opsscript-gate 0.1.2__tar.gz

opsscript_gate-0.1.2/.gitattributes

@@ -0,0 +1,9 @@
+# Auto-detect text files and perform LF normalization
+* text=auto eol=lf
+
+# Force shell scripts to strictly retain LF line endings
+*.sh text eol=lf
+*.yml text eol=lf
+*.yaml text eol=lf
+*.toml text eol=lf
+*.py text eol=lf

opsscript_gate-0.1.2/.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,41 @@
+name: Bug Report
+description: File an issue about an unexpected failure or compatibility bug in opsscript-gate
+title: "[BUG] "
+labels: ["bug"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Thanks for taking the time to report an issue! Please provide as much detail as possible.
+  - type: textarea
+    id: description
+    attributes:
+      label: Bug Description
+      description: A clear and concise description of what happened.
+      placeholder: What went wrong?
+    validations:
+      required: true
+  - type: textarea
+    id: script
+    attributes:
+      label: Reproducible Shell Script
+      description: Provide a minimal shell script snippet reproducing the issue.
+      render: bash
+    validations:
+      required: true
+  - type: textarea
+    id: logs
+    attributes:
+      label: Output / Failure Diagnostics
+      description: Terminal output or GitHub Actions step summary.
+      render: text
+    validations:
+      required: true
+  - type: input
+    id: environment
+    attributes:
+      label: Environment Info
+      description: Operating system, Docker version, Python version, opsscript-gate version.
+      placeholder: Ubuntu 24.04, Docker 27.2, Python 3.12, opsscript-gate 0.1.1
+    validations:
+      required: false

opsscript_gate-0.1.2/.github/ISSUE_TEMPLATE/distro_request.yml

@@ -0,0 +1,33 @@
+name: Distribution Support Request
+description: Request adding a new Linux distribution or version to the default matrix
+title: "[DISTRO] Support "
+labels: ["distro-matrix"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Suggesting a new Linux distribution? Please ensure an official public image exists and boots without interactive init.
+  - type: input
+    id: distro_image
+    attributes:
+      label: Proposed Docker Image
+      description: The official public container image tag.
+      placeholder: e.g. fedora:40, rockylinux:9
+    validations:
+      required: true
+  - type: textarea
+    id: use_case
+    attributes:
+      label: Rationale & Use Case
+      description: Why is testing this distribution valuable for production ops scripts?
+    validations:
+      required: true
+  - type: checkboxes
+    id: checks
+    attributes:
+      label: Distribution Compatibility Checklist
+      options:
+        - label: Image provides a standard POSIX /bin/sh.
+          required: true
+        - label: Container starts without systemd or interactive configuration.
+          required: true

opsscript_gate-0.1.2/.github/ISSUE_TEMPLATE/feature_request.yml

@@ -0,0 +1,33 @@
+name: Feature Request
+description: Suggest an idea or architectural improvement for opsscript-gate
+title: "[FEATURE] "
+labels: ["enhancement"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        We appreciate feature suggestions! Please note our security boundaries: no privileged containers, read-only script mounts, and timeouts.
+  - type: textarea
+    id: problem
+    attributes:
+      label: Problem Statement
+      description: What problem are you trying to solve?
+    validations:
+      required: true
+  - type: textarea
+    id: solution
+    attributes:
+      label: Proposed Solution
+      description: Describe your proposed change or command option.
+    validations:
+      required: true
+  - type: checkboxes
+    id: security_check
+    attributes:
+      label: Security Assessment
+      description: Please verify that this proposal adheres to unprivileged runtime boundaries.
+      options:
+        - label: Does NOT require container privilege or root access on the host.
+          required: true
+        - label: Respects timeouts and non-interactive execution.
+          required: true

opsscript_gate-0.1.2/.github/pull_request_template.md

@@ -0,0 +1,18 @@
+## Description
+
+Briefly describe the change and the motivation behind it.
+
+## Changes Made
+- 
+
+## Runner Safety Verification
+Please check all that apply:
+- [ ] Unprivileged mode maintained (`privileged=False`)
+- [ ] Capabilities drop maintained (`cap_drop=["ALL"]`)
+- [ ] `no-new-privileges:true` maintained
+- [ ] Target scripts remain mounted read-only (`:ro`)
+- [ ] Timeout and container cleanup logic preserved
+
+## Testing
+- [ ] Unit tests added/updated (`pytest -v -m "not integration"`)
+- [ ] All tests passing locally

opsscript_gate-0.1.2/.github/workflows/demo.yml

@@ -0,0 +1,55 @@
+name: Demo Shell Script Compatibility Gate
+
+on:
+  push:
+    branches: [ main ]
+  workflow_dispatch:
+
+jobs:
+  compatibility-demo:
+    name: Cross-Distro Compatibility Demos
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v7
+
+      # Scenario 1: Fully compatible POSIX script passes on all 4 distributions
+      - name: "Scenario 1: POSIX script verification (Expect: ALL PASS)"
+        uses: ./
+        with:
+          script-path: 'tests/fixtures/pass_basic.sh'
+          matrix: 'debian:12-slim,ubuntu:22.04,ubuntu:24.04,alpine:3.20'
+          timeout: '30'
+          format: 'table'
+
+      # Scenario 2: Alpine catches missing apt-get dependency (exit 127 intercepted)
+      - name: "Scenario 2: Missing dependency interception (Expect: Alpine FAIL 127)"
+        id: demo_fail_deps
+        continue-on-error: true
+        uses: ./
+        with:
+          script-path: 'tests/fixtures/fail_deps.sh'
+          matrix: 'debian:12-slim,ubuntu:22.04,ubuntu:24.04,alpine:3.20'
+          timeout: '30'
+          format: 'table'
+
+      - name: Verify Scenario 2 Interception
+        if: steps.demo_fail_deps.outcome == 'failure'
+        run: |
+          echo "::notice title=Interception Verified::Successfully caught missing apt-get on Alpine (Exit code 127 intercepted)!"
+
+      # Scenario 3: Script waiting for interactive input terminated immediately by /dev/null
+      - name: "Scenario 3: Interactive hang defense (Expect: /dev/null EOF failure intercepted)"
+        id: demo_fail_hang
+        continue-on-error: true
+        uses: ./
+        with:
+          script-path: 'tests/fixtures/fail_hang.sh'
+          matrix: 'alpine:3.20'
+          timeout: '15'
+          format: 'table'
+
+      - name: Verify Scenario 3 Interception
+        if: steps.demo_fail_hang.outcome == 'failure'
+        run: |
+          echo "::notice title=Anti-Hang Verified::Interactive prompt prevented from hanging CI by automatic /dev/null redirection!"

opsscript_gate-0.1.2/.github/workflows/release.yml

@@ -0,0 +1,121 @@
+name: Build and Release
+
+on:
+  push:
+    tags:
+      - 'v*'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  test:
+    name: Run Test Suite
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout Code
+        uses: actions/checkout@v7
+
+      - name: Set up Python
+        uses: actions/setup-python@v7
+        with:
+          python-version: '3.12'
+
+      - name: Install Dependencies
+        run: |
+          python -m pip install --upgrade pip
+          pip install -e .[test]
+
+      - name: Run Tests
+        run: |
+          pytest -v -m "not integration"
+
+  build:
+    name: Build Distribution Packages
+    needs: test
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - name: Checkout Code
+        uses: actions/checkout@v7
+
+      - name: Set up Python
+        uses: actions/setup-python@v7
+        with:
+          python-version: '3.12'
+
+      - name: Verify Version Consistency
+        shell: bash
+        run: |
+          TOML_VERSION=$(python -c "import tomllib; f=open('pyproject.toml', 'rb'); print(tomllib.load(f)['project']['version'])")
+          INIT_VERSION=$(python -c "import sys; sys.path.insert(0, 'src'); import opsscript_gate; print(opsscript_gate.__version__)")
+
+          echo "pyproject.toml version: $TOML_VERSION"
+          echo "opsscript_gate version: $INIT_VERSION"
+
+          if [ "$TOML_VERSION" != "$INIT_VERSION" ]; then
+            echo "::error::Version mismatch: pyproject.toml ($TOML_VERSION) != __init__.py ($INIT_VERSION)"
+            exit 1
+          fi
+
+          if [[ "${{ github.ref }}" =~ ^refs/tags/v ]]; then
+            TAG_VERSION="${GITHUB_REF_NAME#v}"
+            echo "Git tag version: $TAG_VERSION"
+            if [ "$TAG_VERSION" != "$TOML_VERSION" ]; then
+              echo "::error::Tag mismatch: Git tag v$TAG_VERSION does not match project version $TOML_VERSION"
+              exit 1
+            fi
+          fi
+
+          echo "Version consistency verified: $TOML_VERSION"
+
+      - name: Install build tools
+        run: |
+          python -m pip install --upgrade pip
+          pip install build twine
+
+      - name: Build sdist and wheel
+        run: |
+          python -m build
+
+      - name: Verify Package Metadata
+        run: |
+          python -m twine check dist/*
+
+      - name: Upload dist artifacts
+        uses: actions/upload-artifact@v4
+        with:
+          name: dist
+          path: dist/
+          retention-days: 7
+
+      - name: Create GitHub Release and Upload Assets
+        uses: softprops/action-gh-release@v2
+        if: startsWith(github.ref, 'refs/tags/v')
+        with:
+          files: dist/*
+          generate_release_notes: true
+
+  publish-pypi:
+    name: Publish to PyPI via OIDC
+    needs: [test, build]
+    if: startsWith(github.ref, 'refs/tags/v')
+    runs-on: ubuntu-latest
+    environment:
+      name: pypi
+      url: https://pypi.org/p/opsscript-gate
+    permissions:
+      id-token: write
+    steps:
+      - name: Download dist artifacts
+        uses: actions/download-artifact@v4
+        with:
+          name: dist
+          path: dist
+
+      - name: Publish package distributions to PyPI
+        uses: pypa/gh-action-pypi-publish@release/v1
+        with:
+          packages-dir: dist/

opsscript_gate-0.1.2/.github/workflows/test.yml

@@ -0,0 +1,28 @@
+name: Test opsscript-gate
+
+on:
+  push:
+    branches: [ main, test ]
+  pull_request:
+    branches: [ main, test ]
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout Code
+        uses: actions/checkout@v7
+
+      - name: Set up Python
+        uses: actions/setup-python@v7
+        with:
+          python-version: '3.12'
+
+      - name: Install Dependencies
+        run: |
+          python -m pip install --upgrade pip
+          pip install -e .[test]
+
+      - name: Run Pytest
+        run: |
+          pytest -v -m "not integration"

opsscript_gate-0.1.2/.gitignore

@@ -0,0 +1,52 @@
+# Byte-compiled / optimized / DLL files
+__pycache__/
+*.py[cod]
+*$py.class
+
+# Distribution / packaging
+.Python
+build/
+develop-eggs/
+dist/
+downloads/
+eggs/
+.eggs/
+lib/
+lib64/
+parts/
+sdist/
+var/
+wheels/
+share/python-wheels/
+*.egg-info/
+.installed.cfg
+*.egg
+MANIFEST
+
+# Pytest / Test / Coverage
+.pytest_cache/
+.coverage
+.coverage.*
+.cache
+nosetests.xml
+coverage.xml
+*.cover
+*.log
+
+# Environments
+.env
+.venv
+env/
+venv/
+ENV/
+env.bak/
+venv.bak/
+
+# IDE & OS files
+.vscode/
+.idea/
+*.swp
+*.swo
+*~
+.DS_Store
+Thumbs.db

opsscript_gate-0.1.2/CHANGELOG.md

@@ -0,0 +1,43 @@
+# Changelog
+
+All notable changes to this project will be documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [0.1.2] - 2026-09-18
+
+### Added
+- Configured PyPI Trusted Publishing via GitHub Actions OIDC (`pypa/gh-action-pypi-publish`).
+- Added full PyPI package metadata, classifiers, and project URLs to `pyproject.toml`.
+- Ensured absolute asset URLs in `README.md` for seamless PyPI rendering.
+
+---
+
+## [0.1.1] - 2026-09-18
+
+### Added
+- Created `examples/` directory showcasing basic setup, Alpine package manager incompatibility, and interactive hang prevention.
+- Added GitHub Issue templates for bug reports, feature requests, and distribution support requests.
+- Added `CONTRIBUTING.md`, `SECURITY.md`, and `ROADMAP.md`.
+- Enforced `security_opt=["no-new-privileges:true"]` on all container executions.
+
+### Fixed
+- Upgraded GitHub Actions dependencies to `actions/checkout@v7` and `actions/setup-python@v7` (Node 24 runtime).
+- Fixed secret referencing syntax in release workflow to ensure reliable binary asset uploads.
+
+---
+
+## [0.1.0] - 2026-09-18
+
+### Added
+- Initial MVP release of `opsscript-gate`.
+- CLI entrypoint (`opsscript-gate run <script_path>`).
+- Unprivileged container isolation engine supporting `debian:12-slim`, `ubuntu:22.04`, `ubuntu:24.04`, and `alpine:3.20`.
+- Safe read-only script mounting (`:ro`).
+- Hard per-container timeout with forced `SIGKILL` and cleanup.
+- Stdin disconnection (`</dev/null`) and non-interactive environment enforcement.
+- Windows CRLF line-ending normalization defense.
+- Unified ASCII table, GitHub Actions Step Summary Markdown, and JSON reporting formats.
+- Composite GitHub Action published to Marketplace.
+- Unit and integration test suite.

opsscript_gate-0.1.2/CONTRIBUTING.md

@@ -0,0 +1,82 @@
+# Contributing to OpsScript Gate
+
+Thank you for your interest in contributing to **OpsScript Gate**! We welcome bug reports, compatibility test fixtures, feature suggestions, and pull requests.
+
+---
+
+## Development Setup
+
+OpsScript Gate requires **Python 3.10+** and a standard virtual environment.
+
+```bash
+# Clone the repository
+git clone https://github.com/Mresyzz/opsscript-gate.git
+cd opsscript-gate
+
+# Create and activate virtual environment
+python -m venv .venv
+source .venv/bin/activate  # On Windows: .venv\Scripts\activate
+
+# Install package in editable mode with test dependencies
+pip install -e .[test]
+```
+
+---
+
+## Running Tests
+
+The test suite separates mocked unit tests from Docker integration tests:
+- **Unit tests**: Use mocking and do not require a running Docker daemon.
+- **Integration tests**: Labeled with `@pytest.mark.integration` and run against real Docker containers.
+
+```bash
+# Run unit tests (recommended for daily development)
+pytest -v -m "not integration"
+
+# Run full test suite including live Docker integration tests
+pytest -v
+```
+
+Pull requests should pass the unit test suite.
+
+---
+
+## Runner safety constraints
+
+Any changes affecting the container runner should preserve these constraints:
+
+1. **Unprivileged execution**:
+   - Containers must not run with `privileged=True`.
+   - `cap_drop` must remain `["ALL"]`.
+   - `security_opt` must include `["no-new-privileges:true"]`.
+2. **Read-only script mount**:
+   - Target scripts must remain read-only (`:ro`).
+   - Do not mount additional host filesystem paths into test containers.
+3. **Timeout & cleanup**:
+   - Containers reaching timeout limits should be terminated with `container.kill()`.
+   - Container removal in `finally` blocks must be preserved.
+4. **Non-interactive execution**:
+   - Standard input should remain detached (`stdin_open=False`, `tty=False`, `</dev/null`).
+   - Keep non-interactive environment variables (`DEBIAN_FRONTEND=noninteractive`, `CI=true`).
+5. **Scope**:
+   - Avoid emulating complex init systems (like systemd) inside containers; the runner focuses on standard script execution, command availability, and exit codes.
+
+---
+
+## Adding a New Linux Distribution
+
+To propose or add a new distribution image:
+1. Ensure the official image is available on Docker Hub and is publicly accessible.
+2. Confirm the image contains `/bin/sh` for minimal POSIX execution.
+3. Add a representative compatibility test fixture in `tests/fixtures/` demonstrating standard behavior.
+4. Ensure the image does not require interactive initialization.
+
+---
+
+## Pull Request Workflow
+
+1. Fork the repository and create a descriptive feature branch from `main`.
+2. Make your modifications, adhering to standard Python formatting (PEP 8) and type hints.
+3. Add or update unit tests in `tests/test_runner.py` verifying both success and failure paths.
+4. Verify tests pass locally: `pytest -v -m "not integration"`.
+5. Open a Pull Request against the `main` branch with a clear summary of changes.

opsscript_gate-0.1.2/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 OpsScript Gate Contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.