opsscript-gate 0.8.3__tar.gz → 0.9.1__tar.gz

{opsscript_gate-0.8.3 → opsscript_gate-0.9.1}/.github/workflow-templates/opsscript-gate.properties.json

@@ -1,6 +1,6 @@
 {
   "name": "OpsScript Gate shell compatibility",
-  "description": "Run shell scripts in Debian, Ubuntu and Alpine containers on changes to shell files.",
+  "description": "Run shell scripts in Debian, Ubuntu and Alpine containers to catch command not found and runtime compatibility failures.",
   "iconName": "octicon-shield-check",
   "categories": ["Continuous integration", "Testing"],
   "filePatterns": [".*\\.sh$", ".*\\.bash$"]

{opsscript_gate-0.8.3 → opsscript_gate-0.9.1}/CHANGELOG.md

@@ -1,5 +1,25 @@
 # Changelog
 
+## [0.9.1] - 2026-10-03
+
+### Fixed
+- Normalized discovery exclusions so top-level paths match with or without `./`.
+- Made SARIF output conform to the 2.1.0 result schema.
+- Failed closed when Docker omitted an exit code and separated package setup errors from script failures.
+- Validated project configuration in `doctor` and handled UTF-8 BOM scripts.
+- Distinguished Docker wait API errors from genuine execution timeouts.
+
+## [0.9.0] - 2026-10-03
+
+### Added
+- Added `--repeat` and Action/config `repeat` support to detect flaky runtime behavior per distribution.
+- Added attempt counts and `FLAKY` status to JSON, Markdown, SARIF, terminal, and GitHub Step Summary reports.
+
+### Fixed
+- Bounded project configuration reads to prevent oversized configuration files from consuming unbounded memory.
+- Prefer Docker's blocking wait API over repeated synchronous container reloads, while retaining a bounded compatibility fallback.
+- Removed duplicated CLI execution error handling and the unused `asdict` import.
+
 ## [0.8.3] - 2026-10-02
 
 - Corrected the PyPI homepage and demo links to point to the OpsScript Gate Pages site.

{opsscript_gate-0.8.3 → opsscript_gate-0.9.1}/CITATION.cff

@@ -5,7 +5,7 @@ type: software
 authors:
   - family-names: Mresyzz
     given-names: Mresy
-version: 0.8.3
+version: 0.9.0
 date-released: 2026-10-02
 repository-code: https://github.com/Mresyzz/opsscript-gate
 url: https://github.com/Mresyzz/opsscript-gate

opsscript_gate-0.8.3/README.md → opsscript_gate-0.9.1/PKG-INFO

@@ -1,8 +1,39 @@
-# OpsScript Gate — GitHub Action for cross-distro shell installer testing
+Metadata-Version: 2.5
+Name: opsscript-gate
+Version: 0.9.1
+Summary: Cross-distro shell script compatibility checker for runtime testing in Debian, Ubuntu and Alpine
+Project-URL: Homepage, https://mresyzz.github.io/opsscript-gate/
+Project-URL: Demo, https://mresyzz.github.io/opsscript-gate/
+Project-URL: Repository, https://github.com/Mresyzz/opsscript-gate
+Project-URL: Issues, https://github.com/Mresyzz/opsscript-gate/issues
+Project-URL: Changelog, https://github.com/Mresyzz/opsscript-gate/blob/main/CHANGELOG.md
+Project-URL: Documentation, https://github.com/Mresyzz/opsscript-gate/tree/main/docs
+Project-URL: Troubleshooting, https://github.com/Mresyzz/opsscript-gate/blob/main/docs/command-not-found.md
+Author: Mresyzz
+License: MIT
+License-File: LICENSE
+Keywords: alpine,apk,apt-get,bashisms,bootstrap,busybox,ci,command-not-found,compatibility,cross-distro,debian,devops,docker,github-actions,installer,installer-testing,linux,portable-shell,posix,runtime-compatibility,shell,shell-portability,shell-script-testing,shellcheck,shellcheck-alternative,testing,ubuntu
+Classifier: Development Status :: 4 - Beta
+Classifier: Intended Audience :: Developers
+Classifier: Intended Audience :: System Administrators
+Classifier: License :: OSI Approved :: MIT License
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Topic :: Software Development :: Testing
+Classifier: Topic :: System :: Systems Administration
+Requires-Python: >=3.10
+Requires-Dist: docker>=7.0.0
+Provides-Extra: test
+Requires-Dist: pytest>=8.0.0; extra == 'test'
+Description-Content-Type: text/markdown
+
+# OpsScript Gate — cross-distro shell script runtime compatibility checker
 
 [Live demo](https://mresyzz.github.io/opsscript-gate/) · [简体中文](README.zh-CN.md) · [Configuration](docs/configuration.md) · [Troubleshooting](docs/troubleshooting.md) · [Self-hosted model installer guide](docs/gpt-oss.md)
 
-> A GitHub Action and Python CLI that executes shell installers in Debian, Ubuntu, and Alpine containers. ShellCheck analyzes syntax; OpsScript Gate verifies runtime compatibility.
+> **OpsScript Gate is a cross-distro shell script runtime compatibility checker.** The GitHub Action and Python CLI test shell installers in real Debian, Ubuntu, and Alpine containers and diagnose failures such as `command not found`. Use it alongside ShellCheck to check both source code and runtime behavior.
 
 [![CI](https://github.com/Mresyzz/opsscript-gate/actions/workflows/test.yml/badge.svg)](https://github.com/Mresyzz/opsscript-gate/actions/workflows/test.yml)
 [![Demo](https://github.com/Mresyzz/opsscript-gate/actions/workflows/demo.yml/badge.svg)](https://github.com/Mresyzz/opsscript-gate/actions/workflows/demo.yml)
@@ -13,21 +44,55 @@
 [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)
 [![Supported Distros](https://img.shields.io/badge/matrix-Debian%20%7C%20Ubuntu%20%7C%20Alpine-orange.svg)](#default-test-matrix)
 
-**OpsScript Gate** is a runtime compatibility checker for Linux shell scripts. It executes scripts inside unprivileged Debian, Ubuntu, and Alpine containers, catching environment-specific failures, missing interpreters, and package-manager assumptions that static analysis cannot detect.
+**OpsScript Gate** is a cross-distro shell script runtime compatibility checker for Linux. It executes scripts inside unprivileged Debian, Ubuntu, and Alpine containers, catching environment-specific failures, missing interpreters, package-manager assumptions, and exit code 127 errors that static analysis cannot detect.
 
 It is designed for shell testing, portable shell validation, Bash/POSIX compatibility checks, and cross-distro CI where syntax-only tooling is not enough.
 
+If you arrived here from an error or a search, these are the problems this project answers:
+
+- `command not found` when a shell script runs in Docker or GitHub Actions
+- `apt-get: not found` on Alpine, or `apk: not found` on Debian/Ubuntu
+- a shell installer that passes ShellCheck but fails at runtime
+- a shell script compatibility checker that tests runtime commands, not only syntax
+- cross-distro shell testing for installers, bootstrap scripts, and entrypoints
+- testing one shell script across real Debian, Ubuntu, and Alpine containers
+- replacing a hand-written cross-distribution CI matrix with one reusable action
+
+Start with the problem-first guide: [debug `command not found` across Debian, Ubuntu, and Alpine](docs/command-not-found.md). It includes a failing script, the diagnosis, a copyable workflow, and the local CLI equivalent.
+
 If your repository contains an installer, bootstrap script, or shell entrypoint, start with the
 [interactive demo](https://mresyzz.github.io/opsscript-gate/), then copy the maintained
 [zero-configuration workflow](.github/workflow-templates/opsscript-gate.yml). The demo explains the
 ShellCheck-versus-runtime gap and the workflow is ready to review in your own repository.
 
+### The 15-second proof
+
+This script is valid POSIX shell and can pass a syntax linter, but it fails on Alpine because
+`apt-get` is not installed there:
+
+```sh
+#!/bin/sh
+set -eu
+apt-get --version
+```
+
+Run it locally with `opsscript-gate run ./install.sh`, or add the following step to CI:
+
+```yaml
+- uses: Mresyzz/opsscript-gate@v0.9.1
+  with:
+    script-path: install.sh
+```
+
+The result identifies the failing distribution, exit code, line, missing command, and the usual remediation (`apk` on Alpine). See the [full `command not found` guide](docs/command-not-found.md) for Bash, `curl`, `jq`, and noninteractive prompt cases.
+
 ---
 
-## Current release: v0.8.3
+## Current release: v0.9.1
 
 The current release includes a project config file, a dry-run plan, presets, exclusions,
-saved reports, and changed-script selection for pull requests. The project controls
+saved reports, changed-script selection for pull requests, and repeat runs for detecting
+flaky runtime behavior. The project controls
 were introduced in v0.5.0; projects on v0.4.1 and earlier do not include them.
 
 ```bash
@@ -35,6 +100,8 @@ opsscript-gate init
 opsscript-gate doctor
 opsscript-gate run --dry-run
 opsscript-gate run --format json --output reports/compatibility.json
+# Repeat each distro three times when diagnosing intermittent failures
+opsscript-gate run ./install.sh --repeat 3
 ```
 
 `init` creates `.opsscript-gate.json` and a GitHub Actions workflow without replacing
@@ -75,7 +142,7 @@ jobs:
       - uses: actions/checkout@v7
         with:
           persist-credentials: false
-      - uses: Mresyzz/opsscript-gate@v0.8.3
+      - uses: Mresyzz/opsscript-gate@v0.9.1
 ```
 
 This zero-configuration form discovers shell scripts in the repository. Use
@@ -86,11 +153,13 @@ repository has a single installer. For self-hosted model installers, see the
 Or test a specific script with custom execution modes:
 
 ```yaml
-      - uses: Mresyzz/opsscript-gate@v0.8.3
+      - uses: Mresyzz/opsscript-gate@v0.9.1
         with:
           script-path: scripts/install.sh
           shell: auto
           jobs: 4
+          # Optional: expose intermittent runtime failures
+          repeat: 3
 ```
 
 ### In Local Terminal (CLI)
@@ -118,7 +187,7 @@ unrelated scripts:
         with:
           persist-credentials: false
           fetch-depth: 0
-      - uses: Mresyzz/opsscript-gate@v0.8.3
+      - uses: Mresyzz/opsscript-gate@v0.9.1
         with:
           changed-since: ${{ github.event.pull_request.base.sha }}
           preset: minimal
@@ -128,6 +197,14 @@ If the change does not include a shell script, the check passes without starting
 container. The same selection can be previewed locally with
 `opsscript-gate run --changed-since origin/main --dry-run`.
 
+### Detect intermittent runtime failures
+
+Use `--repeat N` when a script sometimes passes and sometimes fails in CI. OpsScript
+Gate runs each distribution N times and reports `FLAKY` when the same distribution has
+both passing and failing attempts. The JSON, Markdown, SARIF, annotations, and step
+summary include the attempt counts so a retry cannot silently turn an unstable script
+green.
+
 ### Example: package-manager mismatch
 
 Create `install.sh`:
@@ -201,7 +278,7 @@ Use `sarif` when the result should appear in GitHub Code Scanning or another
 SARIF-compatible viewer. Upload it explicitly with the official upload action:
 
 ```yaml
-- uses: Mresyzz/opsscript-gate@v0.8.3
+- uses: Mresyzz/opsscript-gate@v0.9.1
   with:
     script-path: scripts/install.sh
     format: sarif

opsscript_gate-0.8.3/PKG-INFO → opsscript_gate-0.9.1/README.md

@@ -1,38 +1,8 @@
-Metadata-Version: 2.5
-Name: opsscript-gate
-Version: 0.8.3
-Summary: Run Linux shell scripts in Debian, Ubuntu and Alpine containers to catch runtime compatibility failures before merge
-Project-URL: Homepage, https://mresyzz.github.io/opsscript-gate/
-Project-URL: Demo, https://mresyzz.github.io/opsscript-gate/
-Project-URL: Repository, https://github.com/Mresyzz/opsscript-gate
-Project-URL: Issues, https://github.com/Mresyzz/opsscript-gate/issues
-Project-URL: Changelog, https://github.com/Mresyzz/opsscript-gate/blob/main/CHANGELOG.md
-Project-URL: Documentation, https://github.com/Mresyzz/opsscript-gate/tree/main/docs
-Author: Mresyzz
-License: MIT
-License-File: LICENSE
-Keywords: alpine,bootstrap,busybox,ci,compatibility,cross-distro,debian,devops,docker,github-actions,installer,installer-testing,linux,posix,shell,shell-portability,shellcheck,shellcheck-alternative,testing,ubuntu
-Classifier: Development Status :: 4 - Beta
-Classifier: Intended Audience :: Developers
-Classifier: Intended Audience :: System Administrators
-Classifier: License :: OSI Approved :: MIT License
-Classifier: Programming Language :: Python :: 3
-Classifier: Programming Language :: Python :: 3.10
-Classifier: Programming Language :: Python :: 3.11
-Classifier: Programming Language :: Python :: 3.12
-Classifier: Topic :: Software Development :: Testing
-Classifier: Topic :: System :: Systems Administration
-Requires-Python: >=3.10
-Requires-Dist: docker>=7.0.0
-Provides-Extra: test
-Requires-Dist: pytest>=8.0.0; extra == 'test'
-Description-Content-Type: text/markdown
-
-# OpsScript Gate — GitHub Action for cross-distro shell installer testing
+# OpsScript Gate — cross-distro shell script runtime compatibility checker
 
 [Live demo](https://mresyzz.github.io/opsscript-gate/) · [简体中文](README.zh-CN.md) · [Configuration](docs/configuration.md) · [Troubleshooting](docs/troubleshooting.md) · [Self-hosted model installer guide](docs/gpt-oss.md)
 
-> A GitHub Action and Python CLI that executes shell installers in Debian, Ubuntu, and Alpine containers. ShellCheck analyzes syntax; OpsScript Gate verifies runtime compatibility.
+> **OpsScript Gate is a cross-distro shell script runtime compatibility checker.** The GitHub Action and Python CLI test shell installers in real Debian, Ubuntu, and Alpine containers and diagnose failures such as `command not found`. Use it alongside ShellCheck to check both source code and runtime behavior.
 
 [![CI](https://github.com/Mresyzz/opsscript-gate/actions/workflows/test.yml/badge.svg)](https://github.com/Mresyzz/opsscript-gate/actions/workflows/test.yml)
 [![Demo](https://github.com/Mresyzz/opsscript-gate/actions/workflows/demo.yml/badge.svg)](https://github.com/Mresyzz/opsscript-gate/actions/workflows/demo.yml)
@@ -43,21 +13,55 @@ Description-Content-Type: text/markdown
 [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)
 [![Supported Distros](https://img.shields.io/badge/matrix-Debian%20%7C%20Ubuntu%20%7C%20Alpine-orange.svg)](#default-test-matrix)
 
-**OpsScript Gate** is a runtime compatibility checker for Linux shell scripts. It executes scripts inside unprivileged Debian, Ubuntu, and Alpine containers, catching environment-specific failures, missing interpreters, and package-manager assumptions that static analysis cannot detect.
+**OpsScript Gate** is a cross-distro shell script runtime compatibility checker for Linux. It executes scripts inside unprivileged Debian, Ubuntu, and Alpine containers, catching environment-specific failures, missing interpreters, package-manager assumptions, and exit code 127 errors that static analysis cannot detect.
 
 It is designed for shell testing, portable shell validation, Bash/POSIX compatibility checks, and cross-distro CI where syntax-only tooling is not enough.
 
+If you arrived here from an error or a search, these are the problems this project answers:
+
+- `command not found` when a shell script runs in Docker or GitHub Actions
+- `apt-get: not found` on Alpine, or `apk: not found` on Debian/Ubuntu
+- a shell installer that passes ShellCheck but fails at runtime
+- a shell script compatibility checker that tests runtime commands, not only syntax
+- cross-distro shell testing for installers, bootstrap scripts, and entrypoints
+- testing one shell script across real Debian, Ubuntu, and Alpine containers
+- replacing a hand-written cross-distribution CI matrix with one reusable action
+
+Start with the problem-first guide: [debug `command not found` across Debian, Ubuntu, and Alpine](docs/command-not-found.md). It includes a failing script, the diagnosis, a copyable workflow, and the local CLI equivalent.
+
 If your repository contains an installer, bootstrap script, or shell entrypoint, start with the
 [interactive demo](https://mresyzz.github.io/opsscript-gate/), then copy the maintained
 [zero-configuration workflow](.github/workflow-templates/opsscript-gate.yml). The demo explains the
 ShellCheck-versus-runtime gap and the workflow is ready to review in your own repository.
 
+### The 15-second proof
+
+This script is valid POSIX shell and can pass a syntax linter, but it fails on Alpine because
+`apt-get` is not installed there:
+
+```sh
+#!/bin/sh
+set -eu
+apt-get --version
+```
+
+Run it locally with `opsscript-gate run ./install.sh`, or add the following step to CI:
+
+```yaml
+- uses: Mresyzz/opsscript-gate@v0.9.1
+  with:
+    script-path: install.sh
+```
+
+The result identifies the failing distribution, exit code, line, missing command, and the usual remediation (`apk` on Alpine). See the [full `command not found` guide](docs/command-not-found.md) for Bash, `curl`, `jq`, and noninteractive prompt cases.
+
 ---
 
-## Current release: v0.8.3
+## Current release: v0.9.1
 
 The current release includes a project config file, a dry-run plan, presets, exclusions,
-saved reports, and changed-script selection for pull requests. The project controls
+saved reports, changed-script selection for pull requests, and repeat runs for detecting
+flaky runtime behavior. The project controls
 were introduced in v0.5.0; projects on v0.4.1 and earlier do not include them.
 
 ```bash
@@ -65,6 +69,8 @@ opsscript-gate init
 opsscript-gate doctor
 opsscript-gate run --dry-run
 opsscript-gate run --format json --output reports/compatibility.json
+# Repeat each distro three times when diagnosing intermittent failures
+opsscript-gate run ./install.sh --repeat 3
 ```
 
 `init` creates `.opsscript-gate.json` and a GitHub Actions workflow without replacing
@@ -105,7 +111,7 @@ jobs:
       - uses: actions/checkout@v7
         with:
           persist-credentials: false
-      - uses: Mresyzz/opsscript-gate@v0.8.3
+      - uses: Mresyzz/opsscript-gate@v0.9.1
 ```
 
 This zero-configuration form discovers shell scripts in the repository. Use
@@ -116,11 +122,13 @@ repository has a single installer. For self-hosted model installers, see the
 Or test a specific script with custom execution modes:
 
 ```yaml
-      - uses: Mresyzz/opsscript-gate@v0.8.3
+      - uses: Mresyzz/opsscript-gate@v0.9.1
         with:
           script-path: scripts/install.sh
           shell: auto
           jobs: 4
+          # Optional: expose intermittent runtime failures
+          repeat: 3
 ```
 
 ### In Local Terminal (CLI)
@@ -148,7 +156,7 @@ unrelated scripts:
         with:
           persist-credentials: false
           fetch-depth: 0
-      - uses: Mresyzz/opsscript-gate@v0.8.3
+      - uses: Mresyzz/opsscript-gate@v0.9.1
         with:
           changed-since: ${{ github.event.pull_request.base.sha }}
           preset: minimal
@@ -158,6 +166,14 @@ If the change does not include a shell script, the check passes without starting
 container. The same selection can be previewed locally with
 `opsscript-gate run --changed-since origin/main --dry-run`.
 
+### Detect intermittent runtime failures
+
+Use `--repeat N` when a script sometimes passes and sometimes fails in CI. OpsScript
+Gate runs each distribution N times and reports `FLAKY` when the same distribution has
+both passing and failing attempts. The JSON, Markdown, SARIF, annotations, and step
+summary include the attempt counts so a retry cannot silently turn an unstable script
+green.
+
 ### Example: package-manager mismatch
 
 Create `install.sh`:
@@ -231,7 +247,7 @@ Use `sarif` when the result should appear in GitHub Code Scanning or another
 SARIF-compatible viewer. Upload it explicitly with the official upload action:
 
 ```yaml
-- uses: Mresyzz/opsscript-gate@v0.8.3
+- uses: Mresyzz/opsscript-gate@v0.9.1
   with:
     script-path: scripts/install.sh
     format: sarif

{opsscript_gate-0.8.3 → opsscript_gate-0.9.1}/README.zh-CN.md

@@ -1,18 +1,25 @@
-# OpsScript Gate：GitHub Action 跨发行版 Shell 安装脚本测试
+# OpsScript Gate：cross-distro shell script runtime compatibility checker
 
-[English](README.md) · [配置说明](docs/configuration.md) · [常见问题](docs/troubleshooting.md) · [自托管模型安装脚本指南](docs/gpt-oss.md)
+OpsScript Gate 是跨发行版 Shell 脚本运行时兼容性检查器（cross-distro shell script runtime compatibility checker）。
+它在 Debian、Ubuntu、Alpine 中真实运行脚本，诊断 `command not found`。
+
+[English](README.md) · [按错误排查：`command not found` / `apt-get: not found`](docs/command-not-found.md) · [配置说明](docs/configuration.md) · [常见问题](docs/troubleshooting.md) · [自托管模型安装脚本指南](docs/gpt-oss.md)
 
 在 Debian、Ubuntu、Alpine 容器里实际运行 Shell 脚本，提前发现缺失命令、
 Bash 依赖、包管理器假设和交互式阻塞。它与 ShellCheck 互补。
 
+如果你搜索的是“在 Debian/Ubuntu/Alpine 真实运行 shell 脚本”“Alpine 上
+`apt-get: not found`”“ShellCheck 通过但 CI 运行失败”，请直接看
+[按错误排查的指南](docs/command-not-found.md)。
+
 适合独立安装脚本、容器入口脚本和发布脚本。每次只挂载目标脚本，
 不挂载整个仓库；依赖其他仓库文件的脚本需要现有项目测试配合。
 
 也可以直接打开 [OpsScript Gate 在线演示](https://mresyzz.github.io/opsscript-gate/)，先查看 ShellCheck 与运行时验证的差异，再复制 workflow 到自己的仓库。
 
-## 当前版本 v0.8.3
+## 当前版本 v0.9.0
 
-v0.8.3 已作为正式版本发布；如果你要从源码验证当前分支，也可以执行：
+v0.9.0 已作为正式版本发布；如果你要从源码验证当前分支，也可以执行：
 
 ```bash
 pip install -e .
@@ -28,7 +35,7 @@ opsscript-gate run --dry-run
 opsscript-gate run --format json --output reports/compatibility.json
 ```
 
-`init` 生成配置和 GitHub 工作流，不覆盖已有文件。工作流引用 `v0.8.3`。
+`init` 生成配置和 GitHub 工作流，不覆盖已有文件。工作流引用 `v0.9.0`。
 预览不需要 Docker；真实运行需要 Python 3.10+
 和可访问的 Linux Docker 引擎。
 `opsscript-gate doctor` 可以在真实运行前检查 Python 和 Docker。
@@ -51,6 +58,8 @@ opsscript-gate run --format json --output reports/compatibility.json
 - 排除规则、发行版预设、扫描数量限制。
 - 超过扫描上限明确报错，避免只测前 20 个却误以为全部通过。
 - 报告保存为 JSON、Markdown 或文本，失败时同样保留结果。
+- 使用 `--repeat 3` 或配置 `"repeat": 3` 重复运行每个发行版；同一发行版出现
+  一次通过、一次失败时会标记为 `FLAKY`，避免偶发绿灯掩盖 CI 不稳定。
 - 自动发现跳过符号链接，并严格校验配置与执行参数。
 
 返回码 `0` 表示全部通过，`1` 表示检查失败或发生错误。`--dry-run` 成功只表示
@@ -65,7 +74,7 @@ Docker daemon 和可选的项目配置。
 - uses: actions/checkout@v7
   with:
     fetch-depth: 0
-- uses: Mresyzz/opsscript-gate@v0.8.3
+- uses: Mresyzz/opsscript-gate@v0.9.0
   with:
     changed-since: ${{ github.event.pull_request.base.sha }}
     preset: minimal

{opsscript_gate-0.8.3 → opsscript_gate-0.9.1}/ROADMAP.md

@@ -4,6 +4,15 @@ This roadmap tracks features delivered in recent releases and areas under consid
 
 ---
 
+## Delivered in v0.9.0
+
+- [x] **Flaky Runtime Detection (`--repeat` / `repeat`)**: Repeat each distribution
+  run and report mixed pass/fail outcomes as `FLAKY` with attempt counts.
+- [x] **Bounded Configuration Loading**: Reject oversized project configuration files
+  before parsing them.
+- [x] **Blocking Container Wait**: Prefer Docker's wait API over repeated synchronous
+  status reloads while retaining a test-double fallback.
+
 ## Delivered in v0.4.0
 
 - [x] **High-confidence Line-level GitHub Actions Annotations**: Emits safe `::error` annotations linking failure lines directly on pull request file diffs.

{opsscript_gate-0.8.3 → opsscript_gate-0.9.1}/action.yml

@@ -1,5 +1,5 @@
 name: 'OpsScript Gate'
-description: 'Run Linux shell installers across Debian, Ubuntu, and Alpine; a ShellCheck companion for runtime compatibility in CI.'
+description: 'Cross-distro shell script compatibility checker for runtime testing in Debian, Ubuntu, and Alpine. Diagnoses command not found.'
 author: 'Mresyzz'
 branding:
   icon: 'shield'
@@ -22,6 +22,10 @@ inputs:
     description: 'Hard timeout in seconds per container (default: 60)'
     required: false
     default: ''
+  repeat:
+    description: 'Repeat each distribution run to detect flaky runtime behavior (default: 1)'
+    required: false
+    default: ''
   format:
     description: 'Output report format: table, markdown, json, or sarif'
     required: false
@@ -96,6 +100,7 @@ runs:
         INPUT_MATRIX: ${{ inputs.matrix }}
         INPUT_JOBS: ${{ inputs.jobs }}
         INPUT_TIMEOUT: ${{ inputs.timeout }}
+        INPUT_REPEAT: ${{ inputs.repeat }}
         INPUT_FORMAT: ${{ inputs.format }}
         INPUT_SHELL: ${{ inputs.shell }}
         INPUT_MEM_LIMIT: ${{ inputs.mem-limit }}
@@ -116,6 +121,7 @@ runs:
         fi
         # Only explicit inputs override project configuration.
         [ -z "$INPUT_TIMEOUT" ] || ARGS+=(--timeout "$INPUT_TIMEOUT")
+        [ -z "$INPUT_REPEAT" ] || ARGS+=(--repeat "$INPUT_REPEAT")
         [ -z "$INPUT_FORMAT" ] || ARGS+=(--format "$INPUT_FORMAT")
         [ -z "$INPUT_SHELL" ] || ARGS+=(--shell "$INPUT_SHELL")
         [ -z "$INPUT_MEM_LIMIT" ] || ARGS+=(--mem-limit "$INPUT_MEM_LIMIT")

{opsscript_gate-0.8.3 → opsscript_gate-0.9.1}/demo.html

@@ -232,7 +232,7 @@
             OpsScript Gate
           </span>
           <span class="font-mono text-[11px] px-1.5 py-0.5 rounded bg-[var(--surface-muted)] text-[var(--text-muted)] border border-[var(--border-light)]">
-            v0.8.3
+            v0.9.0
           </span>
         </div>
       </div>
@@ -367,7 +367,7 @@
         <div class="panel-card p-4 flex flex-col justify-between space-y-3">
           <div class="space-y-2.5">
             <div class="flex items-center justify-between border-b border-[var(--border-light)] pb-2">
-              <span class="font-mono text-xs font-medium text-[var(--text-muted)]">OpsScript Gate Runtime (v0.8.3)</span>
+              <span class="font-mono text-xs font-medium text-[var(--text-muted)]">OpsScript Gate Runtime (v0.9.0)</span>
               <span id="ops-status" class="font-mono text-xs font-semibold px-2 py-0.5 rounded border">
                 1 DISTRO FAILED
               </span>
@@ -536,7 +536,7 @@
     <span class="font-semibold text-[var(--text-hero)]">steps:</span>
       - <span class="font-semibold text-[var(--text-hero)]">uses:</span> actions/checkout@v4
       - <span class="font-semibold text-[var(--text-hero)]">name:</span> Validate scripts across distributions
-        <span class="font-semibold text-[var(--brand)]">uses:</span> Mresyzz/opsscript-gate@v0.8.3
+        <span class="font-semibold text-[var(--brand)]">uses:</span> Mresyzz/opsscript-gate@v0.9.0
         <span class="font-semibold text-[var(--text-hero)]">with:</span>
           <span class="text-[var(--text-body)]">script-path:</span> ./install.sh
           <span class="text-[var(--text-body)]">shell:</span> auto
@@ -604,7 +604,7 @@ jobs:
     steps:
       - uses: actions/checkout@v4
       - name: Validate scripts across distributions
-        uses: Mresyzz/opsscript-gate@v0.8.3
+        uses: Mresyzz/opsscript-gate@v0.9.0
         with:
           script-path: ./install.sh
           shell: auto

opsscript_gate-0.9.1/docs/command-not-found.html

@@ -0,0 +1,122 @@
+<!doctype html>
+<html lang="en">
+<head>
+  <meta charset="utf-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1">
+  <title>Test shell scripts in Debian, Ubuntu and Alpine: command not found | OpsScript Gate</title>
+  <meta name="description" content="Test a shell installer in real Debian, Ubuntu and Alpine containers. Diagnose command not found, exit code 127 and missing Bash with OpsScript Gate, a GitHub Action and CLI.">
+  <link rel="canonical" href="https://mresyzz.github.io/opsscript-gate/command-not-found.html">
+  <meta property="og:title" content="ShellCheck passed. Does your installer run on Alpine?">
+  <meta property="og:description" content="A reproducible shell runtime compatibility check for Debian, Ubuntu and Alpine, with a copyable GitHub Actions workflow.">
+  <meta property="og:url" content="https://mresyzz.github.io/opsscript-gate/command-not-found.html">
+  <style>
+    :root { color-scheme: light; --ink:#262420; --muted:#59544b; --accent:#a94a31; --line:#ddd6c9; }
+    * { box-sizing:border-box; }
+    body { margin:0; background:#faf8f5; color:var(--ink); font:17px/1.7 system-ui,sans-serif; }
+    main { width:min(900px,100%); margin:auto; padding:32px 24px 64px; }
+    nav { display:flex; flex-wrap:wrap; justify-content:space-between; gap:12px; padding-bottom:28px; }
+    a { color:var(--accent); text-underline-offset:4px; }
+    a:focus-visible { outline:3px solid var(--accent); outline-offset:5px; }
+    h1 { font:normal clamp(32px,6vw,48px)/1.18 Georgia,serif; letter-spacing:-.025em; margin:12px 0 20px; }
+    h2 { font:normal 28px/1.3 Georgia,serif; margin:38px 0 12px; }
+    h3 { font-size:18px; margin:0 0 10px; }
+    p { margin:12px 0; } .eyebrow,.muted { color:var(--muted); }
+    .eyebrow { font-size:13px; letter-spacing:.05em; text-transform:uppercase; }
+    pre { background:#f0ebe2; padding:20px; border:1px solid var(--line); border-radius:9px; overflow:auto; font:14px/1.65 Consolas,monospace; }
+    code { font-family:Consolas,monospace; } p code,td code { font-size:.9em; }
+    .table-wrap { overflow:auto; } table { border-collapse:collapse; width:100%; }
+    th,td { text-align:left; padding:12px; border-bottom:1px solid var(--line); }
+    .pass { color:#1e593d; } .fail { color:#8a342b; }
+    .cards { display:grid; grid-template-columns:repeat(3,minmax(0,1fr)); gap:14px; }
+    .card { border:1px solid var(--line); background:white; border-radius:9px; padding:20px; font-size:15px; }
+    .cta { display:inline-block; background:var(--accent); color:white; padding:10px 18px; border-radius:6px; text-decoration:none; margin:16px 0; }
+    footer { margin-top:40px; padding-top:20px; border-top:1px solid var(--line); font-size:14px; }
+    @media (max-width:650px) { .cards { grid-template-columns:1fr; } main { padding:24px 18px 48px; } }
+  </style>
+</head>
+<body>
+<main>
+  <nav aria-label="Primary"><a href="./">OpsScript Gate</a><a href="https://github.com/Mresyzz/opsscript-gate">GitHub repository</a></nav>
+  <p class="eyebrow">Cross-distro shell script runtime compatibility checker</p>
+  <h1>ShellCheck passed.<br>Your installer still failed on Alpine.</h1>
+  <p><strong>OpsScript Gate tests shell scripts in real Debian, Ubuntu, and Alpine containers.</strong>
+    It is a GitHub Action and Python CLI that reports each distribution's PASS/FAIL result and
+    diagnoses runtime failures such as <code>command not found</code>.</p>
+  <p>Use it for standalone installers, bootstrap scripts, and shell entrypoints. You supply the script;
+    the tool runs the distribution matrix and collects the diagnostic report.</p>
+  <a class="cta" href="#workflow">Add the runtime check to CI</a>
+
+  <h2>A valid shell script can assume the wrong command</h2>
+  <p>Save this as <code>install.sh</code>. The syntax is valid POSIX shell, but Alpine uses
+    <code>apk</code> and does not supply <code>apt-get</code> in its standard image.</p>
+  <pre><code>#!/bin/sh
+set -eu
+apt-get --version</code></pre>
+  <p class="muted">Expected outcome for this example; this page does not execute containers in your browser.</p>
+  <div class="table-wrap"><table>
+    <thead><tr><th scope="col">Image</th><th scope="col">Result</th><th scope="col">Diagnostic</th></tr></thead>
+    <tbody>
+      <tr><td><code>debian:12-slim</code></td><td class="pass">PASS</td><td>Exit 0</td></tr>
+      <tr><td><code>ubuntu:22.04</code></td><td class="pass">PASS</td><td>Exit 0</td></tr>
+      <tr><td><code>ubuntu:24.04</code></td><td class="pass">PASS</td><td>Exit 0</td></tr>
+      <tr><td><code>alpine:3.20</code></td><td class="fail">FAIL</td><td>Exit 127: <code>apt-get: not found</code>, line 3</td></tr>
+    </tbody>
+  </table></div>
+  <p>A shell linter checks source code. Executing the script tests which commands actually exist in the target image.
+    Run both checks to cover source mistakes and runtime assumptions.</p>
+
+  <h2 id="workflow">A complete GitHub Actions workflow</h2>
+  <p>Copy this into <code>.github/workflows/shell-runtime.yml</code> and set <code>script-path</code>
+    to your installer. The Ubuntu runner starts the Debian, Ubuntu, and Alpine containers.</p>
+  <pre><code>name: Shell runtime compatibility
+on: [push, pull_request]
+permissions:
+  contents: read
+jobs:
+  runtime:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
+      - uses: Mresyzz/opsscript-gate@v0.9.0
+        with:
+          script-path: install.sh
+          shell: auto
+          format: markdown
+          output: reports/compatibility.md</code></pre>
+  <p>The report includes the image, exit code, script line where available, missing command, and remediation hint.
+    GitHub Actions also receives workflow annotations and a Step Summary.
+    <a href="https://github.com/Mresyzz/opsscript-gate/actions/workflows/demo.yml">Inspect the project's real CI demo runs</a>.</p>
+
+  <h2>What the failure tells you</h2>
+  <div class="cards">
+    <article class="card"><h3><code>apt-get: not found</code></h3><p>Check for APT or <code>apk</code> before calling it.
+      Package names differ by distribution; do not replace them blindly.</p></article>
+    <article class="card"><h3><code>/bin/bash: not found</code></h3><p>Minimal Alpine omits Bash by default.
+      Use POSIX shell or declare an image or package prerequisite that supplies Bash.</p></article>
+    <article class="card"><h3><code>curl</code> or <code>jq</code> missing</h3><p>Minimal images omit many convenience tools.
+      Declare required tools through <code>packages</code> or explain the prerequisite in your installer.</p></article>
+  </div>
+
+  <h2>Run the same check locally</h2>
+  <p>Requires Python 3.10+ and a reachable Docker engine running Linux containers.</p>
+  <pre><code>pip install opsscript-gate
+opsscript-gate doctor
+opsscript-gate run ./install.sh</code></pre>
+  <p>The CLI supports table, Markdown, JSON, and SARIF reports.
+    <code>--dry-run</code> previews the plan without Docker; it does not verify runtime compatibility.</p>
+
+  <h2>Where this check fits</h2>
+  <p>ShellCheck analyzes shell source; OpsScript Gate executes it across distributions. A handwritten Docker matrix
+    can also run scripts, but you maintain its image list, timeouts, log parsing, and reports.</p>
+  <p>OpsScript Gate mounts each script independently. Sibling files and repository dependencies are not mounted.
+    These are distribution user-space tests in containers, not separate Linux kernels or full-machine tests.
+    Passing checks do not prove security or replace project integration tests.</p>
+  <footer>Read the <a href="https://github.com/Mresyzz/opsscript-gate/blob/main/docs/configuration.md">configuration guide</a>,
+    <a href="https://github.com/Mresyzz/opsscript-gate/blob/main/docs/troubleshooting.md">troubleshooting</a>,
+    or <a href="https://github.com/Mresyzz/opsscript-gate/blob/main/SECURITY.md">security boundaries</a>.
+    <a href="./">Open the interactive demo</a>.</footer>
+</main>
+</body>
+</html>