opsscript-gate 0.2.0__tar.gz → 0.3.0__tar.gz

opsscript_gate-0.3.0/.github/workflows/release.yml

@@ -0,0 +1,213 @@
+name: Build and Release
+
+on:
+  push:
+    branches:
+      - main
+    tags:
+      - 'v*'
+  workflow_dispatch:
+
+concurrency:
+  group: opsscript-gate-release
+  cancel-in-progress: false
+  queue: max
+
+permissions:
+  contents: read
+
+jobs:
+  test:
+    name: Run Test Suite
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout Code
+        uses: actions/checkout@v7
+
+      - name: Set up Python
+        uses: actions/setup-python@v7
+        with:
+          python-version: '3.12'
+
+      - name: Install Dependencies
+        run: |
+          python -m pip install --upgrade pip
+          pip install -e .[test]
+
+      - name: Run Tests
+        run: |
+          pytest -v -m "not integration"
+
+  integration:
+    name: Docker Integration Tests
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout Code
+        uses: actions/checkout@v7
+
+      - name: Set up Python
+        uses: actions/setup-python@v7
+        with:
+          python-version: '3.12'
+
+      - name: Install Dependencies
+        run: |
+          python -m pip install --upgrade pip
+          pip install -e .[test]
+
+      - name: Verify Docker Available
+        run: docker version
+
+      - name: Run Docker Integration Tests
+        run: |
+          pytest -v -m integration
+
+  build:
+    name: Build Distribution Packages
+    needs: [test, integration]
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    outputs:
+      is_new_release: ${{ steps.release-check.outputs.is_new_release }}
+      should_tag: ${{ steps.release-check.outputs.should_tag }}
+      release_tag: ${{ steps.release-check.outputs.release_tag }}
+    steps:
+      - name: Checkout Code
+        uses: actions/checkout@v7
+        with:
+          fetch-depth: 0
+
+      - name: Set up Python
+        uses: actions/setup-python@v7
+        with:
+          python-version: '3.12'
+
+      - name: Determine Release Readiness
+        id: release-check
+        shell: bash
+        run: |
+          set -euo pipefail
+
+          TOML_VERSION=$(python -c "import tomllib; f=open('pyproject.toml', 'rb'); print(tomllib.load(f)['project']['version'])")
+          INIT_VERSION=$(python -c "import sys; sys.path.insert(0, 'src'); import opsscript_gate; print(opsscript_gate.__version__)")
+
+          echo "pyproject.toml version: $TOML_VERSION"
+          echo "opsscript_gate version: $INIT_VERSION"
+
+          if [ "$TOML_VERSION" != "$INIT_VERSION" ]; then
+            echo "::error::Version mismatch: pyproject.toml ($TOML_VERSION) != __init__.py ($INIT_VERSION)"
+            exit 1
+          fi
+
+          TARGET_TAG="v$TOML_VERSION"
+          echo "Target release tag: $TARGET_TAG"
+          echo "Triggering ref: ${{ github.ref }}"
+          echo "Triggering SHA: ${{ github.sha }}"
+          echo "Triggering event: ${{ github.event_name }}"
+
+          IS_NEW_RELEASE="false"
+          SHOULD_TAG="false"
+
+          if [[ "${{ github.ref }}" =~ ^refs/tags/v ]]; then
+            TAG_VERSION="${GITHUB_REF_NAME#v}"
+            echo "Triggered via explicit Git tag: $GITHUB_REF_NAME (version: $TAG_VERSION)"
+            if [ "$TAG_VERSION" != "$TOML_VERSION" ]; then
+              echo "::error::Tag mismatch: Git tag $GITHUB_REF_NAME does not match project version $TOML_VERSION"
+              exit 1
+            fi
+            IS_NEW_RELEASE="true"
+            SHOULD_TAG="false"
+          elif [ "${{ github.ref }}" = "refs/heads/main" ]; then
+            if git rev-parse -q --verify "refs/tags/$TARGET_TAG" >/dev/null; then
+              TAG_SHA=$(git rev-list -n 1 "$TARGET_TAG")
+              echo "Tag $TARGET_TAG already exists, pointing to commit: $TAG_SHA"
+              if [ "$TAG_SHA" = "${{ github.sha }}" ]; then
+                echo "Tag $TARGET_TAG points to current commit (${{ github.sha }}). Treating as retry/resume of release."
+                IS_NEW_RELEASE="true"
+                SHOULD_TAG="false"
+              else
+                echo "Tag $TARGET_TAG was released from earlier commit ($TAG_SHA != ${{ github.sha }}). Skipping release."
+                IS_NEW_RELEASE="false"
+                SHOULD_TAG="false"
+              fi
+            else
+              echo "Target tag $TARGET_TAG does not exist. Scheduling new release for commit ${{ github.sha }}."
+              IS_NEW_RELEASE="true"
+              SHOULD_TAG="true"
+            fi
+          else
+            echo "Workflow triggered on unsupported ref (${{ github.ref }}). Release is strictly prohibited."
+            IS_NEW_RELEASE="false"
+            SHOULD_TAG="false"
+          fi
+
+          echo "is_new_release=$IS_NEW_RELEASE" >> "$GITHUB_OUTPUT"
+          echo "should_tag=$SHOULD_TAG" >> "$GITHUB_OUTPUT"
+          echo "release_tag=$TARGET_TAG" >> "$GITHUB_OUTPUT"
+
+      - name: Install build tools
+        if: steps.release-check.outputs.is_new_release == 'true'
+        run: |
+          python -m pip install --upgrade pip
+          pip install build twine
+
+      - name: Build sdist and wheel
+        if: steps.release-check.outputs.is_new_release == 'true'
+        run: |
+          python -m build
+
+      - name: Verify Package Metadata
+        if: steps.release-check.outputs.is_new_release == 'true'
+        run: |
+          python -m twine check dist/*
+
+      - name: Upload dist artifacts
+        if: steps.release-check.outputs.is_new_release == 'true'
+        uses: actions/upload-artifact@v4
+        with:
+          name: dist
+          path: dist/
+          retention-days: 7
+
+      - name: Create and push Git tag
+        if: steps.release-check.outputs.is_new_release == 'true' && steps.release-check.outputs.should_tag == 'true'
+        shell: bash
+        run: |
+          TARGET_TAG="${{ steps.release-check.outputs.release_tag }}"
+          echo "Creating and pushing Git tag: $TARGET_TAG pointing to commit $GITHUB_SHA"
+          git config user.name "github-actions[bot]"
+          git config user.email "github-actions[bot]@users.noreply.github.com"
+          git tag "$TARGET_TAG" "$GITHUB_SHA"
+          git push origin "$TARGET_TAG"
+
+      - name: Create GitHub Release and Upload Assets
+        uses: softprops/action-gh-release@v3
+        if: steps.release-check.outputs.is_new_release == 'true'
+        with:
+          tag_name: ${{ steps.release-check.outputs.release_tag }}
+          target_commitish: ${{ github.sha }}
+          files: dist/*
+          generate_release_notes: true
+
+  publish-pypi:
+    name: Publish to PyPI via OIDC
+    needs: [test, build]
+    if: needs.build.outputs.is_new_release == 'true'
+    runs-on: ubuntu-latest
+    environment:
+      name: pypi
+      url: https://pypi.org/p/opsscript-gate
+    permissions:
+      id-token: write
+    steps:
+      - name: Download dist artifacts
+        uses: actions/download-artifact@v4
+        with:
+          name: dist
+          path: dist
+
+      - name: Publish package distributions to PyPI
+        uses: pypa/gh-action-pypi-publish@release/v1
+        with:
+          packages-dir: dist/

{opsscript_gate-0.2.0 → opsscript_gate-0.3.0}/CHANGELOG.md

@@ -5,6 +5,25 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.3.0] - 2026-09-19
+
+### Added
+- Structured runtime failure diagnostics: detect common "command not found" failures across Linux distributions (Alpine/BusyBox ash, Debian/Ubuntu dash, Bash, and missing interpreter paths).
+- High-confidence dual-signal classification: requires exit code 127 and matching shell output to produce a `missing_command` diagnostic.
+- Additive `diagnostic` field in JSON report format (`SingleResult.to_dict()`) providing structured diagnostic information (backward-compatible for consumers tolerating additional fields).
+- Enhanced terminal table formatting and GitHub Actions Step Summary showing clear failure causes in the summary overview.
+
+---
+
+## [0.2.1] - 2026-09-19
+
+### Fixed
+- Strip complete ANSI CSI and OSC escape sequences from diagnostic text instead of leaving escape-sequence residue.
+- Ensure diagnostic `max_length` includes the trailing ellipsis when truncation occurs.
+- Add regression coverage for ANSI sanitization and truncation edge cases.
+
+---
+
 ## [0.2.0] - 2026-09-18
 
 ### Added

{opsscript_gate-0.2.0 → opsscript_gate-0.3.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: opsscript-gate
-Version: 0.2.0
+Version: 0.3.0
 Summary: Run Linux shell scripts across Debian, Ubuntu and Alpine before release to catch runtime compatibility failures
 Project-URL: Homepage, https://github.com/Mresyzz/opsscript-gate
 Project-URL: Repository, https://github.com/Mresyzz/opsscript-gate
@@ -39,7 +39,7 @@ Description-Content-Type: text/markdown
 [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)
 [![Supported Distros](https://img.shields.io/badge/matrix-Debian%20%7C%20Ubuntu%20%7C%20Alpine-orange.svg)](#default-test-matrix)
 
-**OpsScript Gate** is a drop-in runtime compatibility gate for Linux shell scripts. It executes your shell scripts inside isolated Debian, Ubuntu, and Alpine containers before release, catching environment-specific runtime failures that static analysis cannot detect.
+**OpsScript Gate** is a drop-in runtime compatibility gate for Linux shell scripts. It executes your shell scripts inside separate Debian, Ubuntu, and Alpine Docker containers before release, catching environment-specific runtime failures that static analysis cannot detect.
 
 <p align="center">
   <img src="https://raw.githubusercontent.com/Mresyzz/opsscript-gate/main/.github/assets/social-preview.png" alt="OpsScript Gate Terminal Preview" width="800">
@@ -51,27 +51,31 @@ Description-Content-Type: text/markdown
 
 ### In GitHub Actions
 
-Add one step to your pull request workflow (`.github/workflows/gate.yml`):
+Here is a complete minimal workflow to drop into `.github/workflows/shell-compat.yml`:
 
 ```yaml
-- name: Verify Shell Script Portability
-  uses: Mresyzz/opsscript-gate@v0.2.0
-  with:
-    script-path: scripts/setup.sh
-    # shell: posix  # optional: 'posix' (default), 'shebang', or 'auto'
+name: Shell compatibility
+on: [pull_request]
+
+jobs:
+  shell-compat:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+      - uses: Mresyzz/opsscript-gate@v0.3.0
+        with:
+          script-path: scripts/setup.sh
+          shell: auto
 ```
 
 ### In Local Terminal (CLI)
 
-Requires Python 3.10+ and a local Docker engine:
+Requires Python 3.10+ and a running local Docker engine:
 
 ```bash
 # Install from PyPI
 pip install opsscript-gate
 
-# Latest development version
-pip install git+https://github.com/Mresyzz/opsscript-gate.git
-
 # Run compatibility gate against your script
 opsscript-gate run ./scripts/setup.sh
 ```
@@ -138,9 +142,11 @@ Failed Distributions - Output Snippets (last 15 lines):
 
 ## Security Boundaries
 
-OpsScript Gate uses conservative container defaults when running scripts:
+OpsScript Gate is not a security sandbox for untrusted code. Containers may run as the image's default user, and Docker/host-kernel security boundaries still apply.
+
+OpsScript Gate applies conservative container defaults when running scripts:
 
-1. **Unprivileged by Design**:
+1. **Restricted Container Defaults**:
    - Containers run with `privileged=False`.
    - All Linux capabilities are dropped: `cap_drop=["ALL"]`.
    - Privilege escalation is disabled: `security_opt=["no-new-privileges:true"]`.
@@ -149,7 +155,7 @@ OpsScript Gate uses conservative container defaults when running scripts:
    - OpsScript Gate does not mount additional host filesystem paths into the test container.
 3. **Anti-Hang Deadlock Defense**:
    - Disables TTY and stdin (`stdin_open=False`, `tty=False`).
-   - Redirects execution: `/bin/sh -c "/bin/sh /tmp/target_script.sh </dev/null"`.
+   - Redirects execution with input disconnected: `/bin/sh -c "... /tmp/target_script.sh </dev/null"`.
    - Injects `DEBIAN_FRONTEND=noninteractive` and `CI=true`.
    - Any script prompting for user input (`read -p`) fails immediately instead of blocking the CI runner.
 4. **Timeout & Container Cleanup**:
@@ -157,8 +163,8 @@ OpsScript Gate uses conservative container defaults when running scripts:
    - Container removal is attempted from a `finally` block during normal Python execution paths, including failures and timeouts.
 5. **Windows CRLF Defense**:
    - Automatically detects and normalizes carriage returns (`\r\n` -> `\n`) before container execution, preventing false `\r: command not found` errors.
-6. **POSIX-oriented `/bin/sh` Baseline**:
-   - Containers invoke `/bin/sh` directly, catching undeclared Bashism syntax (e.g. bash arrays, `[[ ... ]]`) that break in lightweight Alpine environments.
+6. **Minimal `/bin/sh` Baseline**:
+   - In default POSIX mode, containers invoke `/bin/sh` directly, catching undeclared Bashism syntax (e.g. bash arrays, `[[ ... ]]`) that break in lightweight Alpine environments.
 
 ---
 
@@ -169,7 +175,7 @@ OpsScript Gate uses conservative container defaults when running scripts:
 | `debian:12-slim` | Debian 12 (Bookworm) | Minimal glibc + APT base |
 | `ubuntu:22.04` | Ubuntu 22.04 LTS (Jammy) | Enterprise long-term support baseline |
 | `ubuntu:24.04` | Ubuntu 24.04 LTS (Noble) | Modern glibc, updated coreutils & defaults |
-| `alpine:3.20` | Alpine Linux 3.20 | Minimal musl libc + BusyBox (strict POSIX test) |
+| `alpine:3.20` | Alpine Linux 3.20 | Minimal musl libc + BusyBox /bin/sh environment |
 
 You can customize the matrix at any time via `--matrix` or Action input `matrix`.
 
@@ -196,7 +202,7 @@ usage: opsscript-gate run [-h] [--matrix MATRIX] [--timeout TIMEOUT]
 
 ### Shell Execution Modes (`--shell`)
 
-- **`posix`** (default): Strictly executes with `/bin/sh`, ignoring any script shebang. Ideal for verifying that your script runs in minimal POSIX-compliant environments (e.g. Alpine BusyBox).
+- **`posix`** (default): Strictly executes with `/bin/sh`, ignoring any script shebang. Useful for verifying that your script runs under minimal `/bin/sh` environments, including Alpine BusyBox.
 - **`shebang`**: Strictly honors the interpreter specified in the script's shebang (`#!/bin/sh`, `#!/bin/bash`, `#!/usr/bin/sh`, `#!/usr/bin/bash`, `#!/usr/bin/env sh`, `#!/usr/bin/env bash`). If the shebang is missing, malformed, or specifies an unsupported interpreter/flag, the check fails immediately with an error before running containers.
 - **`auto`**: Honors recognized shebangs if present; falls back to `/bin/sh` if no shebang is declared. Scripts with explicit unsupported or malformed shebangs fail immediately with an error (does not silently execute as POSIX).
 
@@ -217,6 +223,14 @@ Check out the [examples/](examples/) directory for self-contained, runnable scen
 
 ---
 
+## Dogfooding
+
+OpsScript Gate is used in [`Mresyzz/linux-dev-bootstrap`](https://github.com/Mresyzz/linux-dev-bootstrap) to validate its `install.sh` script across the default Debian, Ubuntu, and Alpine matrix in GitHub Actions. That workflow pins `Mresyzz/opsscript-gate@v0.2.1` with `shell: auto`.
+
+See the downstream workflow: [`.github/workflows/test.yml`](https://github.com/Mresyzz/linux-dev-bootstrap/blob/main/.github/workflows/test.yml).
+
+---
+
 ## Development & Testing
 
 The test suite uses Docker SDK mocking to ensure fast unit tests without needing a local daemon:
@@ -227,6 +241,9 @@ git clone https://github.com/Mresyzz/opsscript-gate.git
 cd opsscript-gate
 pip install -e .[test]
 
+# Or install latest unreleased code directly from Git:
+# pip install git+https://github.com/Mresyzz/opsscript-gate.git
+
 # Run unit tests (mocked)
 pytest -v -m "not integration"
 

{opsscript_gate-0.2.0 → opsscript_gate-0.3.0}/README.md

@@ -11,7 +11,7 @@
 [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)
 [![Supported Distros](https://img.shields.io/badge/matrix-Debian%20%7C%20Ubuntu%20%7C%20Alpine-orange.svg)](#default-test-matrix)
 
-**OpsScript Gate** is a drop-in runtime compatibility gate for Linux shell scripts. It executes your shell scripts inside isolated Debian, Ubuntu, and Alpine containers before release, catching environment-specific runtime failures that static analysis cannot detect.
+**OpsScript Gate** is a drop-in runtime compatibility gate for Linux shell scripts. It executes your shell scripts inside separate Debian, Ubuntu, and Alpine Docker containers before release, catching environment-specific runtime failures that static analysis cannot detect.
 
 <p align="center">
   <img src="https://raw.githubusercontent.com/Mresyzz/opsscript-gate/main/.github/assets/social-preview.png" alt="OpsScript Gate Terminal Preview" width="800">
@@ -23,27 +23,31 @@
 
 ### In GitHub Actions
 
-Add one step to your pull request workflow (`.github/workflows/gate.yml`):
+Here is a complete minimal workflow to drop into `.github/workflows/shell-compat.yml`:
 
 ```yaml
-- name: Verify Shell Script Portability
-  uses: Mresyzz/opsscript-gate@v0.2.0
-  with:
-    script-path: scripts/setup.sh
-    # shell: posix  # optional: 'posix' (default), 'shebang', or 'auto'
+name: Shell compatibility
+on: [pull_request]
+
+jobs:
+  shell-compat:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+      - uses: Mresyzz/opsscript-gate@v0.3.0
+        with:
+          script-path: scripts/setup.sh
+          shell: auto
 ```
 
 ### In Local Terminal (CLI)
 
-Requires Python 3.10+ and a local Docker engine:
+Requires Python 3.10+ and a running local Docker engine:
 
 ```bash
 # Install from PyPI
 pip install opsscript-gate
 
-# Latest development version
-pip install git+https://github.com/Mresyzz/opsscript-gate.git
-
 # Run compatibility gate against your script
 opsscript-gate run ./scripts/setup.sh
 ```
@@ -110,9 +114,11 @@ Failed Distributions - Output Snippets (last 15 lines):
 
 ## Security Boundaries
 
-OpsScript Gate uses conservative container defaults when running scripts:
+OpsScript Gate is not a security sandbox for untrusted code. Containers may run as the image's default user, and Docker/host-kernel security boundaries still apply.
+
+OpsScript Gate applies conservative container defaults when running scripts:
 
-1. **Unprivileged by Design**:
+1. **Restricted Container Defaults**:
    - Containers run with `privileged=False`.
    - All Linux capabilities are dropped: `cap_drop=["ALL"]`.
    - Privilege escalation is disabled: `security_opt=["no-new-privileges:true"]`.
@@ -121,7 +127,7 @@ OpsScript Gate uses conservative container defaults when running scripts:
    - OpsScript Gate does not mount additional host filesystem paths into the test container.
 3. **Anti-Hang Deadlock Defense**:
    - Disables TTY and stdin (`stdin_open=False`, `tty=False`).
-   - Redirects execution: `/bin/sh -c "/bin/sh /tmp/target_script.sh </dev/null"`.
+   - Redirects execution with input disconnected: `/bin/sh -c "... /tmp/target_script.sh </dev/null"`.
    - Injects `DEBIAN_FRONTEND=noninteractive` and `CI=true`.
    - Any script prompting for user input (`read -p`) fails immediately instead of blocking the CI runner.
 4. **Timeout & Container Cleanup**:
@@ -129,8 +135,8 @@ OpsScript Gate uses conservative container defaults when running scripts:
    - Container removal is attempted from a `finally` block during normal Python execution paths, including failures and timeouts.
 5. **Windows CRLF Defense**:
    - Automatically detects and normalizes carriage returns (`\r\n` -> `\n`) before container execution, preventing false `\r: command not found` errors.
-6. **POSIX-oriented `/bin/sh` Baseline**:
-   - Containers invoke `/bin/sh` directly, catching undeclared Bashism syntax (e.g. bash arrays, `[[ ... ]]`) that break in lightweight Alpine environments.
+6. **Minimal `/bin/sh` Baseline**:
+   - In default POSIX mode, containers invoke `/bin/sh` directly, catching undeclared Bashism syntax (e.g. bash arrays, `[[ ... ]]`) that break in lightweight Alpine environments.
 
 ---
 
@@ -141,7 +147,7 @@ OpsScript Gate uses conservative container defaults when running scripts:
 | `debian:12-slim` | Debian 12 (Bookworm) | Minimal glibc + APT base |
 | `ubuntu:22.04` | Ubuntu 22.04 LTS (Jammy) | Enterprise long-term support baseline |
 | `ubuntu:24.04` | Ubuntu 24.04 LTS (Noble) | Modern glibc, updated coreutils & defaults |
-| `alpine:3.20` | Alpine Linux 3.20 | Minimal musl libc + BusyBox (strict POSIX test) |
+| `alpine:3.20` | Alpine Linux 3.20 | Minimal musl libc + BusyBox /bin/sh environment |
 
 You can customize the matrix at any time via `--matrix` or Action input `matrix`.
 
@@ -168,7 +174,7 @@ usage: opsscript-gate run [-h] [--matrix MATRIX] [--timeout TIMEOUT]
 
 ### Shell Execution Modes (`--shell`)
 
-- **`posix`** (default): Strictly executes with `/bin/sh`, ignoring any script shebang. Ideal for verifying that your script runs in minimal POSIX-compliant environments (e.g. Alpine BusyBox).
+- **`posix`** (default): Strictly executes with `/bin/sh`, ignoring any script shebang. Useful for verifying that your script runs under minimal `/bin/sh` environments, including Alpine BusyBox.
 - **`shebang`**: Strictly honors the interpreter specified in the script's shebang (`#!/bin/sh`, `#!/bin/bash`, `#!/usr/bin/sh`, `#!/usr/bin/bash`, `#!/usr/bin/env sh`, `#!/usr/bin/env bash`). If the shebang is missing, malformed, or specifies an unsupported interpreter/flag, the check fails immediately with an error before running containers.
 - **`auto`**: Honors recognized shebangs if present; falls back to `/bin/sh` if no shebang is declared. Scripts with explicit unsupported or malformed shebangs fail immediately with an error (does not silently execute as POSIX).
 
@@ -189,6 +195,14 @@ Check out the [examples/](examples/) directory for self-contained, runnable scen
 
 ---
 
+## Dogfooding
+
+OpsScript Gate is used in [`Mresyzz/linux-dev-bootstrap`](https://github.com/Mresyzz/linux-dev-bootstrap) to validate its `install.sh` script across the default Debian, Ubuntu, and Alpine matrix in GitHub Actions. That workflow pins `Mresyzz/opsscript-gate@v0.2.1` with `shell: auto`.
+
+See the downstream workflow: [`.github/workflows/test.yml`](https://github.com/Mresyzz/linux-dev-bootstrap/blob/main/.github/workflows/test.yml).
+
+---
+
 ## Development & Testing
 
 The test suite uses Docker SDK mocking to ensure fast unit tests without needing a local daemon:
@@ -199,6 +213,9 @@ git clone https://github.com/Mresyzz/opsscript-gate.git
 cd opsscript-gate
 pip install -e .[test]
 
+# Or install latest unreleased code directly from Git:
+# pip install git+https://github.com/Mresyzz/opsscript-gate.git
+
 # Run unit tests (mocked)
 pytest -v -m "not integration"
 

{opsscript_gate-0.2.0 → opsscript_gate-0.3.0}/SECURITY.md

@@ -30,7 +30,9 @@ Reports will be reviewed as maintainer availability allows.
 
 ## Runner Security Boundaries
 
+OpsScript Gate is not a security sandbox for untrusted code. Containers may run as the image's default user, and Docker containers still share the host kernel.
+
 OpsScript Gate applies conservative container defaults when running scripts:
-- **Unprivileged Execution**: Containers run with `privileged=False`, `cap_drop=["ALL"]`, and `security_opt=["no-new-privileges:true"]`.
+- **Restricted Container Defaults**: Containers run with `privileged=False`, `cap_drop=["ALL"]`, and `security_opt=["no-new-privileges:true"]`.
 - **Read-Only Mounting**: Target scripts are mounted read-only (`:ro`). OpsScript Gate does not mount additional host filesystem paths into test containers.
 - **Resource Protection**: Containers are subject to timeouts and `SIGKILL` termination. Container removal is attempted from a `finally` block during normal Python execution paths, including failures and timeouts.

{opsscript_gate-0.2.0 → opsscript_gate-0.3.0}/examples/github-actions/workflow.yml

@@ -17,9 +17,10 @@ jobs:
         uses: actions/checkout@v7
 
       - name: Run OpsScript Gate
-        uses: Mresyzz/opsscript-gate@v0.1.1
+        uses: Mresyzz/opsscript-gate@v0.3.0
         with:
           script-path: 'scripts/deploy.sh'
+          shell: auto
           matrix: 'debian:12-slim,ubuntu:22.04,ubuntu:24.04,alpine:3.20'
           timeout: '60'
           format: 'table'

{opsscript_gate-0.2.0 → opsscript_gate-0.3.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "opsscript-gate"
-version = "0.2.0"
+version = "0.3.0"
 description = "Run Linux shell scripts across Debian, Ubuntu and Alpine before release to catch runtime compatibility failures"
 readme = "README.md"
 license = { text = "MIT" }

{opsscript_gate-0.2.0 → opsscript_gate-0.3.0}/src/opsscript_gate/__init__.py

@@ -1,4 +1,4 @@
 """OpsScript Gate: Lightweight cross-distro compatibility pre-check for Linux ops scripts."""
 
-__version__ = "0.2.0"
+__version__ = "0.3.0"
 __all__ = ["__version__"]

{opsscript_gate-0.2.0 → opsscript_gate-0.3.0}/src/opsscript_gate/models.py

@@ -20,6 +20,23 @@ class ShellMode(str, Enum):
     AUTO = "auto"
 
 
+@dataclass
+class FailureDiagnostic:
+    """Structured diagnostic information for execution failures."""
+    kind: str
+    message: str
+    command: str | None = None
+
+    def to_dict(self) -> dict[str, Any]:
+        d: dict[str, Any] = {
+            "kind": self.kind,
+            "message": self.message,
+        }
+        if self.command is not None:
+            d["command"] = self.command
+        return d
+
+
 @dataclass
 class SingleResult:
     """Execution result for a single Linux distribution."""
@@ -29,6 +46,7 @@ class SingleResult:
     duration: float
     output_snippet: str = ""
     error_message: str | None = None
+    diagnostic: FailureDiagnostic | None = None
 
     def to_dict(self) -> dict[str, Any]:
         return {
@@ -38,6 +56,7 @@ class SingleResult:
             "duration": round(self.duration, 3),
             "output_snippet": self.output_snippet,
             "error_message": self.error_message,
+            "diagnostic": self.diagnostic.to_dict() if self.diagnostic is not None else None,
         }
 
 

{opsscript_gate-0.2.0 → opsscript_gate-0.3.0}/src/opsscript_gate/reporter.py

@@ -16,6 +16,8 @@ def format_terminal_table(report: RunReport) -> str:
 
         if r.status == DistroStatus.PASS:
             detail = "OK"
+        elif r.diagnostic:
+            detail = r.diagnostic.message
         elif r.error_message:
             detail = r.error_message
         else:
@@ -107,7 +109,12 @@ def format_github_summary(report: RunReport) -> str:
 
         exit_code_str = f"`{r.exit_code}`" if r.exit_code is not None else "`N/A`"
         duration_str = f"`{r.duration:.2f}s`"
-        msg = r.error_message or "-"
+        if r.status == DistroStatus.PASS:
+            msg = "OK"
+        elif r.diagnostic:
+            msg = r.diagnostic.message
+        else:
+            msg = r.error_message or "-"
         msg_escaped = msg.replace("|", "\\|")
 
         lines.append(
@@ -123,6 +130,11 @@ def format_github_summary(report: RunReport) -> str:
         for r in failures:
             lines.append(f"<details><summary><b>[{r.status.value}] {r.distro}</b></summary>")
             lines.append("")
+            if r.diagnostic:
+                clean_kind = r.diagnostic.kind.replace("`", "'")
+                clean_msg = r.diagnostic.message.replace("`", "'")
+                lines.append(f"> **Diagnostic:** `{clean_kind}` — `{clean_msg}`")
+                lines.append("")
             if r.error_message:
                 lines.append(f"> **Error:** {r.error_message}")
                 lines.append("")