opsscript-gate 0.1.2__tar.gz → 0.2.1__tar.gz

opsscript_gate-0.2.1/.github/workflows/test.yml

@@ -0,0 +1,52 @@
+name: Test opsscript-gate
+
+on:
+  push:
+    branches: [ main, test ]
+  pull_request:
+    branches: [ main, test ]
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout Code
+        uses: actions/checkout@v7
+
+      - name: Set up Python
+        uses: actions/setup-python@v7
+        with:
+          python-version: '3.12'
+
+      - name: Install Dependencies
+        run: |
+          python -m pip install --upgrade pip
+          pip install -e .[test]
+
+      - name: Run Pytest
+        run: |
+          pytest -v -m "not integration"
+
+  integration:
+    name: Docker Integration Tests
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout Code
+        uses: actions/checkout@v7
+
+      - name: Set up Python
+        uses: actions/setup-python@v7
+        with:
+          python-version: '3.12'
+
+      - name: Install Dependencies
+        run: |
+          python -m pip install --upgrade pip
+          pip install -e .[test]
+
+      - name: Verify Docker Available
+        run: docker version
+
+      - name: Run Docker Integration Tests
+        run: |
+          pytest -v -m integration

{opsscript_gate-0.1.2 → opsscript_gate-0.2.1}/CHANGELOG.md

@@ -5,6 +5,29 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.2.1] - 2026-09-19
+
+### Fixed
+- Strip complete ANSI CSI and OSC escape sequences from diagnostic text instead of leaving escape-sequence residue.
+- Ensure diagnostic `max_length` includes the trailing ellipsis when truncation occurs.
+- Add regression coverage for ANSI sanitization and truncation edge cases.
+
+---
+
+## [0.2.0] - 2026-09-18
+
+### Added
+- Explicit shell execution modes (`--shell posix|shebang|auto`) in CLI and GitHub Action.
+  - `posix` (default): Strictly executes with `/bin/sh`, ignoring any script shebang to verify portability against minimal POSIX environments.
+  - `shebang`: Strictly honors recognized shebang interpreters (`sh`, `bash`, `/usr/bin/env`). Fails immediately with clear diagnostics if missing, malformed, or unsupported.
+  - `auto`: Uses recognized shebang when present; safely falls back to `/bin/sh` if no shebang is present; rejects unsupported/malformed shebangs without silent fallback.
+- Exact interpreter-path preservation using fixed trusted container command constants (`SUPPORTED_SHEBANG_COMMANDS`), preventing `$PATH` resolution from masking missing paths like `/usr/bin/bash`.
+- Hardened GitHub Action input passing via step-level environment variables to eliminate shell injection risks.
+- Dedicated Docker integration test job in GitHub Actions workflow verifying real container behaviors (including bash missing on Alpine 3.20).
+- Sanitized shebang error diagnostics against control character injection and multiline pollution.
+
+---
+
 ## [0.1.2] - 2026-09-18
 
 ### Added

{opsscript_gate-0.1.2 → opsscript_gate-0.2.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: opsscript-gate
-Version: 0.1.2
+Version: 0.2.1
 Summary: Run Linux shell scripts across Debian, Ubuntu and Alpine before release to catch runtime compatibility failures
 Project-URL: Homepage, https://github.com/Mresyzz/opsscript-gate
 Project-URL: Repository, https://github.com/Mresyzz/opsscript-gate
@@ -32,9 +32,10 @@ Description-Content-Type: text/markdown
 
 [![CI](https://github.com/Mresyzz/opsscript-gate/actions/workflows/test.yml/badge.svg)](https://github.com/Mresyzz/opsscript-gate/actions/workflows/test.yml)
 [![Demo](https://github.com/Mresyzz/opsscript-gate/actions/workflows/demo.yml/badge.svg)](https://github.com/Mresyzz/opsscript-gate/actions/workflows/demo.yml)
+[![PyPI](https://img.shields.io/pypi/v/opsscript-gate)](https://pypi.org/project/opsscript-gate/)
+[![Python Versions](https://img.shields.io/pypi/pyversions/opsscript-gate)](https://pypi.org/project/opsscript-gate/)
 [![GitHub Marketplace](https://img.shields.io/badge/Marketplace-OpsScript%20Gate-blue?logo=github&color=2088FF)](https://github.com/marketplace/actions/opsscript-gate)
 [![Release](https://img.shields.io/github/v/release/Mresyzz/opsscript-gate?color=green)](https://github.com/Mresyzz/opsscript-gate/releases)
-[![Python Version](https://img.shields.io/badge/python-3.10+-blue.svg)](https://www.python.org/downloads/)
 [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)
 [![Supported Distros](https://img.shields.io/badge/matrix-Debian%20%7C%20Ubuntu%20%7C%20Alpine-orange.svg)](#default-test-matrix)
 
@@ -54,9 +55,10 @@ Add one step to your pull request workflow (`.github/workflows/gate.yml`):
 
 ```yaml
 - name: Verify Shell Script Portability
-  uses: Mresyzz/opsscript-gate@v0.1.1
+  uses: Mresyzz/opsscript-gate@v0.2.1
   with:
     script-path: scripts/setup.sh
+    # shell: posix  # optional: 'posix' (default), 'shebang', or 'auto'
 ```
 
 ### In Local Terminal (CLI)
@@ -64,7 +66,10 @@ Add one step to your pull request workflow (`.github/workflows/gate.yml`):
 Requires Python 3.10+ and a local Docker engine:
 
 ```bash
-# Install directly from GitHub
+# Install from PyPI
+pip install opsscript-gate
+
+# Latest development version
 pip install git+https://github.com/Mresyzz/opsscript-gate.git
 
 # Run compatibility gate against your script
@@ -175,6 +180,7 @@ You can customize the matrix at any time via `--matrix` or Action input `matrix`
 ```text
 usage: opsscript-gate run [-h] [--matrix MATRIX] [--timeout TIMEOUT]
                           [--format {table,markdown,json}]
+                          [--shell {posix,shebang,auto}]
                           script_path
 ```
 
@@ -184,9 +190,16 @@ usage: opsscript-gate run [-h] [--matrix MATRIX] [--timeout TIMEOUT]
 | `--matrix` | String | `debian:12-slim,ubuntu:22.04,ubuntu:24.04,alpine:3.20` | Comma-separated list of Docker images |
 | `--timeout` | Integer | `60` | Hard timeout per container in seconds |
 | `--format` | Choice | `table` | Output format: `table`, `markdown`, or `json` |
+| `--shell` | Choice | `posix` | Execution mode: `posix` (default), `shebang`, or `auto` |
 | `--version` | Flag | - | Show version number |
 | `-h, --help` | Flag | - | Show argument help |
 
+### Shell Execution Modes (`--shell`)
+
+- **`posix`** (default): Strictly executes with `/bin/sh`, ignoring any script shebang. Ideal for verifying that your script runs in minimal POSIX-compliant environments (e.g. Alpine BusyBox).
+- **`shebang`**: Strictly honors the interpreter specified in the script's shebang (`#!/bin/sh`, `#!/bin/bash`, `#!/usr/bin/sh`, `#!/usr/bin/bash`, `#!/usr/bin/env sh`, `#!/usr/bin/env bash`). If the shebang is missing, malformed, or specifies an unsupported interpreter/flag, the check fails immediately with an error before running containers.
+- **`auto`**: Honors recognized shebangs if present; falls back to `/bin/sh` if no shebang is declared. Scripts with explicit unsupported or malformed shebangs fail immediately with an error (does not silently execute as POSIX).
+
 ### Exit Code Convention
 - **`0`**: All distributions passed (`PASS`).
 - **`1`**: At least one distribution failed (`FAIL`), timed out (`TIMED_OUT`), or errored (`ERROR`).
@@ -204,6 +217,14 @@ Check out the [examples/](examples/) directory for self-contained, runnable scen
 
 ---
 
+## Dogfooding
+
+OpsScript Gate is used in [`Mresyzz/linux-dev-bootstrap`](https://github.com/Mresyzz/linux-dev-bootstrap) to validate its `install.sh` script across the default Debian, Ubuntu, and Alpine matrix in GitHub Actions. That workflow pins `Mresyzz/opsscript-gate@v0.2.0` with `shell: auto`.
+
+See the downstream workflow: [`.github/workflows/test.yml`](https://github.com/Mresyzz/linux-dev-bootstrap/blob/main/.github/workflows/test.yml).
+
+---
+
 ## Development & Testing
 
 The test suite uses Docker SDK mocking to ensure fast unit tests without needing a local daemon:
@@ -223,10 +244,20 @@ pytest -v
 
 ---
 
+## Current limitations
+
+- Requires access to a Docker daemon.
+- Scripts are executed with `/bin/sh` by default; use `--shell shebang` or `--shell auto` for shebang-aware execution.
+- Distribution runs are currently sequential.
+- Containers use bridge networking by default.
+- Failure reports currently include only a tail of captured output.
+- OpsScript Gate checks runtime execution and exit status; it does not validate application-specific outcomes.
+
+---
+
 ## Roadmap
 
 See [ROADMAP.md](ROADMAP.md) for planned capabilities, including:
-- Shebang-aware execution modes (`--shell auto|posix|shebang`)
 - Container resource limits (`--mem-limit`, `--pids-limit`)
 - Configurable network isolation (`--network none|bridge`)
 - Parallel matrix execution

{opsscript_gate-0.1.2 → opsscript_gate-0.2.1}/README.md

@@ -4,9 +4,10 @@
 
 [![CI](https://github.com/Mresyzz/opsscript-gate/actions/workflows/test.yml/badge.svg)](https://github.com/Mresyzz/opsscript-gate/actions/workflows/test.yml)
 [![Demo](https://github.com/Mresyzz/opsscript-gate/actions/workflows/demo.yml/badge.svg)](https://github.com/Mresyzz/opsscript-gate/actions/workflows/demo.yml)
+[![PyPI](https://img.shields.io/pypi/v/opsscript-gate)](https://pypi.org/project/opsscript-gate/)
+[![Python Versions](https://img.shields.io/pypi/pyversions/opsscript-gate)](https://pypi.org/project/opsscript-gate/)
 [![GitHub Marketplace](https://img.shields.io/badge/Marketplace-OpsScript%20Gate-blue?logo=github&color=2088FF)](https://github.com/marketplace/actions/opsscript-gate)
 [![Release](https://img.shields.io/github/v/release/Mresyzz/opsscript-gate?color=green)](https://github.com/Mresyzz/opsscript-gate/releases)
-[![Python Version](https://img.shields.io/badge/python-3.10+-blue.svg)](https://www.python.org/downloads/)
 [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)
 [![Supported Distros](https://img.shields.io/badge/matrix-Debian%20%7C%20Ubuntu%20%7C%20Alpine-orange.svg)](#default-test-matrix)
 
@@ -26,9 +27,10 @@ Add one step to your pull request workflow (`.github/workflows/gate.yml`):
 
 ```yaml
 - name: Verify Shell Script Portability
-  uses: Mresyzz/opsscript-gate@v0.1.1
+  uses: Mresyzz/opsscript-gate@v0.2.1
   with:
     script-path: scripts/setup.sh
+    # shell: posix  # optional: 'posix' (default), 'shebang', or 'auto'
 ```
 
 ### In Local Terminal (CLI)
@@ -36,7 +38,10 @@ Add one step to your pull request workflow (`.github/workflows/gate.yml`):
 Requires Python 3.10+ and a local Docker engine:
 
 ```bash
-# Install directly from GitHub
+# Install from PyPI
+pip install opsscript-gate
+
+# Latest development version
 pip install git+https://github.com/Mresyzz/opsscript-gate.git
 
 # Run compatibility gate against your script
@@ -147,6 +152,7 @@ You can customize the matrix at any time via `--matrix` or Action input `matrix`
 ```text
 usage: opsscript-gate run [-h] [--matrix MATRIX] [--timeout TIMEOUT]
                           [--format {table,markdown,json}]
+                          [--shell {posix,shebang,auto}]
                           script_path
 ```
 
@@ -156,9 +162,16 @@ usage: opsscript-gate run [-h] [--matrix MATRIX] [--timeout TIMEOUT]
 | `--matrix` | String | `debian:12-slim,ubuntu:22.04,ubuntu:24.04,alpine:3.20` | Comma-separated list of Docker images |
 | `--timeout` | Integer | `60` | Hard timeout per container in seconds |
 | `--format` | Choice | `table` | Output format: `table`, `markdown`, or `json` |
+| `--shell` | Choice | `posix` | Execution mode: `posix` (default), `shebang`, or `auto` |
 | `--version` | Flag | - | Show version number |
 | `-h, --help` | Flag | - | Show argument help |
 
+### Shell Execution Modes (`--shell`)
+
+- **`posix`** (default): Strictly executes with `/bin/sh`, ignoring any script shebang. Ideal for verifying that your script runs in minimal POSIX-compliant environments (e.g. Alpine BusyBox).
+- **`shebang`**: Strictly honors the interpreter specified in the script's shebang (`#!/bin/sh`, `#!/bin/bash`, `#!/usr/bin/sh`, `#!/usr/bin/bash`, `#!/usr/bin/env sh`, `#!/usr/bin/env bash`). If the shebang is missing, malformed, or specifies an unsupported interpreter/flag, the check fails immediately with an error before running containers.
+- **`auto`**: Honors recognized shebangs if present; falls back to `/bin/sh` if no shebang is declared. Scripts with explicit unsupported or malformed shebangs fail immediately with an error (does not silently execute as POSIX).
+
 ### Exit Code Convention
 - **`0`**: All distributions passed (`PASS`).
 - **`1`**: At least one distribution failed (`FAIL`), timed out (`TIMED_OUT`), or errored (`ERROR`).
@@ -176,6 +189,14 @@ Check out the [examples/](examples/) directory for self-contained, runnable scen
 
 ---
 
+## Dogfooding
+
+OpsScript Gate is used in [`Mresyzz/linux-dev-bootstrap`](https://github.com/Mresyzz/linux-dev-bootstrap) to validate its `install.sh` script across the default Debian, Ubuntu, and Alpine matrix in GitHub Actions. That workflow pins `Mresyzz/opsscript-gate@v0.2.0` with `shell: auto`.
+
+See the downstream workflow: [`.github/workflows/test.yml`](https://github.com/Mresyzz/linux-dev-bootstrap/blob/main/.github/workflows/test.yml).
+
+---
+
 ## Development & Testing
 
 The test suite uses Docker SDK mocking to ensure fast unit tests without needing a local daemon:
@@ -195,10 +216,20 @@ pytest -v
 
 ---
 
+## Current limitations
+
+- Requires access to a Docker daemon.
+- Scripts are executed with `/bin/sh` by default; use `--shell shebang` or `--shell auto` for shebang-aware execution.
+- Distribution runs are currently sequential.
+- Containers use bridge networking by default.
+- Failure reports currently include only a tail of captured output.
+- OpsScript Gate checks runtime execution and exit status; it does not validate application-specific outcomes.
+
+---
+
 ## Roadmap
 
 See [ROADMAP.md](ROADMAP.md) for planned capabilities, including:
-- Shebang-aware execution modes (`--shell auto|posix|shebang`)
 - Container resource limits (`--mem-limit`, `--pids-limit`)
 - Configurable network isolation (`--network none|bridge`)
 - Parallel matrix execution

{opsscript_gate-0.1.2 → opsscript_gate-0.2.1}/ROADMAP.md

@@ -9,8 +9,8 @@ This roadmap tracks features being considered for future releases.
 ## Planned Features
 
 ### 1. Execution Modes (`--shell`)
-- [ ] **Shebang-aware execution (`--shell shebang | auto`)**: Under consideration. Parse and honor `#!/usr/bin/env bash` or `#!/bin/bash` in distributions where Bash is present, while maintaining unprivileged container defaults.
-- [ ] **Explicit POSIX mode (`--shell posix`)**: Retain the current baseline of `/bin/sh` across all containers to verify portability.
+- [x] **Shebang-aware execution (`--shell shebang | auto`)**: Implemented in v0.2.0. Parses and honors recognized shebang forms (`sh`, `bash`) across distributions using fixed trusted container commands.
+- [x] **Explicit POSIX mode (`--shell posix`)**: Implemented in v0.2.0. Retains `/bin/sh` baseline across all containers to verify strict POSIX portability.
 
 ### 2. Resource Constraints
 - [ ] **Memory limits (`--mem-limit`)**: Planned. Constrain container memory usage for scripts under test.

{opsscript_gate-0.1.2 → opsscript_gate-0.2.1}/SECURITY.md

@@ -6,7 +6,8 @@ Only the latest release of **OpsScript Gate** receives security updates and bug
 
 | Version | Supported          |
 | :---    | :---:              |
-| 0.1.x   | :white_check_mark: |
+| 0.2.x   | :white_check_mark: |
+| 0.1.x   | :x:                |
 | < 0.1.0 | :x:                |
 
 ---

{opsscript_gate-0.1.2 → opsscript_gate-0.2.1}/action.yml

@@ -21,6 +21,10 @@ inputs:
     description: 'Output report format: table, markdown, or json'
     required: false
     default: 'table'
+  shell:
+    description: "Shell execution mode: 'posix' (default), 'shebang', or 'auto'"
+    required: false
+    default: 'posix'
 
 runs:
   using: 'composite'
@@ -38,9 +42,21 @@ runs:
 
     - name: Run compatibility gate
       shell: bash
+      env:
+        INPUT_SCRIPT_PATH: ${{ inputs.script-path }}
+        INPUT_MATRIX: ${{ inputs.matrix }}
+        INPUT_TIMEOUT: ${{ inputs.timeout }}
+        INPUT_FORMAT: ${{ inputs.format }}
+        INPUT_SHELL: ${{ inputs.shell }}
       run: |
-        ARGS=("run" "${{ inputs.script-path }}" "--timeout" "${{ inputs.timeout }}" "--format" "${{ inputs.format }}")
-        if [ -n "${{ inputs.matrix }}" ]; then
-          ARGS+=("--matrix" "${{ inputs.matrix }}")
+        ARGS=(
+          "run"
+          "$INPUT_SCRIPT_PATH"
+          "--timeout" "$INPUT_TIMEOUT"
+          "--format" "$INPUT_FORMAT"
+          "--shell" "$INPUT_SHELL"
+        )
+        if [ -n "$INPUT_MATRIX" ]; then
+          ARGS+=("--matrix" "$INPUT_MATRIX")
         fi
         python -m opsscript_gate.cli "${ARGS[@]}"

{opsscript_gate-0.1.2 → opsscript_gate-0.2.1}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "opsscript-gate"
-version = "0.1.2"
+version = "0.2.1"
 description = "Run Linux shell scripts across Debian, Ubuntu and Alpine before release to catch runtime compatibility failures"
 readme = "README.md"
 license = { text = "MIT" }

{opsscript_gate-0.1.2 → opsscript_gate-0.2.1}/src/opsscript_gate/__init__.py

@@ -1,4 +1,4 @@
 """OpsScript Gate: Lightweight cross-distro compatibility pre-check for Linux ops scripts."""
 
-__version__ = "0.1.2"
+__version__ = "0.2.1"
 __all__ = ["__version__"]

{opsscript_gate-0.1.2 → opsscript_gate-0.2.1}/src/opsscript_gate/cli.py

@@ -64,6 +64,12 @@ def build_parser() -> argparse.ArgumentParser:
         default="table",
         help="Output report format: 'table' (default ASCII), 'markdown', or 'json'",
     )
+    run_parser.add_argument(
+        "--shell",
+        choices=["posix", "shebang", "auto"],
+        default="posix",
+        help="Shell execution mode: 'posix' (default, /bin/sh), 'shebang' (honors script shebang), or 'auto' (shebang if recognized, else /bin/sh)",
+    )
 
     return parser
 
@@ -98,6 +104,7 @@ def main(argv: list[str] | None = None) -> int:
                 script_path=script_path,
                 matrix=matrix,
                 timeout=args.timeout,
+                shell_mode=args.shell,
             )
         except DockerDaemonError as err:
             sys.stderr.write(f"Docker Error: {err}\n")

{opsscript_gate-0.1.2 → opsscript_gate-0.2.1}/src/opsscript_gate/models.py

@@ -13,6 +13,13 @@ class DistroStatus(str, Enum):
     ERROR = "ERROR"
 
 
+class ShellMode(str, Enum):
+    """Execution mode for shell scripts."""
+    POSIX = "posix"
+    SHEBANG = "shebang"
+    AUTO = "auto"
+
+
 @dataclass
 class SingleResult:
     """Execution result for a single Linux distribution."""