opsscript-gate 0.9.2__tar.gz → 0.9.4__tar.gz

{opsscript_gate-0.9.2 → opsscript_gate-0.9.4}/.github/workflows/release.yml

@@ -128,7 +128,8 @@ jobs:
                 echo "Tag $TARGET_TAG was released from earlier commit ($TAG_SHA != ${{ github.sha }}). Skipping release."
               fi
             else
-              echo "Target tag $TARGET_TAG does not exist. Creating it and handing publication to the tag workflow."
+              echo "Target tag $TARGET_TAG does not exist. Creating tag and publishing release."
+              IS_NEW_RELEASE="true"
               SHOULD_TAG="true"
             fi
           else

{opsscript_gate-0.9.2 → opsscript_gate-0.9.4}/.gitignore

@@ -50,3 +50,4 @@ venv.bak/
 *~
 .DS_Store
 Thumbs.db
+.ai/

{opsscript_gate-0.9.2 → opsscript_gate-0.9.4}/CHANGELOG.md

@@ -1,6 +1,28 @@
 # Changelog
 
-## [0.9.2] - Unreleased
+## [0.9.4] - 2026-10-11
+
+### Fixed
+- Fixed release workflow publishing deadlock where `main` pushes skipped distribution package builds and release creation due to GITHUB_TOKEN tag events not triggering new workflows.
+- Unified command path extraction in remediation rules to ensure full-path commands (e.g. `/usr/bin/apt-get`, `/sbin/apk`, `/bin/yum`, `/usr/local/bin/bash`) accurately match package manager and shell hints.
+- Added native RHEL/Fedora/CentOS package mappings in `COMMON_COMMAND_PACKAGES` to prevent fallback to invalid Debian package names.
+- Added native container package pre-installation support for `dnf`, `microdnf`, and `yum` in `runner._wrap_with_package_setup`.
+- Fixed `RunReport` and `MultiScriptReport` `__post_init__` to preserve explicitly passed `all_passed=False` when result collections are empty.
+- Supported bare directory exclusions (e.g. `tests` or `tests/`) in `_matches_exclude` to match both directories and all contained files.
+
+## [0.9.3] - 2026-10-11
+
+### Added
+- Added cross-distribution package name mapping and actionable remediation suggestions (`apt-get`, `apk`, `dnf`) for common missing operations commands (`curl`, `wget`, `jq`, `git`, `tar`, `python3`, `pip`, `sudo`, `make`, `gcc`, etc.).
+- Extended `FailureDiagnostic` and SARIF output with structured `suggested_package` property.
+
+### Fixed
+- Fixed unreadable shell script candidate misclassification during discovery.
+- Ensured temporary script files are safely cleaned up during distribution preparation errors.
+- Added preflight validation to reject directory and missing script paths before creating worker threads.
+- Enforced consistent POSIX LF line endings in report output files across platforms.
+
+## [0.9.2] - 2026-10-05
 
 ### Fixed
 - Hardened SARIF, Markdown, terminal, and machine-readable output handling.

{opsscript_gate-0.9.2 → opsscript_gate-0.9.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: opsscript-gate
-Version: 0.9.2
+Version: 0.9.4
 Summary: Cross-distro shell script compatibility and portability checker for Debian, Ubuntu, and Alpine. Runs real containers to diagnose command not found.
 Project-URL: Homepage, https://mresyzz.github.io/opsscript-gate/
 Project-URL: Demo, https://mresyzz.github.io/opsscript-gate/

{opsscript_gate-0.9.2 → opsscript_gate-0.9.4}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "opsscript-gate"
-version = "0.9.2"
+version = "0.9.4"
 description = "Cross-distro shell script compatibility and portability checker for Debian, Ubuntu, and Alpine. Runs real containers to diagnose command not found."
 readme = "README.md"
 license = { text = "MIT" }

{opsscript_gate-0.9.2 → opsscript_gate-0.9.4}/src/opsscript_gate/__init__.py

@@ -1,4 +1,4 @@
 """OpsScript Gate: Lightweight cross-distro compatibility pre-check for Linux ops scripts."""
 
-__version__ = "0.9.2"
+__version__ = "0.9.4"
 __all__ = ["__version__"]

{opsscript_gate-0.9.2 → opsscript_gate-0.9.4}/src/opsscript_gate/cli.py

@@ -30,6 +30,17 @@ from opsscript_gate.runner import (
     run_matrix,
 )
 
+CRITICAL_PROJECT_FILES: tuple[str, ...] = (
+    "pyproject.toml",
+    "action.yml",
+    "action.yaml",
+    "setup.py",
+    "setup.cfg",
+    "README.md",
+    "CHANGELOG.md",
+)
+
+
 
 def build_parser() -> argparse.ArgumentParser:
     """Build the command-line argument parser."""
@@ -319,6 +330,12 @@ def main(argv: list[str] | None = None) -> int:
             if not os.path.isfile(args.script_path):
                 sys.stderr.write(f"Error: Script file not found: {args.script_path}\n")
                 return 1
+            try:
+                with open(args.script_path, "rb") as probe:
+                    probe.read(1)
+            except OSError as err:
+                sys.stderr.write(f"Error: Cannot read script {args.script_path}: {err}\n")
+                return 1
             target_scripts = [args.script_path]
         elif changed_selection:
             try:
@@ -351,8 +368,15 @@ def main(argv: list[str] | None = None) -> int:
             if output_path.is_dir():
                 sys.stderr.write("Error: output must name a file, not an existing directory\n")
                 return 1
+            if any(part == ".git" for part in output_path.parts):
+                sys.stderr.write("Error: output must not target files inside .git directory\n")
+                return 1
             protected = [Path(p).resolve() for p in target_scripts]
             protected.append(Path(args.config or ".opsscript-gate.json").resolve())
+            for critical_name in CRITICAL_PROJECT_FILES:
+                critical_path = Path(critical_name).resolve()
+                if critical_path.exists():
+                    protected.append(critical_path)
             if _output_overwrites_protected(output_path, protected):
                 sys.stderr.write("Error: output must not overwrite a target script or configuration\n")
                 return 1
@@ -465,7 +489,8 @@ def publish_output(output: str, filename: str | None) -> bool:
         try:
             path = Path(filename)
             path.parent.mkdir(parents=True, exist_ok=True)
-            path.write_text(output + "\n", encoding="utf-8")
+            with path.open("w", encoding="utf-8", newline="\n") as stream:
+                stream.write(output + "\n")
         except OSError as err:
             sys.stderr.write(f"Error writing report: {err}\n")
             return False

{opsscript_gate-0.9.2 → opsscript_gate-0.9.4}/src/opsscript_gate/config.py

@@ -126,7 +126,7 @@ jobs:
       - uses: actions/checkout@v7
         with:
           persist-credentials: false
-      - uses: Mresyzz/opsscript-gate@v0.9.2
+      - uses: Mresyzz/opsscript-gate@v0.9.4
         with:
           config: .opsscript-gate.json
 """,

{opsscript_gate-0.9.2 → opsscript_gate-0.9.4}/src/opsscript_gate/discovery.py

@@ -41,16 +41,23 @@ MAX_SCRIPT_SIZE_BYTES = 1024 * 1024  # 1 MB
 
 
 def _matches_exclude(rel_path: str, patterns: list[str] | None) -> bool:
-    """Match exclusions consistently whether callers use ``foo.sh`` or ``./foo.sh``."""
+    """Match exclusions consistently whether callers use ``foo.sh``, ``./foo.sh``, ``/foo.sh``, or directory names like ``tests``."""
     normalized_path = rel_path.replace("\\", "/")
-    if normalized_path.startswith("./"):
+    while normalized_path.startswith("./"):
         normalized_path = normalized_path[2:]
+    normalized_path = normalized_path.lstrip("/")
     for pattern in patterns or []:
         normalized_pattern = pattern.replace("\\", "/")
-        if normalized_pattern.startswith("./"):
+        while normalized_pattern.startswith("./"):
             normalized_pattern = normalized_pattern[2:]
+        normalized_pattern = normalized_pattern.lstrip("/")
+        if not normalized_pattern:
+            continue
         if fnmatch.fnmatchcase(normalized_path, normalized_pattern):
             return True
+        pat = normalized_pattern.rstrip("/")
+        if normalized_path == pat or normalized_path.startswith(f"{pat}/") or fnmatch.fnmatchcase(normalized_path, f"{pat}/*"):
+            return True
     return False
 
 
@@ -62,6 +69,7 @@ def _is_ignored_path(rel_path: str) -> bool:
     parts = normalized.split("/")
     return any(
         part in IGNORED_DIRS
+        or part == ".."
         or part.endswith(".egg-info")
         or (part.startswith(".") and part not in (".", ".."))
         for part in parts
@@ -75,6 +83,7 @@ def is_shell_script(file_path: Path, max_size_bytes: int = MAX_SCRIPT_SIZE_BYTES
     Check if a file is a candidate shell script:
     - Must be a regular file, never a symlink.
     - File size must not exceed max_size_bytes.
+    - Must be readable by the current process.
     - Extension is .sh or .bash, OR the first line is a recognized shell shebang.
     """
     try:
@@ -84,14 +93,13 @@ def is_shell_script(file_path: Path, max_size_bytes: int = MAX_SCRIPT_SIZE_BYTES
         if stat.st_size == 0 or stat.st_size > max_size_bytes:
             return False
 
+        with open(file_path, "rb") as f:
+            first_line_bytes = f.readline(256)
+
         ext = file_path.suffix.lower()
         if ext in (".sh", ".bash"):
             return True
 
-        # If extension is not .sh/.bash, inspect the first line
-        with open(file_path, "rb") as f:
-            first_line_bytes = f.readline(256)
-
         first_line = first_line_bytes.decode("utf-8-sig", errors="ignore").strip()
         return any(first_line == prefix or first_line.startswith(prefix + " ")
                    for prefix in SHELL_SHEBANG_PREFIXES)

{opsscript_gate-0.9.2 → opsscript_gate-0.9.4}/src/opsscript_gate/models.py

@@ -30,6 +30,7 @@ class FailureDiagnostic:
     line: int | None = None
     distro: str | None = None
     hint: str | None = None
+    suggested_package: str | None = None
 
     def to_dict(self) -> dict[str, Any]:
         d: dict[str, Any] = {
@@ -44,6 +45,8 @@ class FailureDiagnostic:
             d["distro"] = self.distro
         if self.hint is not None:
             d["hint"] = self.hint
+        if self.suggested_package is not None:
+            d["suggested_package"] = self.suggested_package
         return d
 
 
@@ -110,8 +113,6 @@ class RunReport:
     def __post_init__(self) -> None:
         if self.results:
             self.all_passed = all(r.status == DistroStatus.PASS for r in self.results)
-        else:
-            self.all_passed = True
 
     def to_dict(self) -> dict[str, Any]:
         return {
@@ -131,8 +132,6 @@ class MultiScriptReport:
     def __post_init__(self) -> None:
         if self.reports:
             self.all_passed = all(r.all_passed for r in self.reports.values())
-        else:
-            self.all_passed = True
 
     def to_dict(self) -> dict[str, Any]:
         return {

opsscript_gate-0.9.4/src/opsscript_gate/remediation.py

@@ -0,0 +1,239 @@
+from __future__ import annotations
+
+from dataclasses import dataclass
+from typing import Callable
+
+
+@dataclass(frozen=True)
+class RemediationRule:
+    """Rule for generating conservative failure remediation hints."""
+    rule_id: str
+    matcher: Callable[[str | None, str | None, str], bool]
+    hint: str
+
+
+def _normalize_cmd_basename(command: str | None) -> str:
+    """Normalize command path and extract clean executable basename."""
+    if not command:
+        return ""
+    norm = command.lower().replace("\\", "/").split("/")[-1]
+    if norm.endswith(".exe"):
+        norm = norm[:-4]
+    return norm
+
+
+def _match_alpine_apt(distro: str | None, command: str | None, kind: str) -> bool:
+    if not distro or not command:
+        return False
+    return "alpine" in distro.lower() and _normalize_cmd_basename(command) in ("apt", "apt-get")
+
+
+def _match_debian_ubuntu_apk(distro: str | None, command: str | None, kind: str) -> bool:
+    if not distro or not command:
+        return False
+    d = distro.lower()
+    return ("debian" in d or "ubuntu" in d) and _normalize_cmd_basename(command) == "apk"
+
+
+def _match_debian_ubuntu_yum(distro: str | None, command: str | None, kind: str) -> bool:
+    if not distro or not command:
+        return False
+    d = distro.lower()
+    return ("debian" in d or "ubuntu" in d) and _normalize_cmd_basename(command) in ("yum", "dnf")
+
+
+def _match_alpine_yum(distro: str | None, command: str | None, kind: str) -> bool:
+    if not distro or not command:
+        return False
+    return "alpine" in distro.lower() and _normalize_cmd_basename(command) in ("yum", "dnf")
+
+
+def _match_rhel_fedora_apt(distro: str | None, command: str | None, kind: str) -> bool:
+    if not distro or not command:
+        return False
+    d = distro.lower()
+    is_rhel = any(name in d for name in ("fedora", "centos", "rhel", "redhat", "rocky", "alma"))
+    return is_rhel and _normalize_cmd_basename(command) in ("apt", "apt-get", "apk")
+
+
+def _match_alpine_bash(distro: str | None, command: str | None, kind: str) -> bool:
+    if not distro or not command:
+        return False
+    return "alpine" in distro.lower() and _normalize_cmd_basename(command) == "bash"
+
+
+def _match_curl(distro: str | None, command: str | None, kind: str) -> bool:
+    return _normalize_cmd_basename(command) == "curl"
+
+
+def _match_wget(distro: str | None, command: str | None, kind: str) -> bool:
+    return _normalize_cmd_basename(command) == "wget"
+
+
+def _match_sudo(distro: str | None, command: str | None, kind: str) -> bool:
+    return _normalize_cmd_basename(command) == "sudo"
+
+
+def _match_interpreter(distro: str | None, command: str | None, kind: str) -> bool:
+    if kind == "missing_interpreter":
+        return True
+    if command and (command.startswith("/bin/") or command.startswith("/usr/bin/")):
+        base = _normalize_cmd_basename(command)
+        if base in ("bash", "sh", "zsh", "python", "python3", "perl"):
+            return True
+    return False
+
+
+# Mapping of common ops CLI command binaries to distro-specific package names.
+# Supported distro families: "debian" (Debian/Ubuntu), "alpine" (Alpine Linux), "rhel" (Fedora/CentOS/RHEL).
+COMMON_COMMAND_PACKAGES: dict[str, dict[str, str]] = {
+    "curl": {"debian": "curl", "alpine": "curl", "rhel": "curl"},
+    "wget": {"debian": "wget", "alpine": "wget", "rhel": "wget"},
+    "jq": {"debian": "jq", "alpine": "jq", "rhel": "jq"},
+    "git": {"debian": "git", "alpine": "git", "rhel": "git"},
+    "tar": {"debian": "tar", "alpine": "tar", "rhel": "tar"},
+    "gzip": {"debian": "gzip", "alpine": "gzip", "rhel": "gzip"},
+    "bzip2": {"debian": "bzip2", "alpine": "bzip2", "rhel": "bzip2"},
+    "xz": {"debian": "xz-utils", "alpine": "xz", "rhel": "xz"},
+    "unzip": {"debian": "unzip", "alpine": "unzip", "rhel": "unzip"},
+    "zip": {"debian": "zip", "alpine": "zip", "rhel": "zip"},
+    "python": {"debian": "python3", "alpine": "python3", "rhel": "python3"},
+    "python3": {"debian": "python3", "alpine": "python3", "rhel": "python3"},
+    "pip": {"debian": "python3-pip", "alpine": "py3-pip", "rhel": "python3-pip"},
+    "pip3": {"debian": "python3-pip", "alpine": "py3-pip", "rhel": "python3-pip"},
+    "sudo": {"debian": "sudo", "alpine": "sudo", "rhel": "sudo"},
+    "bash": {"debian": "bash", "alpine": "bash", "rhel": "bash"},
+    "make": {"debian": "build-essential", "alpine": "build-base", "rhel": "make"},
+    "gcc": {"debian": "gcc", "alpine": "gcc", "rhel": "gcc"},
+    "ca-certificates": {"debian": "ca-certificates", "alpine": "ca-certificates", "rhel": "ca-certificates"},
+    "openssl": {"debian": "openssl", "alpine": "openssl", "rhel": "openssl"},
+    "nc": {"debian": "netcat-openbsd", "alpine": "netcat-openbsd", "rhel": "nmap-ncat"},
+    "netcat": {"debian": "netcat-openbsd", "alpine": "netcat-openbsd", "rhel": "nmap-ncat"},
+    "socat": {"debian": "socat", "alpine": "socat", "rhel": "socat"},
+    "envsubst": {"debian": "gettext-base", "alpine": "gettext", "rhel": "gettext"},
+    "crontab": {"debian": "cron", "alpine": "dcron", "rhel": "cronie"},
+    "ps": {"debian": "procps", "alpine": "procps", "rhel": "procps-ng"},
+}
+
+
+def detect_distro_family(distro: str | None) -> str:
+    """Identify the distribution family for package manager commands."""
+    if not distro:
+        return "unknown"
+    d = distro.lower()
+    if "alpine" in d:
+        return "alpine"
+    if any(name in d for name in ("debian", "ubuntu", "mint")):
+        return "debian"
+    if any(name in d for name in ("fedora", "centos", "rhel", "redhat", "rocky", "alma")):
+        return "rhel"
+    return "unknown"
+
+
+def resolve_package_recommendation(
+    command: str | None,
+    distro: str | None,
+) -> tuple[str | None, str | None]:
+    """
+    Resolve suggested package name and actionable install command for a missing command.
+    Returns (suggested_package_name, install_command).
+    """
+    if not command:
+        return None, None
+    norm_cmd = command.lower().replace("\\", "/").split("/")[-1]
+    if norm_cmd.endswith(".exe"):
+        norm_cmd = norm_cmd[:-4]
+
+    packages = COMMON_COMMAND_PACKAGES.get(norm_cmd)
+    if not packages:
+        return None, None
+
+    family = detect_distro_family(distro)
+    package_name = packages.get(family)
+    if not package_name and family in ("unknown", "rhel"):
+        package_name = packages.get("debian") or packages.get("alpine")
+
+    if not package_name:
+        return None, None
+
+    if family == "alpine":
+        install_cmd = f"apk add --no-cache {package_name}"
+    elif family == "debian":
+        install_cmd = f"apt-get install -y {package_name}"
+    elif family == "rhel":
+        install_cmd = f"dnf install -y {package_name}"
+    else:
+        install_cmd = None
+
+    return package_name, install_cmd
+
+
+REMEDIATION_RULES: list[RemediationRule] = [
+    RemediationRule(
+        rule_id="alpine_apt",
+        matcher=_match_alpine_apt,
+        hint="Alpine normally uses apk instead of apt-get.",
+    ),
+    RemediationRule(
+        rule_id="debian_ubuntu_apk",
+        matcher=_match_debian_ubuntu_apk,
+        hint="Debian/Ubuntu normally uses APT (apt-get) instead of apk.",
+    ),
+    RemediationRule(
+        rule_id="debian_ubuntu_yum",
+        matcher=_match_debian_ubuntu_yum,
+        hint="Debian/Ubuntu normally uses APT (apt-get) instead of yum or dnf.",
+    ),
+    RemediationRule(
+        rule_id="alpine_yum",
+        matcher=_match_alpine_yum,
+        hint="Alpine normally uses apk instead of yum or dnf.",
+    ),
+    RemediationRule(
+        rule_id="rhel_fedora_apt",
+        matcher=_match_rhel_fedora_apt,
+        hint="RHEL/Fedora family distributions normally use dnf or yum instead of apt-get or apk.",
+    ),
+    RemediationRule(
+        rule_id="alpine_bash",
+        matcher=_match_alpine_bash,
+        hint="Alpine minimal images do not include Bash by default; consider using POSIX sh or installing bash.",
+    ),
+    RemediationRule(
+        rule_id="missing_curl",
+        matcher=_match_curl,
+        hint="Minimal images may not include curl; consider declaring it as a prerequisite or installing it.",
+    ),
+    RemediationRule(
+        rule_id="missing_wget",
+        matcher=_match_wget,
+        hint="Minimal images may not include wget; consider declaring it as a prerequisite or installing it.",
+    ),
+    RemediationRule(
+        rule_id="missing_sudo",
+        matcher=_match_sudo,
+        hint="Minimal container images do not include sudo by default; containers typically run as root or require installing sudo.",
+    ),
+    RemediationRule(
+        rule_id="missing_interpreter",
+        matcher=_match_interpreter,
+        hint="Ensure the required interpreter is installed or adjust the shebang path.",
+    ),
+]
+
+
+def generate_remediation_hint(
+    distro: str | None = None,
+    command: str | None = None,
+    kind: str = "missing_command",
+) -> str | None:
+    """
+    Generate a conservative, testable remediation hint for a failure.
+
+    Uses strict conservative wording ('normally', 'may', 'consider').
+    Returns None if no specific high-confidence recommendation applies.
+    """
+    for rule in REMEDIATION_RULES:
+        if rule.matcher(distro, command, kind):
+            return rule.hint
+    return None

{opsscript_gate-0.9.2 → opsscript_gate-0.9.4}/src/opsscript_gate/reporter.py

@@ -180,18 +180,23 @@ def format_github_annotations(report: RunReport, script_path: str = "") -> list[
     """
     annotations: list[str] = []
     if script_path:
-        clean_path = script_path.replace("\\", "/")
-        if clean_path.startswith("./"):
-            clean_path = clean_path[2:]
-        try:
-            if os.path.isabs(clean_path):
-                clean_path = os.path.relpath(clean_path, ".").replace("\\", "/")
-        except Exception:
-            pass
+        clean_path = sanitize_display_text(script_path).replace("\\", "/")
+        if os.path.isabs(clean_path) or re.match(r"^[A-Za-z]:/", clean_path):
+            try:
+                clean_path = os.path.relpath(clean_path, os.getcwd()).replace("\\", "/")
+            except Exception:
+                clean_path = os.path.basename(clean_path)
+        norm = os.path.normpath(clean_path).replace("\\", "/")
+        while norm.startswith("./"):
+            norm = norm[2:]
+        if norm == ".." or norm.startswith("../") or "/../" in f"/{norm}/":
+            clean_path = os.path.basename(clean_path)
+        else:
+            clean_path = norm
         norm_script = clean_path if clean_path else "script.sh"
     else:
         norm_script = "script.sh"
-    escaped_file = escape_github_property(sanitize_display_text(norm_script))
+    escaped_file = escape_github_property(norm_script)
 
     for r in report.results:
         if r.status == DistroStatus.PASS:
@@ -534,8 +539,13 @@ def _sarif_path(script_path: str) -> str:
             clean = os.path.basename(clean)
     while clean.startswith("./"):
         clean = clean[2:]
-    if clean == ".." or clean.startswith("../"):
+    norm = os.path.normpath(clean).replace("\\", "/")
+    while norm.startswith("./"):
+        norm = norm[2:]
+    if norm == ".." or norm.startswith("../") or "/../" in f"/{norm}/":
         clean = os.path.basename(clean)
+    else:
+        clean = norm
     return clean or "script.sh"
 
 
@@ -572,8 +582,11 @@ def _sarif_result(result: SingleResult, script_path: str) -> dict[str, object] |
     }
     if result.exit_code is not None:
         properties["exitCode"] = result.exit_code
-    if result.diagnostic and result.diagnostic.command:
-        properties["command"] = sanitize_display_text(result.diagnostic.command)
+    if result.diagnostic:
+        if result.diagnostic.command:
+            properties["command"] = sanitize_display_text(result.diagnostic.command)
+        if result.diagnostic.suggested_package:
+            properties["suggestedPackage"] = sanitize_display_text(result.diagnostic.suggested_package)
 
     return {
         "ruleId": rule_id,