git-private2public 0.2.3__tar.gz → 0.2.4__tar.gz

{git_private2public-0.2.3 → git_private2public-0.2.4}/CHANGELOG.md

@@ -1,5 +1,10 @@
 # Changelog
 
+## 0.2.4
+
+- Scan preserved public release tags before publishing and retain only their redacted pre-existing findings.
+- Independently reject any new scan findings after publication while keeping unchanged tag refs intact.
+
 ## 0.2.3
 
 - Preserve existing public target tags unchanged during snapshot publication when explicitly enabled.

{git_private2public-0.2.3 → git_private2public-0.2.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: git-private2public
-Version: 0.2.3
+Version: 0.2.4
 Summary: Like .gitignore, but for what goes public. Keep a sanitized public mirror of your private repo.
 Project-URL: Homepage, https://github.com/megamen32/git-private2public
 Project-URL: Repository, https://github.com/megamen32/git-private2public

{git_private2public-0.2.3 → git_private2public-0.2.4}/git_private2public.py

@@ -35,7 +35,7 @@ from pathlib import Path
 import time
 from typing import Iterable
 
-__version__ = "0.2.3"
+__version__ = "0.2.4"
 
 try:
     import yaml
@@ -898,6 +898,35 @@ def _verify_target_refs_exact(url: str, expected_refs: dict[str, str]) -> None:
         raise SystemExit(f"post-push target refs differ: {'; '.join(details)}")
 
 
+def _target_tag_scan_refs(repo: Path, tags: dict[str, str]) -> list[str]:
+    """Fetch preserved tags into an isolated namespace and return exact refs."""
+    if not tags:
+        return []
+    run(
+        ["git", "fetch", "--quiet", "--no-tags", "target", "+refs/tags/*:refs/target-tags/*"],
+        cwd=str(repo),
+    )
+    lines = run(
+        ["git", "for-each-ref", "--format=%(objectname) %(refname)", "refs/target-tags/"],
+        cwd=str(repo),
+    ).stdout.splitlines()
+    actual = {}
+    refs = []
+    for line in lines:
+        object_id, ref_name = line.split(maxsplit=1)
+        remote_ref = "refs/tags/" + ref_name.removeprefix("refs/target-tags/")
+        actual[remote_ref] = object_id
+        refs.append(ref_name)
+    if actual != tags:
+        raise SystemExit("public target tags changed while their baseline was scanned")
+    return sorted(refs)
+
+
+def _new_violations(current: list[str], preserved_baseline: list[str]) -> list[str]:
+    """Find new findings while retaining unchanged historical public tags."""
+    return sorted(set(current) - set(preserved_baseline))
+
+
 def _local_publish_refs(work: Path, config: Config, head: str) -> dict[str, str]:
     """Build the exact remote ref set that a successful publish must expose."""
     expected = {f"refs/heads/{branch}": head for branch in config.push_branches}
@@ -1138,11 +1167,34 @@ def publish(config: Config, scan_only: bool = False, cwd: str | None = None, out
             preserve_target_tags=config.preserve_target_tags,
         )
         _verify_target_tags_unchanged(expected_target_tags, preserved_target_tags)
+        run(["git", "remote", "add", "target", target_url], cwd=str(work))
+        tag_refs = _target_tag_scan_refs(work, preserved_target_tags)
+        try:
+            preserved_tag_findings = scan_history(
+                work,
+                effective_scan_rules(config.fail_on_match),
+                config.allow_domains,
+                refs=tag_refs,
+                scan_ignore=config.scan_ignore,
+            )
+        except ScanError as exc:
+            raise SystemExit(f"preserved public tag scan incomplete: {exc}") from exc
+        if preserved_tag_findings:
+            print(
+                f"ℹ Preserving {len(preserved_target_tags)} existing public tag(s) with "
+                f"{len(preserved_tag_findings)} pre-existing scan finding(s); checking that "
+                "the publication adds none.",
+                file=sys.stderr,
+            )
+        latest_target_tags = {
+            ref: sha for ref, sha in _remote_refs(target_url).items()
+            if ref.startswith("refs/tags/")
+        }
+        _verify_target_tags_unchanged(expected_target_tags, latest_target_tags)
         expected_public_refs.update(preserved_target_tags)
 
         # Push to target
         print(f"▸ Pushing to {mask_url(target_url)} ...", file=sys.stderr)
-        run(["git", "remote", "add", "target", target_url], cwd=str(work))
 
         if config.preserve_target_tags:
             print(
@@ -1194,8 +1246,23 @@ def publish(config: Config, scan_only: bool = False, cwd: str | None = None, out
                 )
             except ScanError as exc:
                 raise SystemExit(f"post-push target scan incomplete: {exc}") from exc
-            if verify_violations:
-                raise SystemExit("post-push target scan found violations")
+            new_findings = _new_violations(verify_violations, preserved_tag_findings)
+            if new_findings:
+                print(
+                    f"✗ Post-push scan found {len(new_findings)} new violation(s):",
+                    file=sys.stderr,
+                )
+                for finding in new_findings[:30]:
+                    print(f"  {finding}", file=sys.stderr)
+                if len(new_findings) > 30:
+                    print(f"  ... and {len(new_findings) - 30} more", file=sys.stderr)
+                raise SystemExit("post-push target scan found new violations")
+            if preserved_tag_findings:
+                print(
+                    f"✓ Published tree adds no findings; {len(preserved_tag_findings)} "
+                    "pre-existing finding(s) remain only through unchanged public history.",
+                    file=sys.stderr,
+                )
             print("✓ Published target independently re-scanned.", file=sys.stderr)
         else:
             print(

{git_private2public-0.2.3 → git_private2public-0.2.4}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "git-private2public"
-version = "0.2.3"
+version = "0.2.4"
 description = "Like .gitignore, but for what goes public. Keep a sanitized public mirror of your private repo."
 readme = "README.md"
 license = {text = "MIT"}

{git_private2public-0.2.3 → git_private2public-0.2.4}/tests/test_git_private2public.py

@@ -185,8 +185,8 @@ def test_replace_rule_strips_separator_whitespace():
 
 
 def test_version_constant_matches_package_version():
-    assert g.__version__ == "0.2.3"
-    assert 'version = "0.2.3"' in (Path(__file__).parent.parent / "pyproject.toml").read_text()
+    assert g.__version__ == "0.2.4"
+    assert 'version = "0.2.4"' in (Path(__file__).parent.parent / "pyproject.toml").read_text()
 
 
 def test_gitpublic_secret_check_finds_only_replace_and_scan(tmp_path: Path):
@@ -1064,7 +1064,7 @@ def test_snapshot_prunes_secret_in_removed_private_history_before_scan(tmp_path:
     assert public_files == ["safe.txt"]
 
 
-def test_snapshot_publish_preserves_existing_public_release_tags(tmp_path: Path):
+def test_snapshot_publish_preserves_existing_public_release_tags_and_finds_no_new_leaks(tmp_path: Path, capfd):
     source = tmp_path / "private"
     seed = tmp_path / "seed"
     target = tmp_path / "public.git"
@@ -1081,7 +1081,9 @@ def test_snapshot_publish_preserves_existing_public_release_tags(tmp_path: Path)
         subprocess.run(["git", "-C", str(repo), "config", "user.name", name], check=True)
         subprocess.run(["git", "-C", str(repo), "config", "user.email", email], check=True)
 
-    (seed / "public.txt").write_text("previous release\n")
+    # A previously published dummy credential-shaped fixture remains reachable
+    # only through immutable release tags. Its source and value stay redacted.
+    (seed / "public.txt").write_text("previous release " + "sk-" + "x" * 20 + "\n")
     subprocess.run(["git", "-C", str(seed), "add", "public.txt"], check=True)
     subprocess.run(["git", "-C", str(seed), "commit", "-q", "-m", "previous public snapshot"], check=True)
     subprocess.run(["git", "-C", str(seed), "tag", "node-v1024"], check=True)
@@ -1104,6 +1106,9 @@ def test_snapshot_publish_preserves_existing_public_release_tags(tmp_path: Path)
         push_force=True, preserve_target_tags=True,
     )
     assert g.publish(cfg, cwd=str(source)) == 0
+    publish_output = capfd.readouterr().err
+    assert "pre-existing scan finding(s)" in publish_output
+    assert "publication adds none" in publish_output
 
     after_tags = subprocess.run(
         ["git", "--git-dir", str(target), "for-each-ref", "--format=%(objectname) %(refname)", "refs/tags/"],