opsscript-gate 0.5.1__tar.gz → 0.6.0__tar.gz

{opsscript_gate-0.5.1 → opsscript_gate-0.6.0}/CHANGELOG.md

@@ -1,5 +1,11 @@
 # Changelog
 
+## [0.6.0] - 2026-09-30
+
+### Added
+- Added `--changed-since` and the matching Action input to test only shell scripts changed since a Git revision.
+- Changed-script selection uses the existing discovery safety checks and passes when a change contains no shell scripts.
+
 ## [0.5.1] - 2026-09-30
 
 ### Changed

{opsscript_gate-0.5.1 → opsscript_gate-0.6.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: opsscript-gate
-Version: 0.5.1
+Version: 0.6.0
 Summary: Run Linux shell scripts in Debian, Ubuntu and Alpine containers to catch runtime compatibility failures before merge
 Project-URL: Homepage, https://github.com/Mresyzz/opsscript-gate
 Project-URL: Repository, https://github.com/Mresyzz/opsscript-gate
@@ -28,7 +28,7 @@ Description-Content-Type: text/markdown
 
 # OpsScript Gate — shell script compatibility testing
 
-[简体中文](README.zh-CN.md) · [Configuration](docs/configuration.md) · [Troubleshooting](docs/troubleshooting.md)
+[简体中文](README.zh-CN.md) · [Configuration](docs/configuration.md) · [Troubleshooting](docs/troubleshooting.md) · [Self-hosted model installer guide](docs/gpt-oss.md)
 
 > ShellCheck analyzes shell syntax. OpsScript Gate executes scripts in Linux containers.
 
@@ -47,11 +47,11 @@ It is designed for shell testing, portable shell validation, Bash/POSIX compatib
 
 ---
 
-## Current release: v0.5.1
+## Current release: v0.6.0
 
 The current release includes a project config file, a dry-run plan, presets, exclusions,
-and saved reports. These controls were introduced in v0.5.0; projects on v0.4.1 and
-earlier do not include them.
+saved reports, and changed-script selection for pull requests. The project controls
+were introduced in v0.5.0; projects on v0.4.1 and earlier do not include them.
 
 ```bash
 opsscript-gate init
@@ -87,16 +87,18 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v7
-      - uses: Mresyzz/opsscript-gate@v0.5.1
+      - uses: Mresyzz/opsscript-gate@v0.6.0
 ```
 
-If `script-path` is omitted, the action discovers shell scripts in the repository.
-Use `opsscript-gate run --dry-run` to inspect the selection before running it.
+This zero-configuration form discovers shell scripts in the repository. Use
+`opsscript-gate run --dry-run` to inspect the selection, or set `script-path` when the
+repository has a single installer. For self-hosted model installers, see the
+[installer guide](docs/gpt-oss.md).
 
 Or test a specific script with custom execution modes:
 
 ```yaml
-      - uses: Mresyzz/opsscript-gate@v0.5.1
+      - uses: Mresyzz/opsscript-gate@v0.6.0
         with:
           script-path: scripts/install.sh
           shell: auto
@@ -118,6 +120,25 @@ opsscript-gate run ./scripts/install.sh
 opsscript-gate run
 ```
 
+### Test only scripts changed in a pull request
+
+Fetch the comparison revision and pass the pull request base SHA to avoid running
+unrelated scripts:
+
+```yaml
+      - uses: actions/checkout@v7
+        with:
+          fetch-depth: 0
+      - uses: Mresyzz/opsscript-gate@v0.6.0
+        with:
+          changed-since: ${{ github.event.pull_request.base.sha }}
+          preset: minimal
+```
+
+If the change does not include a shell script, the check passes without starting a
+container. The same selection can be previewed locally with
+`opsscript-gate run --changed-since origin/main --dry-run`.
+
 ### Example: package-manager mismatch
 
 Create `install.sh`:
@@ -340,6 +361,7 @@ usage: opsscript-gate run [-h] [--matrix MATRIX] [-j JOBS] [--timeout TIMEOUT]
 | `--mem-limit` | String | `256m` | Memory limit per container (e.g. `256m`, `512m`) |
 | `--pids-limit`| Integer | `128` | Maximum number of processes per container |
 | `--network` | Choice | `bridge` | Container network mode: `bridge` or `none` |
+| `--changed-since` | Git revision | - | Test shell scripts changed between this revision and `HEAD` |
 | `--version` | Flag | - | Show version number |
 | `-h, --help` | Flag | - | Show argument help |
 

{opsscript_gate-0.5.1 → opsscript_gate-0.6.0}/README.md

@@ -1,6 +1,6 @@
 # OpsScript Gate — shell script compatibility testing
 
-[简体中文](README.zh-CN.md) · [Configuration](docs/configuration.md) · [Troubleshooting](docs/troubleshooting.md)
+[简体中文](README.zh-CN.md) · [Configuration](docs/configuration.md) · [Troubleshooting](docs/troubleshooting.md) · [Self-hosted model installer guide](docs/gpt-oss.md)
 
 > ShellCheck analyzes shell syntax. OpsScript Gate executes scripts in Linux containers.
 
@@ -19,11 +19,11 @@ It is designed for shell testing, portable shell validation, Bash/POSIX compatib
 
 ---
 
-## Current release: v0.5.1
+## Current release: v0.6.0
 
 The current release includes a project config file, a dry-run plan, presets, exclusions,
-and saved reports. These controls were introduced in v0.5.0; projects on v0.4.1 and
-earlier do not include them.
+saved reports, and changed-script selection for pull requests. The project controls
+were introduced in v0.5.0; projects on v0.4.1 and earlier do not include them.
 
 ```bash
 opsscript-gate init
@@ -59,16 +59,18 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v7
-      - uses: Mresyzz/opsscript-gate@v0.5.1
+      - uses: Mresyzz/opsscript-gate@v0.6.0
 ```
 
-If `script-path` is omitted, the action discovers shell scripts in the repository.
-Use `opsscript-gate run --dry-run` to inspect the selection before running it.
+This zero-configuration form discovers shell scripts in the repository. Use
+`opsscript-gate run --dry-run` to inspect the selection, or set `script-path` when the
+repository has a single installer. For self-hosted model installers, see the
+[installer guide](docs/gpt-oss.md).
 
 Or test a specific script with custom execution modes:
 
 ```yaml
-      - uses: Mresyzz/opsscript-gate@v0.5.1
+      - uses: Mresyzz/opsscript-gate@v0.6.0
         with:
           script-path: scripts/install.sh
           shell: auto
@@ -90,6 +92,25 @@ opsscript-gate run ./scripts/install.sh
 opsscript-gate run
 ```
 
+### Test only scripts changed in a pull request
+
+Fetch the comparison revision and pass the pull request base SHA to avoid running
+unrelated scripts:
+
+```yaml
+      - uses: actions/checkout@v7
+        with:
+          fetch-depth: 0
+      - uses: Mresyzz/opsscript-gate@v0.6.0
+        with:
+          changed-since: ${{ github.event.pull_request.base.sha }}
+          preset: minimal
+```
+
+If the change does not include a shell script, the check passes without starting a
+container. The same selection can be previewed locally with
+`opsscript-gate run --changed-since origin/main --dry-run`.
+
 ### Example: package-manager mismatch
 
 Create `install.sh`:
@@ -312,6 +333,7 @@ usage: opsscript-gate run [-h] [--matrix MATRIX] [-j JOBS] [--timeout TIMEOUT]
 | `--mem-limit` | String | `256m` | Memory limit per container (e.g. `256m`, `512m`) |
 | `--pids-limit`| Integer | `128` | Maximum number of processes per container |
 | `--network` | Choice | `bridge` | Container network mode: `bridge` or `none` |
+| `--changed-since` | Git revision | - | Test shell scripts changed between this revision and `HEAD` |
 | `--version` | Flag | - | Show version number |
 | `-h, --help` | Flag | - | Show argument help |
 

{opsscript_gate-0.5.1 → opsscript_gate-0.6.0}/README.zh-CN.md

@@ -1,6 +1,6 @@
 # OpsScript Gate：Shell 脚本跨发行版运行检查
 
-[English](README.md) · [配置说明](docs/configuration.md) · [常见问题](docs/troubleshooting.md)
+[English](README.md) · [配置说明](docs/configuration.md) · [常见问题](docs/troubleshooting.md) · [自托管模型安装脚本指南](docs/gpt-oss.md)
 
 在 Debian、Ubuntu、Alpine 容器里实际运行 Shell 脚本，提前发现缺失命令、
 Bash 依赖、包管理器假设和交互式阻塞。它与 ShellCheck 互补。
@@ -8,9 +8,9 @@ Bash 依赖、包管理器假设和交互式阻塞。它与 ShellCheck 互补。
 适合独立安装脚本、容器入口脚本和发布脚本。每次只挂载目标脚本，
 不挂载整个仓库；依赖其他仓库文件的脚本需要现有项目测试配合。
 
-## 当前版本 v0.5.1
+## 当前版本 v0.6.0
 
-v0.5.1 已作为正式版本发布；如果你要从源码验证当前分支，也可以执行：
+v0.6.0 已作为正式版本发布；如果你要从源码验证当前分支，也可以执行：
 
 ```bash
 pip install -e .
@@ -25,7 +25,7 @@ opsscript-gate run --dry-run
 opsscript-gate run --format json --output reports/compatibility.json
 ```
 
-`init` 生成配置和 GitHub 工作流，不覆盖已有文件。工作流引用 `v0.5.1`。
+`init` 生成配置和 GitHub 工作流，不覆盖已有文件。工作流引用 `v0.6.0`。
 预览不需要 Docker；真实运行需要 Python 3.10+
 和可访问的 Linux Docker 引擎。
 
@@ -45,6 +45,25 @@ opsscript-gate run --format json --output reports/compatibility.json
 返回码 `0` 表示全部通过，`1` 表示检查失败或发生错误。`--dry-run` 成功只表示
 执行计划生成成功。容器不是不可信代码的安全沙箱。
 
+在 Pull Request 中只检查本次修改的脚本，可以先获取完整 Git 历史，再传入目标分支提交：
+
+```yaml
+- uses: actions/checkout@v7
+  with:
+    fetch-depth: 0
+- uses: Mresyzz/opsscript-gate@v0.6.0
+  with:
+    changed-since: ${{ github.event.pull_request.base.sha }}
+    preset: minimal
+```
+
+如果本次修改没有 Shell 脚本，检查会直接通过，不启动容器。 本地可以用
+`opsscript-gate run --changed-since origin/main --dry-run` 预览选择结果。
+
+如果仓库维护自托管模型的安装或启动脚本，可以参考
+[自托管模型安装脚本指南](docs/gpt-oss.md)。它只验证 Shell 和发行版兼容性，
+不代替 GPU、模型权重或推理质量测试。
+
 ## 示例：为什么 Alpine 上会失败
 
 ```sh

{opsscript_gate-0.5.1 → opsscript_gate-0.6.0}/action.yml

@@ -67,6 +67,10 @@ inputs:
     description: 'Save a report file for upload-artifact or other tooling'
     required: false
     default: ''
+  changed-since:
+    description: 'Only test shell scripts changed between this Git revision and HEAD'
+    required: false
+    default: ''
 
 runs:
   using: 'composite'
@@ -99,6 +103,7 @@ runs:
         INPUT_MAX_SCRIPTS: ${{ inputs.max-scripts }}
         INPUT_DRY_RUN: ${{ inputs.dry-run }}
         INPUT_OUTPUT: ${{ inputs.output }}
+        INPUT_CHANGED_SINCE: ${{ inputs.changed-since }}
       run: |
         ARGS=("run")
         if [ -n "$INPUT_SCRIPT_PATH" ]; then
@@ -117,6 +122,7 @@ runs:
         [ -z "$INPUT_PRESET" ] || ARGS+=(--preset "$INPUT_PRESET")
         [ -z "$INPUT_MAX_SCRIPTS" ] || ARGS+=(--max-scripts "$INPUT_MAX_SCRIPTS")
         [ -z "$INPUT_OUTPUT" ] || ARGS+=(--output "$INPUT_OUTPUT")
+        [ -z "$INPUT_CHANGED_SINCE" ] || ARGS+=(--changed-since "$INPUT_CHANGED_SINCE")
         while IFS= read -r pattern; do
           pattern="${pattern%$'\r'}"
           [ -z "$pattern" ] || ARGS+=("--exclude" "$pattern")

{opsscript_gate-0.5.1 → opsscript_gate-0.6.0}/docs/configuration.md

@@ -11,7 +11,7 @@ opsscript-gate run --dry-run
 ```
 
 `init` refuses to overwrite either `.opsscript-gate.json` or
-`.github/workflows/opsscript-gate.yml`. The generated workflow uses the v0.5.1 tag.
+`.github/workflows/opsscript-gate.yml`. The generated workflow uses the v0.6.0 tag.
 
 The generated config uses the two-image `minimal` preset, honors recognized shell
 shebangs, disables networking, and excludes `tests/*` and `examples/*`. Review these
@@ -89,8 +89,23 @@ test result. Docker startup failures may occur before a report can be produced.
 The Action accepts matching `config`, `preset`, `max-scripts`, `dry-run`, and `output`
 inputs; `exclude` is a multiline list. Omitted execution inputs preserve config values.
 
+For pull requests, set `changed-since` to the base commit and fetch full Git history:
+
+```yaml
+- uses: actions/checkout@v7
+  with:
+    fetch-depth: 0
+- uses: Mresyzz/opsscript-gate@v0.6.0
+  with:
+    changed-since: ${{ github.event.pull_request.base.sha }}
+    preset: minimal
+```
+
+The Action passes when no changed shell scripts are selected. This keeps unrelated
+documentation or application changes from starting container jobs.
+
 ```yaml
-- uses: Mresyzz/opsscript-gate@v0.5.1
+- uses: Mresyzz/opsscript-gate@v0.6.0
   with:
     config: .opsscript-gate.json
     format: json

opsscript_gate-0.6.0/docs/gpt-oss.md

@@ -0,0 +1,80 @@
+# Test self-hosted model installer scripts
+
+OpsScript Gate fits the installation and release layer of a self-hosted model project. It
+executes shell scripts in Debian, Ubuntu, and Alpine containers to catch distribution
+differences, missing commands, package-manager assumptions, and interactive hangs.
+
+This guide uses [OpenAI's gpt-oss open-weight models](https://openai.com/index/introducing-gpt-oss/)
+as a concrete example. The checks cover installer scripts, startup scripts, and container
+entrypoints. They do **not** test GPU drivers, CUDA/ROCm, model weights, inference speed,
+output quality, or the memory requirements of a particular machine. Keeping this boundary
+explicit prevents a script-compatibility check from being mistaken for a complete model
+deployment test.
+
+## Check changed scripts in pull requests
+
+Assume the repository contains `scripts/bootstrap-gpt-oss.sh` or another shell installer:
+
+```yaml
+name: Model installer compatibility
+
+on:
+  pull_request:
+
+permissions:
+  contents: read
+
+jobs:
+  shell-runtime:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+
+      - uses: Mresyzz/opsscript-gate@v0.6.0
+        with:
+          changed-since: ${{ github.event.pull_request.base.sha }}
+          preset: minimal
+          shell: auto
+          network: none
+```
+
+`changed-since` selects only shell files changed in the commit range. Documentation,
+Python, model configuration, and frontend changes do not start containers. If no shell
+file changed, the check passes without doing container work.
+
+If the installer must download packages or model files, change `network` to `bridge` and
+keep downloads in a dedicated test script. Once network access is enabled, upstream
+mirrors and package indexes can affect repeatability.
+
+## Preview and run locally
+
+Confirm the selection before starting Docker:
+
+```bash
+pip install opsscript-gate
+opsscript-gate run --changed-since origin/main --preset minimal --shell auto --dry-run
+opsscript-gate run scripts/bootstrap-gpt-oss.sh --preset minimal --shell auto --network none
+```
+
+If an installer depends on other repository files, an explicit `script-path` still checks
+only that script; dependencies are not mounted into the container. Put the required logic
+behind a standalone test entrypoint, or use the project's integration tests for file-level
+collaboration and use OpsScript Gate for the cross-distribution runtime layer.
+
+## What to inspect when a check fails
+
+- `apt-get` is missing on Alpine: choose `apk` for that distribution, or detect it and
+  return a clear message.
+- `bash` is missing: declare `#!/usr/bin/env bash` for Bash syntax, use `shell: auto`, and
+  confirm that the selected test image includes Bash.
+- The script waits for input: remove interactive prompts or return a clear non-interactive
+  error.
+- A download fails: separate script failures from network or package-index instability;
+  use `network: bridge` only when needed and pin versions with checksums.
+
+Model loading, GPU drivers, and inference quality belong in the project's hardware
+integration tests. OpsScript Gate makes the installer and startup scripts pass a small,
+repeatable shell-runtime check before those expensive tests run.

{opsscript_gate-0.5.1 → opsscript_gate-0.6.0}/examples/github-actions/README.md

@@ -2,4 +2,4 @@
 
 This example shows a GitHub Actions workflow for checking a shell script on pull requests.
 
-Copy `workflow.yml` into your repository at `.github/workflows/script-gate.yml` and point `script-path` to the script you want to validate. The example uses the current v0.5.1 Action release.
+Copy `workflow.yml` into your repository at `.github/workflows/script-gate.yml` and point `script-path` to the script you want to validate. The example uses the current v0.6.0 Action release.

{opsscript_gate-0.5.1 → opsscript_gate-0.6.0}/examples/github-actions/workflow.yml

@@ -19,7 +19,7 @@ jobs:
           persist-credentials: false
 
       - name: Run OpsScript Gate
-        uses: Mresyzz/opsscript-gate@v0.5.1
+        uses: Mresyzz/opsscript-gate@v0.6.0
         with:
           script-path: 'scripts/deploy.sh'
           shell: auto

{opsscript_gate-0.5.1 → opsscript_gate-0.6.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "opsscript-gate"
-version = "0.5.1"
+version = "0.6.0"
 description = "Run Linux shell scripts in Debian, Ubuntu and Alpine containers to catch runtime compatibility failures before merge"
 readme = "README.md"
 license = { text = "MIT" }

{opsscript_gate-0.5.1 → opsscript_gate-0.6.0}/src/opsscript_gate/__init__.py

@@ -1,4 +1,4 @@
 """OpsScript Gate: Lightweight cross-distro compatibility pre-check for Linux ops scripts."""
 
-__version__ = "0.5.1"
+__version__ = "0.6.0"
 __all__ = ["__version__"]

{opsscript_gate-0.5.1 → opsscript_gate-0.6.0}/src/opsscript_gate/cli.py

@@ -8,7 +8,7 @@ import time
 from pathlib import Path
 
 from opsscript_gate import __version__
-from opsscript_gate.discovery import discover_scripts
+from opsscript_gate.discovery import discover_changed_scripts, discover_scripts
 from opsscript_gate.config import DEFAULTS, PRESETS, init_project, load_config
 from opsscript_gate.models import MultiScriptReport, RunReport
 from opsscript_gate.reporter import (
@@ -108,6 +108,10 @@ def build_parser() -> argparse.ArgumentParser:
         default="bridge",
         help="Network mode for containers: 'bridge' or 'none' (default: bridge)",
     )
+    run_parser.add_argument(
+        "--changed-since",
+        help="Only test shell scripts changed between this Git revision and HEAD",
+    )
 
     run_parser.add_argument("--config", help="Project JSON configuration (default: .opsscript-gate.json)")
     run_parser.add_argument("--preset", choices=list(PRESETS), help="Named distribution matrix")
@@ -172,18 +176,30 @@ def main(argv: list[str] | None = None) -> int:
             sys.stderr.write(f"Error: {err}\n")
             return 1
         # Resolve target script(s)
+        if args.script_path and args.changed_since:
+            sys.stderr.write("Error: use either a script path or --changed-since, not both\n")
+            return 1
+        changed_selection = bool(args.changed_since)
         if args.script_path:
             if not os.path.isfile(args.script_path):
                 sys.stderr.write(f"Error: Script file not found: {args.script_path}\n")
                 return 1
             target_scripts = [args.script_path]
+        elif changed_selection:
+            try:
+                target_scripts = discover_changed_scripts(
+                    ".", since=args.changed_since, max_scripts=args.max_scripts, exclude=args.exclude
+                )
+            except ValueError as err:
+                sys.stderr.write(f"Error: {err}\n")
+                return 1
         else:
             try:
                 target_scripts = discover_scripts(".", max_scripts=args.max_scripts, exclude=args.exclude)
             except ValueError as err:
                 sys.stderr.write(f"Error: {err}\n")
                 return 1
-            if not target_scripts:
+            if not target_scripts and not changed_selection:
                 sys.stderr.write(
                     "No shell scripts discovered in the current directory. "
                     "Please specify a script path explicitly.\n"
@@ -203,6 +219,8 @@ def main(argv: list[str] | None = None) -> int:
             plan = {"dry_run": True, "scripts": target_scripts, "matrix": matrix,
                     "executions": len(target_scripts) * len(matrix), "shell": args.shell,
                     "network": args.network, "timeout": args.timeout}
+            if changed_selection:
+                plan["changed_since"] = args.changed_since
             output = json.dumps(plan, indent=2) if args.format == "json" else (
                 "Execution preview (no scripts executed)\n"
                 + "\n".join(f"  {path}" for path in target_scripts)
@@ -211,6 +229,12 @@ def main(argv: list[str] | None = None) -> int:
             )
             return 0 if publish_output(output, args.output) else 1
 
+        if not target_scripts:
+            output = (
+                f"No changed shell scripts since {args.changed_since}; skipping compatibility checks."
+            )
+            return 0 if publish_output(output, args.output) else 1
+
         if len(target_scripts) == 1:
             script_path = target_scripts[0]
             try:

{opsscript_gate-0.5.1 → opsscript_gate-0.6.0}/src/opsscript_gate/config.py

@@ -63,7 +63,7 @@ jobs:
       - uses: actions/checkout@v7
         with:
           persist-credentials: false
-      - uses: Mresyzz/opsscript-gate@v0.5.1
+      - uses: Mresyzz/opsscript-gate@v0.6.0
         with:
           config: .opsscript-gate.json
 """,

{opsscript_gate-0.5.1 → opsscript_gate-0.6.0}/src/opsscript_gate/discovery.py

@@ -2,6 +2,7 @@ from __future__ import annotations
 
 import os
 import fnmatch
+import subprocess
 from pathlib import Path
 
 # Directories to ignore during automatic script discovery
@@ -117,3 +118,66 @@ def discover_scripts(
     # Sort alphabetically for stable, deterministic ordering
     discovered.sort()
     return discovered
+
+
+def discover_changed_scripts(
+    root_dir: str = ".",
+    since: str = "HEAD^",
+    max_scripts: int = MAX_DISCOVERED_SCRIPTS,
+    max_size_bytes: int = MAX_SCRIPT_SIZE_BYTES,
+    exclude: list[str] | None = None,
+) -> list[str]:
+    """Discover shell scripts changed between ``since`` and ``HEAD``.
+
+    Git provides the candidate paths; the same file, size, shebang, exclusion,
+    and overflow checks used by normal discovery still apply. A missing Git
+    repository or unavailable revision is reported as a user-facing error.
+    """
+    root_path = Path(root_dir).resolve()
+    if not since or not since.strip() or since.startswith("-") or any(char.isspace() for char in since):
+        raise ValueError("changed-since must name a Git revision")
+
+    try:
+        result = subprocess.run(
+            ["git", "diff", "--name-only", "--diff-filter=ACMR", "-z",
+             f"{since}...HEAD", "--"],
+            cwd=root_path,
+            check=True,
+            stdout=subprocess.PIPE,
+            stderr=subprocess.PIPE,
+        )
+    except FileNotFoundError as exc:
+        raise ValueError("changed-since requires Git to be installed") from exc
+    except subprocess.CalledProcessError as exc:
+        detail = exc.stderr.decode("utf-8", errors="replace").strip()
+        raise ValueError(
+            f"Cannot compare Git revision {since!r} with HEAD"
+            + (f": {detail}" if detail else "")
+        ) from exc
+
+    changed_paths = [
+        item.decode("utf-8", errors="surrogateescape")
+        for item in result.stdout.split(b"\0")
+        if item
+    ]
+    discovered: list[str] = []
+    for relative_name in changed_paths:
+        candidate = root_path / Path(relative_name)
+        try:
+            resolved = candidate.resolve()
+            rel_path = resolved.relative_to(root_path).as_posix()
+        except (OSError, ValueError):
+            continue
+        if any(fnmatch.fnmatchcase(rel_path, pattern) for pattern in (exclude or [])):
+            continue
+        if not is_shell_script(candidate, max_size_bytes=max_size_bytes):
+            continue
+        normalized = rel_path if "/" in rel_path else f"./{rel_path}"
+        discovered.append(normalized)
+        if len(discovered) > max_scripts:
+            raise ValueError(
+                f"Changed files include more than {max_scripts} shell scripts, exceeding limit. "
+                "Use --exclude or increase --max-scripts; no scripts were executed."
+            )
+
+    return sorted(set(discovered))

{opsscript_gate-0.5.1 → opsscript_gate-0.6.0}/tests/test_action_contract.py

@@ -7,13 +7,14 @@ ROOT = Path(__file__).parents[1]
 def test_action_metadata_is_valid_and_inputs_are_wired():
     text = (ROOT / "action.yml").read_text(encoding="utf-8")
     assert "using: 'composite'" in text
-    for name in ("config", "preset", "exclude", "max-scripts", "dry-run", "output"):
+    for name in ("config", "preset", "exclude", "max-scripts", "dry-run", "output", "changed-since"):
         assert f"  {name}:" in text
     run_text = text
     for flag in ("--timeout", "--format", "--shell", "--mem-limit", "--pids-limit",
                  "--network", "--matrix", "--jobs", "--config", "--preset",
                  "--max-scripts", "--output", "--exclude"):
         assert flag in run_text
+    assert "--changed-since" in run_text
 
 
 def test_test_workflow_has_valid_yaml_and_python_indent():

{opsscript_gate-0.5.1 → opsscript_gate-0.6.0}/tests/test_onboarding.py

@@ -6,7 +6,7 @@ import pytest
 
 from opsscript_gate.cli import main
 from opsscript_gate.config import CONFIG_NAME, init_project, load_config
-from opsscript_gate.discovery import discover_scripts, is_shell_script
+from opsscript_gate.discovery import discover_changed_scripts, discover_scripts, is_shell_script
 from opsscript_gate.models import RunReport, SingleResult, DistroStatus
 
 
@@ -96,6 +96,40 @@ def test_discovery_stops_at_first_overflow(tmp_path, monkeypatch):
     assert len(checked) == 3
 
 
+def test_changed_discovery_uses_git_paths_and_filters_candidates(tmp_path):
+    (tmp_path / "install.sh").write_text("#!/bin/sh\necho ok\n")
+    (tmp_path / "README.md").write_text("docs\n")
+    completed = type("Completed", (), {"stdout": b"install.sh\0README.md\0", "stderr": b""})()
+    with patch("opsscript_gate.discovery.subprocess.run", return_value=completed) as run:
+        result = discover_changed_scripts(str(tmp_path), since="origin/main")
+    assert result == ["./install.sh"]
+    run.assert_called_once()
+    assert "origin/main...HEAD" in run.call_args.args[0]
+
+
+@pytest.mark.parametrize("revision", ["", "--output=bad", "origin/main bad"])
+def test_changed_discovery_rejects_invalid_revision(tmp_path, revision):
+    with pytest.raises(ValueError, match="changed-since"):
+        discover_changed_scripts(str(tmp_path), since=revision)
+
+
+def test_changed_discovery_reports_empty_selection_as_success(project, monkeypatch, capsys):
+    monkeypatch.setattr("opsscript_gate.cli.discover_changed_scripts", lambda *args, **kwargs: [])
+    assert main(["run", "--changed-since", "origin/main"]) == 0
+    assert "No changed shell scripts" in capsys.readouterr().out
+
+
+def test_changed_discovery_preview_includes_revision(project, monkeypatch, capsys):
+    monkeypatch.setattr(
+        "opsscript_gate.cli.discover_changed_scripts",
+        lambda *args, **kwargs: ["./install.sh"],
+    )
+    assert main(["run", "--changed-since", "origin/main", "--dry-run", "--format", "json"]) == 0
+    plan = json.loads(capsys.readouterr().out)
+    assert plan["changed_since"] == "origin/main"
+    assert plan["scripts"] == ["./install.sh"]
+
+
 @pytest.mark.parametrize("flags", [["--jobs", "0"], ["--timeout", "-1"],
     ["--pids-limit", "0"], ["--network", "host"], ["--matrix", ","],
     ["--matrix", "alpine", "--preset", "minimal"], ["--config", "missing.json"]])