gitgalaxy 2.3.15__tar.gz → 2.3.17__tar.gz

{gitgalaxy-2.3.15 → gitgalaxy-2.3.17}/.github/workflows/publish.yml

@@ -25,6 +25,14 @@ jobs:
         with:
           fetch-depth: 0
 
+      - name: Enforce Main Branch Tagging
+        run: |
+          git fetch origin main
+          if ! git branch -r --contains ${{ github.sha }} | grep -q "origin/main"; then
+            echo "🛑 ERROR: Tag was cut from a side branch. Releases are only allowed from main."
+            exit 1
+          fi
+
       - name: Set up Python
         uses: actions/setup-python@v6
         with:

{gitgalaxy-2.3.15 → gitgalaxy-2.3.17}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: gitgalaxy
-Version: 2.3.15
+Version: 2.3.17
 Summary: An AST-free, LLM-free zero-trust static analysis engine for mapping architectural risk, securing CI/CD pipelines, and modernizing legacy monoliths.
 Author: Joe Esquibel
 Project-URL: Homepage, https://gitgalaxy.io

{gitgalaxy-2.3.15 → gitgalaxy-2.3.17}/action.yml

@@ -16,7 +16,7 @@ inputs:
     required: true
     default: '.'
   args:
-    description: 'Additional CLI arguments to pass to the tool (e.g., --sarif-only, --sbom-only, --fail-on-secrets, --fail-on-malware, --max-risk-exposure 85.0).'
+    description: 'Additional CLI arguments to pass to the tool (e.g., --sarif-only, --sbom-only, --fail-on-secrets, --fail-on-malware, --max-systemic-threat 150.0).'
     required: false
     default: ''
   version:

{gitgalaxy-2.3.15 → gitgalaxy-2.3.17}/gitgalaxy/galaxyscope.py

@@ -840,9 +840,9 @@ class Orchestrator:
             # PHASE 10.5: CI/CD POLICY ENFORCEMENT GATE
             # ==========================================================
             self.policy_failed = False
-            max_risk_allowed = self.config.get("MAX_RISK_EXPOSURE", 0.0)
+            max_systemic_threat = self.config.get("MAX_SYSTEMIC_THREAT", 0.0)
             
-            if self.config.get("FAIL_ON_SECRETS") or self.config.get("FAIL_ON_MALWARE") or max_risk_allowed > 0.0:
+            if self.config.get("FAIL_ON_SECRETS") or self.config.get("FAIL_ON_MALWARE") or max_systemic_threat > 0.0:
                 logger.info("🛡️ Evaluating CI/CD Threat Thresholds...")
                 
                 from gitgalaxy.metrics.signal_processor import SignalProcessor
@@ -890,12 +890,18 @@ class Orchestrator:
                         logger.critical(f"BUILD FAILED: Behavioral malware signature ({ai_class}) detected in {file_data.get('path', 'unknown')}")
                         self.policy_failed = True
                         
-                    # 3. Maximum Risk Exposure Ratchet
-                    if max_risk_allowed > 0.0:
+                    # 3. Systemic Threat Ceiling (Cumulative Risk * Blast Radius)
+                    if max_systemic_threat > 0.0:
                         risk_vec = file_data.get("risk_vector", [])
-                        highest_risk = max(risk_vec) if isinstance(risk_vec, list) and risk_vec else 0.0
-                        if highest_risk >= max_risk_allowed:
-                            logger.critical(f"BUILD FAILED: {file_data.get('path', 'unknown')} exceeded maximum risk threshold ({highest_risk}% >= {max_risk_allowed}%)")
+                        cumulative_risk = sum(r for r in risk_vec if isinstance(r, (int, float)) and r > 0.0) if risk_vec else 0.0
+                        
+                        net_metrics = file_data.get("telemetry", {}).get("network_metrics", {})
+                        blast_radius = net_metrics.get("normalized_blast_radius", 0.0)
+                        
+                        systemic_threat = cumulative_risk * blast_radius
+                        
+                        if systemic_threat >= max_systemic_threat:
+                            logger.critical(f"BUILD FAILED: {file_data.get('path', 'unknown')} exceeded Systemic Threat limit ({systemic_threat:.1f} >= {max_systemic_threat}). Cumulative Risk: {cumulative_risk:.1f} | Blast Radius: {blast_radius:.3f}")
                             self.policy_failed = True
 
             # ==========================================================

{gitgalaxy-2.3.15 → gitgalaxy-2.3.17}/gitgalaxy.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: gitgalaxy
-Version: 2.3.15
+Version: 2.3.17
 Summary: An AST-free, LLM-free zero-trust static analysis engine for mapping architectural risk, securing CI/CD pipelines, and modernizing legacy monoliths.
 Author: Joe Esquibel
 Project-URL: Homepage, https://gitgalaxy.io

{gitgalaxy-2.3.15 → gitgalaxy-2.3.17}/gitgalaxy.egg-info/scm_version.json

@@ -1,7 +1,7 @@
 {
-  "tag": "2.3.15",
+  "tag": "2.3.17",
   "distance": 0,
-  "node": "g25013572909fdf2fb5373c8e98e26f4188a7a0d0",
+  "node": "g160e8fe5c827b1f16c6b9db8dcf0d6448d870c97",
   "dirty": false,
   "branch": "HEAD",
   "node_date": "2026-07-13"