git-private2public 0.2.1__tar.gz → 0.2.2__tar.gz

{git_private2public-0.2.1 → git_private2public-0.2.2}/CHANGELOG.md

@@ -1,5 +1,10 @@
 # Changelog
 
+## 0.2.2
+
+- Fail closed with a concise redacted error when target-ref preflight times out.
+- Prevent Git remote errors from echoing credential-bearing target URLs.
+
 ## 0.2.1
 
 - Add `.gitpublic/public/` overlays for public-only files after sanitization.

{git_private2public-0.2.1 → git_private2public-0.2.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: git-private2public
-Version: 0.2.1
+Version: 0.2.2
 Summary: Like .gitignore, but for what goes public. Keep a sanitized public mirror of your private repo.
 Project-URL: Homepage, https://github.com/megamen32/git-private2public
 Project-URL: Repository, https://github.com/megamen32/git-private2public

{git_private2public-0.2.1 → git_private2public-0.2.2}/git_private2public.py

@@ -35,7 +35,7 @@ from pathlib import Path
 import time
 from typing import Iterable
 
-__version__ = "0.2.1"
+__version__ = "0.2.2"
 
 try:
     import yaml
@@ -739,12 +739,14 @@ def create_snapshot_root(
 
 
 def _remote_ref_sha(url: str, ref: str) -> str:
-    res = subprocess.run(
-        ["git", "ls-remote", url, ref], capture_output=True, text=True, timeout=30
-    )
+    try:
+        res = subprocess.run(
+            ["git", "ls-remote", url, ref], capture_output=True, text=True, timeout=30
+        )
+    except subprocess.TimeoutExpired:
+        raise SystemExit("cannot read target ref: operation timed out") from None
     if res.returncode != 0:
-        err = (res.stderr or res.stdout).strip()
-        raise SystemExit(f"cannot read target ref {ref}: {err}")
+        raise SystemExit("cannot read target ref")
     line = res.stdout.strip().splitlines()
     return line[0].split()[0] if line else ""
 
@@ -758,8 +760,8 @@ def _remote_refs(url: str) -> dict[str, str]:
             text=True,
             timeout=30,
         )
-    except subprocess.TimeoutExpired as exc:
-        raise SystemExit("cannot enumerate target refs: operation timed out") from exc
+    except subprocess.TimeoutExpired:
+        raise SystemExit("cannot enumerate target refs: operation timed out") from None
     if result.returncode != 0:
         raise SystemExit("cannot enumerate target refs")
     refs: dict[str, str] = {}

{git_private2public-0.2.1 → git_private2public-0.2.2}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "git-private2public"
-version = "0.2.1"
+version = "0.2.2"
 description = "Like .gitignore, but for what goes public. Keep a sanitized public mirror of your private repo."
 readme = "README.md"
 license = {text = "MIT"}

{git_private2public-0.2.1 → git_private2public-0.2.2}/tests/test_git_private2public.py

@@ -115,8 +115,8 @@ def test_replace_rule_strips_separator_whitespace():
 
 
 def test_version_constant_matches_package_version():
-    assert g.__version__ == "0.2.1"
-    assert 'version = "0.2.1"' in (Path(__file__).parent.parent / "pyproject.toml").read_text()
+    assert g.__version__ == "0.2.2"
+    assert 'version = "0.2.2"' in (Path(__file__).parent.parent / "pyproject.toml").read_text()
 
 
 def test_gitpublic_secret_check_finds_only_replace_and_scan(tmp_path: Path):
@@ -462,6 +462,22 @@ def test_remote_ref_sha_reads_exact_sha(monkeypatch):
     assert g._remote_ref_sha("example", "refs/heads/main") == sha
 
 
+def test_remote_ref_sha_timeout_fails_closed_without_url_leak(monkeypatch):
+    secret_url = "https://x-access-token:super-secret-token@example.test/private.git"
+
+    def timeout(*args, **kwargs):
+        raise subprocess.TimeoutExpired(args[0], timeout=30)
+
+    monkeypatch.setattr(g.subprocess, "run", timeout)
+    with pytest.raises(SystemExit) as error:
+        g._remote_ref_sha(secret_url, "refs/heads/main")
+
+    message = str(error.value)
+    assert message == "cannot read target ref: operation timed out"
+    assert secret_url not in message
+    assert "super-secret-token" not in message
+
+
 @pytest.mark.parametrize(
     "unexpected_ref",
     ["refs/heads/stale", "refs/tags/stale", "refs/notes/private"],