → 0.3.0__py3-none-any.whl

commit_guard/__init__.py

@@ -1,5 +1,14 @@
 """
-commit-guard: Lightweight, zero-dependency Git commit message and file linter.
+commit-shield: Lightweight Git commit message, secret leak and staged file linter.
 """
 
-__version__ = "0.2.0"
+from commit_guard.checkers import check_commit_message, check_file_path
+from commit_guard.secret_scanner import scan_git_diff, scan_text
+
+__version__ = "0.3.0"
+__all__ = [
+    "check_commit_message",
+    "check_file_path",
+    "scan_git_diff",
+    "scan_text",
+]

commit_guard/cli.py

@@ -4,6 +4,7 @@ Supports standalone usage, git hook usage, and pre-commit framework integration.
 """
 
 import argparse
+import json
 import os
 import stat
 import sys
@@ -17,8 +18,11 @@ from commit_guard.gitutil import (
     git_dir,
     is_git_repo,
     staged_blob_size,
+    staged_diff,
     staged_files,
 )
+from commit_guard.secret_scanner import scan_git_diff
+from commit_guard.wizard import run_wizard
 
 EXIT_OK = 0
 EXIT_FAIL = 1
@@ -66,6 +70,15 @@ def cmd_check_msg(args: argparse.Namespace) -> int:
         msg, max_header_len=args.max_header_len, config=config
     )
 
+    if getattr(args, "json", False):
+        res = {
+            "valid": is_valid,
+            "errors": errors,
+            "message": msg.strip(),
+        }
+        print(json.dumps(res, indent=2))
+        return EXIT_OK if is_valid else EXIT_FAIL
+
     if is_valid:
         if not args.quiet:
             print("[commit-guard] Commit message valid. [OK]")
@@ -107,6 +120,7 @@ def cmd_check_files(args: argparse.Namespace) -> int:
         return EXIT_OK
 
     has_issues = False
+    all_issues: List[str] = []
     for path in files_to_check:
         # Prefer the staged blob size: the working tree may have moved on.
         size_bytes = staged_blob_size(path) if from_index else None
@@ -118,12 +132,40 @@ def cmd_check_files(args: argparse.Namespace) -> int:
         )
         if not is_valid:
             has_issues = True
-            for issue in issues:
-                print("[commit-guard] Warning: {0}".format(issue), file=sys.stderr)
+            all_issues.extend(issues)
+            if not getattr(args, "json", False):
+                for issue in issues:
+                    print("[commit-guard] Warning: {0}".format(issue), file=sys.stderr)
+
+    # Content-level secret scan on staged git diff (inspired by git-secrets / gitleaks)
+    secret_issues: List[str] = []
+    if from_index and not getattr(args, "no_secrets", False):
+        diff_text = staged_diff()
+        if diff_text:
+            findings = scan_git_diff(diff_text)
+            for f in findings:
+                msg = f.format_message()
+                secret_issues.append(msg)
+                all_issues.append(msg)
+                has_issues = True
+                if not getattr(args, "json", False):
+                    print(f"[commit-guard] Warning: {msg}", file=sys.stderr)
+
+    if getattr(args, "json", False):
+        payload = {
+            "valid": not has_issues,
+            "issues": all_issues,
+            "secret_issues": secret_issues,
+            "files_checked": len(files_to_check),
+        }
+        print(json.dumps(payload, indent=2))
+        if has_issues and args.strict:
+            return EXIT_FAIL
+        return EXIT_OK
 
     if has_issues and args.strict:
         print(
-            "\n[commit-guard] Aborting commit due to sensitive or oversized "
+            "\n[commit-guard] Aborting commit due to sensitive, secret or oversized "
             "files (strict mode).",
             file=sys.stderr,
         )
@@ -297,6 +339,15 @@ def cmd_uninstall(args: argparse.Namespace) -> int:
     return EXIT_OK
 
 
+def cmd_wizard(args: argparse.Namespace) -> int:
+    """Run interactive Conventional Commit wizard."""
+    try:
+        config = _resolve_config(args)
+    except ConfigError as exc:
+        return _fail(str(exc))
+    return run_wizard(config=config, dry_run=getattr(args, "dry_run", False))
+
+
 def _add_config_flags(parser: argparse.ArgumentParser) -> None:
     """Flags shared by every validating subcommand."""
     parser.add_argument(
@@ -310,12 +361,15 @@ def _add_config_flags(parser: argparse.ArgumentParser) -> None:
     parser.add_argument(
         "-q", "--quiet", action="store_true", help="Suppress success messages"
     )
+    parser.add_argument(
+        "--json", action="store_true", help="Output machine-readable JSON results"
+    )
 
 
 def build_parser() -> argparse.ArgumentParser:
     parser = argparse.ArgumentParser(
         prog="commit-guard",
-        description="Fast, zero-dependency Git commit message and staged file linter.",
+        description="Fast Git commit message, secret leak and staged file linter.",
     )
     parser.add_argument(
         "--version", action="version", version="%(prog)s {0}".format(__version__)
@@ -323,6 +377,19 @@ def build_parser() -> argparse.ArgumentParser:
 
     subparsers = parser.add_subparsers(dest="subcommand", help="Available subcommands")
 
+    # commit / cz (interactive wizard)
+    p_cz = subparsers.add_parser(
+        "commit", aliases=["cz"], help="Interactive Conventional Commit wizard"
+    )
+    p_cz.add_argument(
+        "--dry-run",
+        action="store_true",
+        help="Generate commit message without committing",
+    )
+    _add_config_flags(p_cz)
+    p_cz.set_defaults(func=cmd_wizard)
+
+    # check-msg
     p_msg = subparsers.add_parser("check-msg", help="Validate commit message format")
     p_msg.add_argument(
         "file", nargs="?", help="Path to commit message file (e.g. .git/COMMIT_EDITMSG)"
@@ -337,8 +404,11 @@ def build_parser() -> argparse.ArgumentParser:
     _add_config_flags(p_msg)
     p_msg.set_defaults(func=cmd_check_msg)
 
+    # check-files / check-staged
     p_files = subparsers.add_parser(
-        "check-files", help="Validate staged files for size and secrets"
+        "check-files",
+        aliases=["check-staged"],
+        help="Validate staged files for size, sensitive patterns and secrets",
     )
     p_files.add_argument(
         "files", nargs="*", help="File paths to inspect (defaults to git staged files)"
@@ -352,7 +422,12 @@ def build_parser() -> argparse.ArgumentParser:
     p_files.add_argument(
         "--strict",
         action="store_true",
-        help="Fail with exit 1 if sensitive files detected",
+        help="Fail with exit 1 if sensitive files or secrets detected",
+    )
+    p_files.add_argument(
+        "--no-secrets",
+        action="store_true",
+        help="Skip scanning staged diffs for hardcoded credentials",
     )
     _add_config_flags(p_files)
     p_files.set_defaults(func=cmd_check_files)

commit_guard/gitutil.py

@@ -19,6 +19,7 @@ __all__ = [
     "repo_root",
     "staged_files",
     "staged_blob_size",
+    "staged_diff",
 ]
 
 
@@ -104,3 +105,11 @@ def staged_blob_size(path: str, cwd: Optional[str] = None) -> Optional[int]:
         return int(out.strip())
     except ValueError:
         return None
+
+
+def staged_diff(cwd: Optional[str] = None) -> str:
+    """Return unified diff of staged changes for secret scanning."""
+    try:
+        return run_git(["diff", "--cached", "-U0"], cwd)
+    except GitError:
+        return ""

commit_guard/secret_scanner.py

@@ -0,0 +1,160 @@
+"""
+Content-level secret and credential scanner for git staged diffs and source files.
+Inspired by AWS git-secrets and gitleaks.
+Zero external dependencies.
+"""
+
+import re
+from dataclasses import dataclass
+from typing import List, Optional, Tuple
+
+
+@dataclass
+class SecretFinding:
+    rule_name: str
+    file_path: str
+    line_number: int
+    secret_preview: str
+    line_content: str
+
+    def format_message(self) -> str:
+        return (
+            f"[SECRET LEAK] {self.file_path}:{self.line_number}: "
+            f"Detected {self.rule_name} ('{self.secret_preview}')"
+        )
+
+
+def _mask_secret(secret: str) -> str:
+    """Mask sensitive string leaving only small prefix and suffix visible."""
+    if len(secret) <= 8:
+        return "***"
+    return secret[:4] + "..." + secret[-4:]
+
+
+# Precompiled secret detection rules
+SECRET_RULES: List[Tuple[str, re.Pattern]] = [
+    ("AWS Access Key ID", re.compile(r"\b(?:AKIA|ABIA|ACCA|ASIA)[A-Z0-9]{16}\b")),
+    (
+        "GitHub Token",
+        re.compile(
+            r"\b(?:ghp|gho|ghu|ghs|ghr)_[A-Za-z0-9]{36}\b|\bgithub_pat_[A-Za-z0-9_]{82}\b"
+        ),
+    ),
+    ("OpenAI API Key", re.compile(r"\bsk-[a-zA-Z0-9]{20,64}\b")),
+    ("Anthropic API Key", re.compile(r"\bsk-ant-[a-zA-Z0-9_\-]{20,128}\b")),
+    ("Slack Token", re.compile(r"\bxox[baprs](?:-[0-9a-zA-Z]{5,48})+\b")),
+    (
+        "Stripe Secret / Live Key",
+        re.compile(r"\b(?:sk|pk)_(?:test|live)_[0-9a-zA-Z]{24,34}\b"),
+    ),
+    ("Google Cloud API Key", re.compile(r"\bAIza[0-9A-Za-z\-_]{35}\b")),
+    (
+        "PEM Private Key Header",
+        re.compile(r"-----BEGIN (?:RSA |EC |DSA |OPENSSH )?PRIVATE KEY-----"),
+    ),
+    (
+        "Generic Hardcoded Password / Secret",
+        re.compile(
+            r"""(?i)(?:[a-zA-Z0-9_\-\.]*(?:password|passwd|secret|api_key|apikey|access_token|auth_token))\s*[:=]\s*['"]([A-Za-z0-9_\-!@#$%^&*()+=]{8,})['"]"""
+        ),
+    ),
+]
+
+# Patterns that indicate false positives / test dummies / placeholders
+ALLOWLIST_PATTERNS = [
+    re.compile(
+        r"(?i)(?:example|placeholder|dummy|test_fake|<YOUR_|fake_|YOUR_KEY|REPLACE_ME)"
+    ),
+    re.compile(r"AKIAIOSFODNN7EXAMPLE"),
+]
+
+
+def _is_false_positive(line: str, matched_secret: str) -> bool:
+    """Check if match appears to be an obvious mock/placeholder or comment."""
+    for pattern in ALLOWLIST_PATTERNS:
+        if pattern.search(line) or pattern.search(matched_secret):
+            return True
+    return False
+
+
+def scan_text(text: str, file_path: str = "<staged>") -> List[SecretFinding]:
+    """Scan arbitrary text content line by line for secrets."""
+    findings: List[SecretFinding] = []
+    lines = text.splitlines()
+
+    for idx, line in enumerate(lines, start=1):
+        stripped = line.strip()
+        if not stripped:
+            continue
+
+        for rule_name, regex in SECRET_RULES:
+            match = regex.search(stripped)
+            if match:
+                matched_secret = match.group(0)
+                if not _is_false_positive(stripped, matched_secret):
+                    findings.append(
+                        SecretFinding(
+                            rule_name=rule_name,
+                            file_path=file_path,
+                            line_number=idx,
+                            secret_preview=_mask_secret(matched_secret),
+                            line_content=stripped[:120],
+                        )
+                    )
+                    break
+
+    return findings
+
+
+def scan_git_diff(diff_output: str) -> List[SecretFinding]:
+    """
+    Parse unified git diff output (e.g. git diff --cached -U0) and scan only
+    added lines ('+...') for committed secrets.
+    """
+    findings: List[SecretFinding] = []
+    current_file: Optional[str] = None
+    current_line_num: int = 0
+
+    diff_file_re = re.compile(r"^\+\+\+\s+b/(.*)$")
+    hunk_header_re = re.compile(r"^@@\s+-\d+(?:,\d+)?\s+\+(\d+)(?:,\d+)?\s+@@")
+
+    for raw_line in diff_output.splitlines():
+        # Check for new file header: +++ b/path/to/file
+        file_match = diff_file_re.match(raw_line)
+        if file_match:
+            current_file = file_match.group(1).strip()
+            continue
+
+        # Check for hunk header: @@ -1,1 +10,1 @@
+        hunk_match = hunk_header_re.match(raw_line)
+        if hunk_match:
+            current_line_num = int(hunk_match.group(1))
+            continue
+
+        # Check for added lines
+        if raw_line.startswith("+") and not raw_line.startswith("+++"):
+            added_content = raw_line[1:]  # strip leading '+'
+            file_name = current_file or "<unknown>"
+
+            # Scan the line for secrets
+            for rule_name, regex in SECRET_RULES:
+                match = regex.search(added_content)
+                if match:
+                    matched_secret = match.group(0)
+                    if not _is_false_positive(added_content, matched_secret):
+                        findings.append(
+                            SecretFinding(
+                                rule_name=rule_name,
+                                file_path=file_name,
+                                line_number=current_line_num,
+                                secret_preview=_mask_secret(matched_secret),
+                                line_content=added_content.strip()[:120],
+                            )
+                        )
+                        break
+
+            current_line_num += 1
+        elif not raw_line.startswith("-"):
+            current_line_num += 1
+
+    return findings

commit_guard/wizard.py

@@ -0,0 +1,222 @@
+"""
+Interactive commit wizard for writing Conventional Commits.
+Inspired by Commitizen (cz commit) with zero external dependencies.
+"""
+
+import sys
+from typing import List, Optional, Tuple
+
+from commit_guard.checkers import check_commit_message
+from commit_guard.config import Config
+from commit_guard.gitutil import run_git
+
+COMMIT_TYPES: List[Tuple[str, str]] = [
+    ("feat", "A new feature for the user or system"),
+    ("fix", "A bug fix"),
+    ("docs", "Documentation only changes"),
+    ("style", "Code style & formatting changes (no logic changes)"),
+    ("refactor", "Code refactoring (neither fixes a bug nor adds a feature)"),
+    ("perf", "A code change that improves performance"),
+    ("test", "Adding or updating unit/integration tests"),
+    ("build", "Changes that affect the build system or packaging"),
+    ("ci", "Changes to CI/CD configuration files and scripts"),
+    ("chore", "Routine maintenance tasks, dependencies, tooling"),
+    ("revert", "Reverts a previous commit"),
+]
+
+
+def prompt_choice(prompt: str, choices: List[Tuple[str, str]]) -> str:
+    """Display a numbered menu and prompt the user to select one."""
+    print(f"\n{prompt}\n")
+    for idx, (code, desc) in enumerate(choices, start=1):
+        print(f"  [{idx:2d}] {code:10s} - {desc}")
+    print()
+
+    while True:
+        try:
+            raw = input("Select type (1-11): ").strip()
+        except (EOFError, KeyboardInterrupt):
+            print("\nAborted.")
+            sys.exit(1)
+
+        if raw.isdigit():
+            val = int(raw)
+            if 1 <= val <= len(choices):
+                return choices[val - 1][0]
+        else:
+            # User typed the code name directly
+            matching = [c for c, _ in choices if c == raw.lower()]
+            if matching:
+                return matching[0]
+
+        print(f"Invalid selection. Please enter a number between 1 and {len(choices)}.")
+
+
+def prompt_text(prompt: str, required: bool = False, default: str = "") -> str:
+    """Prompt the user for a text input."""
+    suffix = f" (default: {default})" if default else ""
+    suffix += " [required]" if required else " [optional, Enter to skip]"
+
+    while True:
+        try:
+            val = input(f"{prompt}{suffix}: ").strip()
+        except (EOFError, KeyboardInterrupt):
+            print("\nAborted.")
+            sys.exit(1)
+
+        if not val and default:
+            return default
+        if not val and required:
+            print("This field is required. Please provide a description.")
+            continue
+        return val
+
+
+def prompt_yes_no(prompt: str, default: bool = False) -> bool:
+    """Prompt for a yes/no question."""
+    hint = "[y/N]" if not default else "[Y/n]"
+    while True:
+        try:
+            ans = input(f"{prompt} {hint}: ").strip().lower()
+        except (EOFError, KeyboardInterrupt):
+            print("\nAborted.")
+            sys.exit(1)
+
+        if not ans:
+            return default
+        if ans in ("y", "yes"):
+            return True
+        if ans in ("n", "no"):
+            return False
+        print("Please answer 'y' or 'n'.")
+
+
+def compose_commit_message(
+    commit_type: str,
+    scope: str,
+    subject: str,
+    body: str = "",
+    is_breaking: bool = False,
+    breaking_description: str = "",
+    issues_closed: str = "",
+) -> str:
+    """Format components into a standard Conventional Commit string."""
+    breaking_mark = "!" if is_breaking else ""
+    scope_part = f"({scope})" if scope else ""
+
+    # Strip any trailing period from subject
+    subject_clean = subject.rstrip(".")
+
+    header = f"{commit_type}{scope_part}{breaking_mark}: {subject_clean}"
+    sections = [header]
+
+    if body.strip():
+        sections.append(body.strip())
+
+    footer_items = []
+    if is_breaking and breaking_description.strip():
+        footer_items.append(f"BREAKING CHANGE: {breaking_description.strip()}")
+
+    if issues_closed.strip():
+        for item in issues_closed.split(","):
+            clean_item = item.strip()
+            if clean_item:
+                if not clean_item.lower().startswith(("closes", "fixes", "resolves")):
+                    clean_item = f"Closes {clean_item}"
+                footer_items.append(clean_item)
+
+    if footer_items:
+        sections.append("\n".join(footer_items))
+
+    return "\n\n".join(sections)
+
+
+def run_wizard(config: Optional[Config] = None, dry_run: bool = False) -> int:
+    """
+    Run interactive wizard in terminal to construct and execute a Conventional Commit.
+    """
+    print("\n" + "=" * 60)
+    print("🛡️  commit-shield: Interactive Conventional Commit Wizard")
+    print("=" * 60)
+
+    # 1. Type
+    commit_type = prompt_choice(
+        "Select the type of change you are committing:", COMMIT_TYPES
+    )
+
+    # 2. Scope
+    scope = prompt_text("Scope of this change (e.g. auth, api, cli, config)")
+
+    # 3. Subject
+    subject = prompt_text(
+        "Short imperative description (e.g. add google login)", required=True
+    )
+
+    # 4. Long Body
+    print("\nDetailed body description (optional). Press Enter twice to finish:")
+    body_lines: List[str] = []
+    while True:
+        try:
+            line = input()
+        except (EOFError, KeyboardInterrupt):
+            break
+        if not line and (not body_lines or not body_lines[-1]):
+            break
+        body_lines.append(line)
+    body = "\n".join(body_lines).strip()
+
+    # 5. Breaking change
+    is_breaking = prompt_yes_no(
+        "Are there any BREAKING CHANGES in this commit?", default=False
+    )
+    breaking_desc = ""
+    if is_breaking:
+        breaking_desc = prompt_text("Describe the breaking changes", required=True)
+
+    # 6. Issue reference
+    issues = prompt_text("Issues closed by this commit (e.g. #123, PROJ-45)")
+
+    # Compose
+    commit_msg = compose_commit_message(
+        commit_type=commit_type,
+        scope=scope,
+        subject=subject,
+        body=body,
+        is_breaking=is_breaking,
+        breaking_description=breaking_desc,
+        issues_closed=issues,
+    )
+
+    # Validate composed message
+    valid, errors = check_commit_message(commit_msg, config=config)
+    print("\n" + "-" * 60)
+    print("Generated Commit Message:")
+    print("-" * 60)
+    print(commit_msg)
+    print("-" * 60)
+
+    if not valid:
+        print("\n❌ Warning: Composed message failed validation:", file=sys.stderr)
+        for err in errors:
+            print(f"  - {err}", file=sys.stderr)
+        print()
+
+    if dry_run:
+        print("[Dry Run] Commit message generated. Not committing.")
+        return 0
+
+    # Confirmation
+    confirm = prompt_yes_no(
+        "Proceed to commit staged changes with this message?", default=True
+    )
+    if not confirm:
+        print("Commit aborted.")
+        return 0
+
+    try:
+        run_git(["commit", "-m", commit_msg])
+        print("✅ Commit created successfully!")
+        return 0
+    except Exception as e:
+        print(f"❌ Git commit failed: {e}", file=sys.stderr)
+        return 1

{commit_shield-0.2.0.dist-info → commit_shield-0.3.0.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: commit-shield
-Version: 0.2.0
+Version: 0.3.0
 Summary: Fast, zero-dependency Git commit message and staged file linter.
 Project-URL: Homepage, https://github.com/lui01212/commit-guard
 Project-URL: Repository, https://github.com/lui01212/commit-guard.git

commit_shield-0.3.0.dist-info/RECORD

@@ -0,0 +1,13 @@
+commit_guard/__init__.py,sha256=RtZCdXsua6NGZAfdSup7UQZ0-zL42lbZ8UUZhOjrUuw,355
+commit_guard/_toml.py,sha256=cbGmGwfJayHIrJu-CDzDMdacpS_Ys-QwpNouW8ZKKhw,7847
+commit_guard/checkers.py,sha256=TOoXmNLGlm3bO6rjtC83pzUdEp7ib3uh2W9BEtLMLWM,9126
+commit_guard/cli.py,sha256=j8vV5T0R49CfUZLC7rF5CBNtokw-xq8wv04aSPD_FtU,15593
+commit_guard/config.py,sha256=aylDj6hTB58g4QJNLfxDNBYEGBY2iGgU86zJMpPsF2s,11102
+commit_guard/gitutil.py,sha256=80W9MaX3CMxh6N_pZEZAAWhrwE5PFsWHoJZ84Mt0mOE,3597
+commit_guard/secret_scanner.py,sha256=ugBw8I62NR9nQnjjCLMvKrKfHkYaC4fDRvFV-VmaoMc,5504
+commit_guard/wizard.py,sha256=VJ5A2blJT81Sv0F-nmWR7TyDmeYYQlOcnTfCyqVuP94,6967
+commit_shield-0.3.0.dist-info/METADATA,sha256=fmx7NF3IJshYyef71sDtcIspT0Ei9EPP1YTbbCqMcvw,5891
+commit_shield-0.3.0.dist-info/WHEEL,sha256=W3fkpkm7-wf9vBI5Z-7s0eWkeM-spu78I8Neb98DeEg,87
+commit_shield-0.3.0.dist-info/entry_points.txt,sha256=miu01XDEo2TnpI6yISlO1teLXGnR3nMrfBpkoiqqNkM,93
+commit_shield-0.3.0.dist-info/licenses/LICENSE,sha256=RWxza2uvDjCv6Rh2BuAIA6Y_trYT1WF7EZ5fUFYldWc,1065
+commit_shield-0.3.0.dist-info/RECORD,,

commit_shield-0.2.0.dist-info/RECORD

@@ -1,11 +0,0 @@
-commit_guard/__init__.py,sha256=TZJxOCvu8aTIKoQClPZU-fen_hVfyKLoayOmMay3-8E,110
-commit_guard/_toml.py,sha256=cbGmGwfJayHIrJu-CDzDMdacpS_Ys-QwpNouW8ZKKhw,7847
-commit_guard/checkers.py,sha256=TOoXmNLGlm3bO6rjtC83pzUdEp7ib3uh2W9BEtLMLWM,9126
-commit_guard/cli.py,sha256=cT9gzRfWsB4NfeZ1Cy7W6XD8ftZ-YgQf462Jmp71EbA,13061
-commit_guard/config.py,sha256=aylDj6hTB58g4QJNLfxDNBYEGBY2iGgU86zJMpPsF2s,11102
-commit_guard/gitutil.py,sha256=7db5sJ7llHk6mJLrcSQ9xetDJhhHvIopRDzMY5OMj8w,3351
-commit_shield-0.2.0.dist-info/METADATA,sha256=jwp9ni46H7j9lct9Vk1smdJmhx7sgQjzmti-HamX06M,5891
-commit_shield-0.2.0.dist-info/WHEEL,sha256=W3fkpkm7-wf9vBI5Z-7s0eWkeM-spu78I8Neb98DeEg,87
-commit_shield-0.2.0.dist-info/entry_points.txt,sha256=miu01XDEo2TnpI6yISlO1teLXGnR3nMrfBpkoiqqNkM,93
-commit_shield-0.2.0.dist-info/licenses/LICENSE,sha256=RWxza2uvDjCv6Rh2BuAIA6Y_trYT1WF7EZ5fUFYldWc,1065
-commit_shield-0.2.0.dist-info/RECORD,,