git-private2public 0.2.0__tar.gz → 0.2.1__tar.gz

{git_private2public-0.2.0 → git_private2public-0.2.1}/CHANGELOG.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## 0.2.1
+
+- Add `.gitpublic/public/` overlays for public-only files after sanitization.
+- Keep snapshot publications at exactly one root commit after applying overlays.
+- Reject overlay symlinks, special files, reserved paths, and destination escapes.
+- Permit tracked `.gitpublic/scan` policy when every active rule is generic `regex:`.
+
 ## 0.2.0
 
 - Add fail-closed scanning of every reachable blob, commit, and annotated tag.

{git_private2public-0.2.0 → git_private2public-0.2.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: git-private2public
-Version: 0.2.0
+Version: 0.2.1
 Summary: Like .gitignore, but for what goes public. Keep a sanitized public mirror of your private repo.
 Project-URL: Homepage, https://github.com/megamen32/git-private2public
 Project-URL: Repository, https://github.com/megamen32/git-private2public

{git_private2public-0.2.0 → git_private2public-0.2.1}/docs/ADVANCED.md

@@ -16,7 +16,7 @@ private repo
   -> push to public repo             (.gitpublic/config)
 ```
 
-Missing custom files mean “no custom rules for that step”. Built-in credential detection remains active for zero-config scans and guard mode.
+Missing custom files mean “no custom rules for that step”. Built-in credential detection remains active for every publish, zero-config scan, and guard run.
 
 | File | If present | If missing or empty |
 |------|------------|---------------------|
@@ -26,6 +26,7 @@ Missing custom files mean “no custom rules for that step”. Built-in credenti
 | `.gitpublic/scan` | Adds custom blocking patterns | Built-in credential rules still protect zero-config scans and guard mode |
 | `.gitpublic/allow` | Exceptions for domain-like matches found by `scan` | No scan exceptions exist |
 | `.gitpublic/domains` | Same as `allow` alias | Nothing is allowlisted |
+| `.gitpublic/public/` | Adds or replaces files in the sanitized public tree | No public-only overlay is applied |
 
 ## `.gitpublic/config`
 
@@ -83,6 +84,17 @@ What it does:
 
 It removes files from Git history in the temporary sanitized clone. It does not edit your private repo.
 
+## `.gitpublic/public/`
+
+Files below this directory are copied into the sanitized tree after delete and
+replace rules. Relative paths are preserved, so
+`.gitpublic/public/README.md` becomes public `README.md`. Overlay files are
+committed and pass the same mandatory secret scan as every other public file.
+
+In `snapshot` mode the overlay is applied before genesis is constructed, so
+the public output still contains exactly one root commit. Symlinks, special
+files, `.git` paths, and destination path escapes are rejected.
+
 ## `.gitpublic/replace`
 
 One replacement per line:
@@ -113,6 +125,10 @@ regex:.*\.corp\.internal ==> example.com
 
 ## `.gitpublic/scan`
 
+Generic scan policy may be tracked when every active rule starts with
+`regex:`. Literal scan rules must remain untracked because the literal itself
+may be private. `.gitpublic/replace` must always remain untracked.
+
 `.gitpublic/scan` adds custom blocking rules. Built-in credential rules are always available for zero-config scans and guard mode.
 
 One rule per line:

{git_private2public-0.2.0 → git_private2public-0.2.1}/docs/ADVANCED.ru.md

@@ -16,7 +16,7 @@
   -> push в публичный репозиторий       (.gitpublic/config)
 ```
 
-Если какого-то файла нет, это значит “нет пользовательских правил для этого шага”. Встроенная проверка известных учётных данных всё равно работает в zero-config и guard-режимах.
+Если какого-то файла нет, это значит “нет пользовательских правил для этого шага”. Встроенная проверка известных учётных данных работает в publish, zero-config и guard-режимах.
 
 | Файл | Если есть | Если файла нет или он пустой |
 |------|-----------|-------------------------------|
@@ -26,6 +26,7 @@
 | `.gitpublic/scan` | добавляет пользовательские блокирующие правила | встроенные правила продолжают работать в zero-config и guard-режимах |
 | `.gitpublic/allow` | исключения для доменов, найденных проверкой `scan` | исключений для проверки нет |
 | `.gitpublic/domains` | alias для `allow` | ничего не разрешается |
+| `.gitpublic/public/` | добавляет или заменяет файлы в очищенном public-дереве | public-only overlay не применяется |
 
 ## `.gitpublic/config`
 
@@ -83,6 +84,17 @@ private/*.json
 
 Это удаляет файлы во временном очищенном clone. Приватный репозиторий не меняется.
 
+## `.gitpublic/public/`
+
+Файлы из этой директории копируются в очищенное дерево после delete и
+replace. Относительные пути сохраняются: `.gitpublic/public/README.md`
+становится публичным `README.md`. Overlay-файлы попадают в public-коммит и
+проходят ту же обязательную проверку секретов.
+
+В `snapshot` overlay применяется до создания genesis, поэтом в публичном результате
+по-прежнему ровно один root-коммит. Symlink, special-файлы, пути `.git` и выход
+через destination path запрещены.
+
 ## `.gitpublic/replace`
 
 По одной замене на строку:
@@ -113,6 +125,10 @@ regex:.*\.corp\.internal ==> example.com
 
 ## `.gitpublic/scan`
 
+Общую scan-политику можно отслеживать в Git, если каждое активное правило
+начинается с `regex:`. Literal scan-правила должны оставаться untracked, потому что
+сам literal может быть приватным. `.gitpublic/replace` всегда должен оставаться untracked.
+
 `.gitpublic/scan` добавляет свои блокирующие правила. Встроенные правила известных секретов доступны без настройки в zero-config и guard-режимах.
 
 По одному правилу на строку:

{git_private2public-0.2.0 → git_private2public-0.2.1}/git_private2public.py

@@ -26,6 +26,7 @@ import json
 import os
 import re
 import shutil
+import stat
 import subprocess
 import sys
 import tempfile
@@ -34,7 +35,7 @@ from pathlib import Path
 import time
 from typing import Iterable
 
-__version__ = "0.2.0"
+__version__ = "0.2.1"
 
 try:
     import yaml
@@ -343,18 +344,31 @@ def clone_source(source: str, dest: Path) -> None:
     # filter-repo works on bare clones too; keep it simple.
 
 
-# Files inside .gitpublic/ that may carry literal secrets in their content
-# (replace patterns or scan rules) and therefore must never be committed.
-GITPUBLIC_SECRET_FILES = ("replace", "scan")
+# Replacement rules may contain private literals and are never safe to track.
+GITPUBLIC_REPLACE_FILE = ".gitpublic/replace"
+
+
+def _is_generic_regex_rule(rule: str) -> bool:
+    """Return true for a valid regex containing real pattern syntax."""
+    if not rule.startswith("regex:"):
+        return False
+    expression = rule[len("regex:"):]
+    try:
+        re.compile(expression)
+    except re.error:
+        return False
+    return bool(
+        re.search(r"(?<!\\)(?:\[|\(|\{|\.|\*|\+|\?|\|)|\\[dDsSwW]", expression)
+    )
 
 
 def check_local_gitpublic_secrets_not_tracked(cwd: str) -> list[str]:
-    """Refuse to publish if .gitpublic/{replace,scan} is tracked in the local repo.
+    """Return tracked policy files that can reveal literal private values.
 
-    Only ``replace`` and ``scan`` may contain literal secrets (e.g.
-    ``whisper.bezrabotnyi.com==>example.com`` or ``XYZ123`` as a scan
-    pattern). The other files in .gitpublic/ — ``config``, ``ignore``,
-    ``allow`` — are safe to commit.
+    ``replace`` is always rejected. A tracked ``scan`` is allowed only when
+    every active rule is explicitly ``regex:``; comments and blank lines are
+    ignored. This permits reusable provider signatures without allowing a
+    literal credential to become part of private Git history.
 
     Returns the list of tracked secret-bearing files. Empty list = OK.
     """
@@ -365,8 +379,26 @@ def check_local_gitpublic_secrets_not_tracked(cwd: str) -> list[str]:
     if res.returncode != 0:
         return []
     tracked = {f for f in res.stdout.splitlines() if f}
-    secret_files = {f".gitpublic/{name}" for name in GITPUBLIC_SECRET_FILES}
-    return sorted(tracked & secret_files)
+    unsafe: list[str] = []
+    if GITPUBLIC_REPLACE_FILE in tracked:
+        unsafe.append(GITPUBLIC_REPLACE_FILE)
+    scan_path = ".gitpublic/scan"
+    if scan_path in tracked:
+        indexed = subprocess.run(
+            ["git", "-C", cwd, "show", f":{scan_path}"],
+            capture_output=True,
+            text=True,
+        )
+        if indexed.returncode != 0:
+            unsafe.append(scan_path)
+        else:
+            rules = [
+                line.strip() for line in indexed.stdout.splitlines()
+                if line.strip() and not line.strip().startswith("#")
+            ]
+            if any(not _is_generic_regex_rule(rule) for rule in rules):
+                unsafe.append(scan_path)
+    return sorted(unsafe)
 
 
 def load_scan_rules(cwd: str, include_defaults: bool = False) -> list[str]:
@@ -567,24 +599,67 @@ def resolve_publish_source(configured_source: str, cwd: Path) -> str:
     return expand_github_shorthand(configured_source)
 
 
-def create_snapshot_root(repo: Path, include_source_sha: bool) -> str:
-    """Replace all history and refs with one neutral commit of the current tree.
+class OverlayError(RuntimeError):
+    """Raised when a public overlay cannot be copied without escaping policy."""
 
-    Args:
-        repo: Normal working clone whose checked-out tree becomes the snapshot.
-        include_source_sha: Add the private source commit ID to the public message.
 
-    Returns:
-        The new root commit ID.
+def _assert_within_worktree(path: Path, worktree: Path) -> None:
+    """Reject a destination whose resolved parent escapes the worktree."""
+    try:
+        path.resolve(strict=False).relative_to(worktree.resolve())
+    except ValueError as exc:
+        raise OverlayError("overlay path escapes public worktree") from exc
 
-    Raises:
-        subprocess.CalledProcessError: If Git cannot construct the snapshot.
+
+def apply_public_overlay(overlay: Path, worktree: Path) -> list[str]:
+    """Copy safe regular overlay files into the sanitized worktree.
+
+    Symlinks, special files, Git metadata paths, and destination symlink chains
+    are rejected so a private checkout cannot redirect writes outside the clone.
     """
-    source_sha = run(["git", "rev-parse", "HEAD"], cwd=str(repo)).stdout.strip()
-    tree = run(["git", "rev-parse", "HEAD^{tree}"], cwd=str(repo)).stdout.strip()
-    message = "Public source snapshot"
-    if include_source_sha:
-        message += f"\n\nSource-Commit: {source_sha}"
+    if overlay.is_symlink():
+        raise OverlayError("public overlay root must not be a symlink")
+    if not overlay.exists():
+        return []
+    if not overlay.is_dir():
+        raise OverlayError("public overlay root must be a real directory")
+
+    copied: list[str] = []
+    for root_text, directories, files in os.walk(overlay, followlinks=False):
+        root = Path(root_text)
+        for directory in directories:
+            entry = root / directory
+            mode = entry.lstat().st_mode
+            if stat.S_ISLNK(mode):
+                raise OverlayError("public overlay contains a symlink")
+            if not stat.S_ISDIR(mode):
+                raise OverlayError("public overlay contains a non-regular directory entry")
+        for filename in files:
+            source = root / filename
+            relative = source.relative_to(overlay)
+            if not relative.parts or relative.parts[0] == ".git" or ".." in relative.parts:
+                raise OverlayError("public overlay path is reserved or escapes its root")
+            mode = source.lstat().st_mode
+            if stat.S_ISLNK(mode):
+                raise OverlayError("public overlay contains a symlink")
+            if not stat.S_ISREG(mode):
+                raise OverlayError("public overlay contains a non-regular file")
+
+            destination = worktree / relative
+            current = worktree
+            for part in relative.parts:
+                current = current / part
+                if current.is_symlink():
+                    raise OverlayError("public overlay destination symlink would escape worktree")
+            _assert_within_worktree(destination.parent, worktree)
+            destination.parent.mkdir(parents=True, exist_ok=True)
+            shutil.copy2(source, destination)
+            copied.append(relative.as_posix())
+    return copied
+
+
+def _neutral_commit_environment() -> dict[str, str]:
+    """Return deterministic, non-private author metadata for generated commits."""
     env = os.environ.copy()
     env.update(
         {
@@ -596,6 +671,52 @@ def create_snapshot_root(repo: Path, include_source_sha: bool) -> str:
             "GIT_COMMITTER_DATE": "2000-01-01T00:00:00Z",
         }
     )
+    return env
+
+
+def commit_public_overlay(repo: Path) -> bool:
+    """Commit staged overlay changes with neutral metadata when changes exist."""
+    run(["git", "add", "-A"], cwd=str(repo))
+    diff = subprocess.run(
+        ["git", "diff", "--cached", "--quiet"], cwd=str(repo), capture_output=True
+    )
+    if diff.returncode == 0:
+        return False
+    if diff.returncode != 1:
+        raise OverlayError("cannot inspect staged public overlay")
+    subprocess.run(
+        ["git", "commit", "-m", "Apply public overlay"],
+        cwd=str(repo), capture_output=True, text=True, check=True,
+        env=_neutral_commit_environment(),
+    )
+    return True
+
+
+def create_snapshot_root(
+    repo: Path,
+    include_source_sha: bool,
+    source_sha: str | None = None,
+) -> str:
+    """Replace all history and refs with one neutral commit of the current tree.
+
+    Args:
+        repo: Normal working clone whose checked-out tree becomes the snapshot.
+        include_source_sha: Add the private source commit ID to the public message.
+        source_sha: Original source ID captured before filtering, when available.
+
+    Returns:
+        The new root commit ID.
+
+    Raises:
+        subprocess.CalledProcessError: If Git cannot construct the snapshot.
+    """
+    if source_sha is None:
+        source_sha = run(["git", "rev-parse", "HEAD"], cwd=str(repo)).stdout.strip()
+    run(["git", "add", "-A"], cwd=str(repo))
+    tree = run(["git", "write-tree"], cwd=str(repo)).stdout.strip()
+    message = "Public source snapshot"
+    if include_source_sha:
+        message += f"\n\nSource-Commit: {source_sha}"
     created = subprocess.run(
         ["git", "commit-tree", tree],
         cwd=str(repo),
@@ -603,7 +724,7 @@ def create_snapshot_root(repo: Path, include_source_sha: bool) -> str:
         capture_output=True,
         text=True,
         check=True,
-        env=env,
+        env=_neutral_commit_environment(),
     )
     commit = created.stdout.strip()
     snapshot_ref = "refs/heads/git-private2public-snapshot"
@@ -767,6 +888,8 @@ def _break_alternates(work_gitdir: Path) -> bool:
 
 def publish(config: Config, scan_only: bool = False, cwd: str | None = None, output_format: str = "text") -> int:
     cwd = cwd or os.getcwd()
+    source_root = find_git_root(Path(cwd)) or Path(cwd).resolve()
+    overlay_path = source_root / ".gitpublic" / "public"
 
     # Only .gitpublic/{replace,scan} may carry literal secrets; the rest
     # (config / ignore / allow) is safe to commit. Refuse early if those
@@ -774,19 +897,17 @@ def publish(config: Config, scan_only: bool = False, cwd: str | None = None, out
     tracked_secrets = check_local_gitpublic_secrets_not_tracked(cwd)
     if tracked_secrets:
         sys.stderr.write(
-            "\u2717 secret-bearing .gitpublic/ files are tracked in your local repo "
+            "\u2717 unsafe .gitpublic policy is tracked in the local repo "
             "\u2014 refusing to publish.\n"
-            "  These files may hold literal secrets inside replace/scan rules;\n"
-            "  pushing them would leak them to the public repo.\n"
+            "  replace rules must stay untracked; tracked scan rules must be valid generic regex:.\n"
         )
         for f in tracked_secrets:
             sys.stderr.write(f"  {f}\n")
         sys.stderr.write(
-            "\n  Fix (keep config/ignore/allow public, hide only replace/scan):\n"
+            "\n  Fix (keep generic regex scan policy tracked if useful):\n"
             "    echo '.gitpublic/replace' >> .gitignore\n"
-            "    echo '.gitpublic/scan'    >> .gitignore\n"
-            "    git rm --cached .gitpublic/replace .gitpublic/scan\n"
-            "    git commit -m 'untrack .gitpublic/{replace,scan}'\n"
+            "    git rm --cached .gitpublic/replace\n"
+            "  Convert scan literals to generic regex rules, or untrack .gitpublic/scan.\n"
         )
         return 1
 
@@ -819,6 +940,7 @@ def publish(config: Config, scan_only: bool = False, cwd: str | None = None, out
         restore_gitdir = backup_info[1] if backup_info else None
         print(f"▸ Cloning {mask_url(source_url)} ...", file=sys.stderr)
         run(["git", "clone", "--no-local", source_url, str(work)])
+        original_source_sha = run(["git", "rev-parse", "HEAD"], cwd=str(work)).stdout.strip()
 
         # Break object-store alternates so filter-repo cannot corrupt source
         _break_alternates(work / ".git")
@@ -826,10 +948,6 @@ def publish(config: Config, scan_only: bool = False, cwd: str | None = None, out
         # Detach origin (filter-repo removes it anyway)
         run(["git", "remote", "remove", "origin"], cwd=str(work), check=False)
 
-        if config.mode == "snapshot":
-            print("▸ Creating one-commit public snapshot ...", file=sys.stderr)
-            create_snapshot_root(work, config.snapshot_include_source_sha)
-
         # Write replace-text file
         replace_file = tmp_path / "replacements.txt"
         if replaces:
@@ -854,6 +972,24 @@ def publish(config: Config, scan_only: bool = False, cwd: str | None = None, out
                 sys.stderr.write(res.stderr)
                 sys.exit("git-filter-repo failed (rc=" + str(res.returncode) + ")" + bk + restore)
 
+        try:
+            overlay_files = apply_public_overlay(overlay_path, work)
+        except OverlayError as exc:
+            print(f"✗ Public overlay rejected: {exc}", file=sys.stderr)
+            return 1
+        if overlay_files:
+            print(f"▸ Applied public overlay ({len(overlay_files)} file(s)).", file=sys.stderr)
+
+        if config.mode == "snapshot":
+            print("▸ Creating one-commit public snapshot ...", file=sys.stderr)
+            create_snapshot_root(
+                work,
+                config.snapshot_include_source_sha,
+                source_sha=original_source_sha,
+            )
+        elif overlay_files:
+            commit_public_overlay(work)
+
         # Scan the complete result before any ref can reach the target. Built-in
         # credential patterns are mandatory and custom rules are additive.
         print("▸ Scanning result and all reachable refs ...", file=sys.stderr)

{git_private2public-0.2.0 → git_private2public-0.2.1}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "git-private2public"
-version = "0.2.0"
+version = "0.2.1"
 description = "Like .gitignore, but for what goes public. Keep a sanitized public mirror of your private repo."
 readme = "README.md"
 license = {text = "MIT"}

{git_private2public-0.2.0 → git_private2public-0.2.1}/tests/test_git_private2public.py

@@ -1,6 +1,7 @@
 from pathlib import Path
 import subprocess
 import json
+import os
 
 import pytest
 
@@ -114,8 +115,8 @@ def test_replace_rule_strips_separator_whitespace():
 
 
 def test_version_constant_matches_package_version():
-    assert g.__version__ == "0.2.0"
-    assert 'version = "0.2.0"' in (Path(__file__).parent.parent / "pyproject.toml").read_text()
+    assert g.__version__ == "0.2.1"
+    assert 'version = "0.2.1"' in (Path(__file__).parent.parent / "pyproject.toml").read_text()
 
 
 def test_gitpublic_secret_check_finds_only_replace_and_scan(tmp_path: Path):
@@ -153,6 +154,46 @@ def test_gitpublic_secret_check_clean_when_only_safe_files_tracked(tmp_path: Pat
     assert g.check_local_gitpublic_secrets_not_tracked(str(repo)) == []
 
 
+def test_gitpublic_secret_check_allows_tracked_generic_regex_scan(tmp_path: Path):
+    repo = tmp_path / "r"
+    repo.mkdir()
+    subprocess.run(["git", "-C", str(repo), "init", "-q"], check=True)
+    gp = repo / ".gitpublic"
+    gp.mkdir()
+    (gp / "scan").write_text(
+        "# Generic provider signatures are safe policy\n"
+        "regex:ghp_[A-Za-z0-9]{30,}\n"
+        "regex:AKIA[0-9A-Z]{16}\n"
+    )
+    subprocess.run(["git", "-C", str(repo), "add", ".gitpublic/scan"], check=True)
+
+    assert g.check_local_gitpublic_secrets_not_tracked(str(repo)) == []
+
+
+def test_gitpublic_secret_check_rejects_tracked_scan_with_literal_rule(tmp_path: Path):
+    repo = tmp_path / "r"
+    repo.mkdir()
+    subprocess.run(["git", "-C", str(repo), "init", "-q"], check=True)
+    gp = repo / ".gitpublic"
+    gp.mkdir()
+    (gp / "scan").write_text("regex:generic-[0-9]+\nactual-private-value\n")
+    subprocess.run(["git", "-C", str(repo), "add", ".gitpublic/scan"], check=True)
+
+    assert g.check_local_gitpublic_secrets_not_tracked(str(repo)) == [".gitpublic/scan"]
+
+
+def test_gitpublic_secret_check_rejects_regex_prefix_without_generic_expression(tmp_path: Path):
+    repo = tmp_path / "r"
+    repo.mkdir()
+    subprocess.run(["git", "-C", str(repo), "init", "-q"], check=True)
+    gp = repo / ".gitpublic"
+    gp.mkdir()
+    (gp / "scan").write_text("regex:actual-private-value\n")
+    subprocess.run(["git", "-C", str(repo), "add", ".gitpublic/scan"], check=True)
+
+    assert g.check_local_gitpublic_secrets_not_tracked(str(repo)) == [".gitpublic/scan"]
+
+
 # ---- guard / default-pattern tests ----------------------------------------- #
 
 def test_load_scan_rules_includes_defaults_when_requested(tmp_path: Path):
@@ -794,6 +835,96 @@ def test_publish_blocks_stale_target_ref_before_writing_configured_head(tmp_path
     assert refs == ["refs/heads/stale"]
 
 
+def test_snapshot_overlay_replaces_private_readme_without_source_history(tmp_path: Path):
+    source = tmp_path / "private"
+    target = tmp_path / "public.git"
+    source.mkdir()
+    subprocess.run(["git", "init", "-q", str(source)], check=True)
+    subprocess.run(["git", "init", "-q", "--bare", str(target)], check=True)
+    subprocess.run(["git", "-C", str(source), "config", "user.email", "private@example.test"], check=True)
+    subprocess.run(["git", "-C", str(source), "config", "user.name", "Private Person"], check=True)
+    (source / "README.md").write_text("private internal instructions\n")
+    subprocess.run(["git", "-C", str(source), "add", "README.md"], check=True)
+    subprocess.run(["git", "-C", str(source), "commit", "-q", "-m", "private history"], check=True)
+    overlay = source / ".gitpublic" / "public"
+    overlay.mkdir(parents=True)
+    (overlay / "README.md").write_text("# Public project\n")
+    cfg = g.Config(source=str(source), target=str(target), delete=["README.md"], mode="snapshot")
+
+    assert g.publish(cfg, cwd=str(source)) == 0
+
+    public_readme = subprocess.run(
+        ["git", "--git-dir", str(target), "show", "refs/heads/main:README.md"],
+        capture_output=True, text=True, check=True,
+    ).stdout
+    count = subprocess.run(
+        ["git", "--git-dir", str(target), "rev-list", "--count", "refs/heads/main"],
+        capture_output=True, text=True, check=True,
+    ).stdout.strip()
+    log = subprocess.run(
+        ["git", "--git-dir", str(target), "log", "--format=%an%n%ae%n%s", "refs/heads/main"],
+        capture_output=True, text=True, check=True,
+    ).stdout
+    assert public_readme == "# Public project\n"
+    assert count == "1"
+    assert "Private Person" not in log
+    assert "private history" not in log
+
+
+def test_public_overlay_rejects_symlinks_and_non_regular_files(tmp_path: Path):
+    overlay = tmp_path / "overlay"
+    work = tmp_path / "work"
+    overlay.mkdir()
+    work.mkdir()
+    (overlay / "link").symlink_to(tmp_path / "outside")
+
+    with pytest.raises(g.OverlayError, match="symlink"):
+        g.apply_public_overlay(overlay, work)
+
+    (overlay / "link").unlink()
+    fifo = overlay / "pipe"
+    fifo.parent.mkdir(exist_ok=True)
+    os.mkfifo(fifo)
+    with pytest.raises(g.OverlayError, match="non-regular"):
+        g.apply_public_overlay(overlay, work)
+
+
+def test_public_overlay_rejects_destination_symlink_escape(tmp_path: Path):
+    overlay = tmp_path / "overlay"
+    work = tmp_path / "work"
+    outside = tmp_path / "outside"
+    (overlay / "nested").mkdir(parents=True)
+    (overlay / "nested" / "README.md").write_text("public\n")
+    work.mkdir()
+    outside.mkdir()
+    (work / "nested").symlink_to(outside, target_is_directory=True)
+
+    with pytest.raises(g.OverlayError, match="destination symlink"):
+        g.apply_public_overlay(overlay, work)
+
+    assert not (outside / "README.md").exists()
+
+
+def test_overlay_content_is_scanned_before_push(tmp_path: Path):
+    source = tmp_path / "private"
+    target = tmp_path / "public.git"
+    source.mkdir()
+    subprocess.run(["git", "init", "-q", str(source)], check=True)
+    subprocess.run(["git", "init", "-q", "--bare", str(target)], check=True)
+    subprocess.run(["git", "-C", str(source), "config", "user.email", "[email protected]"], check=True)
+    subprocess.run(["git", "-C", str(source), "config", "user.name", "Test"], check=True)
+    (source / "safe.txt").write_text("safe\n")
+    subprocess.run(["git", "-C", str(source), "add", "safe.txt"], check=True)
+    subprocess.run(["git", "-C", str(source), "commit", "-q", "-m", "safe"], check=True)
+    overlay = source / ".gitpublic" / "public"
+    overlay.mkdir(parents=True)
+    (overlay / "credential.txt").write_text("ghp_" + "A" * 36 + "\n")
+    cfg = g.Config(source=str(source), target=str(target), mode="snapshot")
+
+    assert g.publish(cfg, cwd=str(source)) == 1
+    assert subprocess.run(["git", "--git-dir", str(target), "show-ref"], capture_output=True).returncode == 1
+
+
 def test_doctor_reports_missing_tools_and_config(tmp_path: Path, monkeypatch, capsys):
     monkeypatch.chdir(tmp_path)
     monkeypatch.setattr(g.shutil, "which", lambda name: None)