opsscript-gate 0.9.4__tar.gz → 0.9.6__tar.gz

{opsscript_gate-0.9.4 → opsscript_gate-0.9.6}/.github/workflow-templates/opsscript-gate.yml

@@ -25,7 +25,7 @@ jobs:
           persist-credentials: false
 
       - name: Run OpsScript Gate
-        uses: Mresyzz/opsscript-gate@v0.9.2
+        uses: Mresyzz/opsscript-gate@v0.9.4
         with:
           shell: auto
           network: none

{opsscript_gate-0.9.4 → opsscript_gate-0.9.6}/.github/workflows/deploy-pages.yml

@@ -25,6 +25,8 @@ jobs:
         uses: actions/checkout@v4
       - name: Setup Pages
         uses: actions/configure-pages@v5
+      - name: Stage downloadable installer workflow
+        run: cp examples/github-actions/installer-smoke.yml docs/installer-smoke.yml
       - name: Upload artifact
         uses: actions/upload-pages-artifact@v3
         with:

{opsscript_gate-0.9.4 → opsscript_gate-0.9.6}/CHANGELOG.md

@@ -1,5 +1,23 @@
 # Changelog
 
+## [0.9.6] - 2026-11-08
+
+### Added
+- Added safe container environment variable injection via CLI `--env` and configuration `"env": {...}`, with strict POSIX variable name validation (`^[A-Za-z_][A-Za-z0-9_]*$`).
+- Added host workspace context read-only mounting via CLI `--workdir` and configuration `"workdir": "..."`, automatically setting `/workspace` as the container working directory while strictly preserving host immutability (`mode: "ro"`).
+- Added `env` and `workdir` inputs to the GitHub Composite Action with transparent argument forwarding.
+- Expanded `COMMON_COMMAND_PACKAGES` to provide cross-distro package remediation for standard operations tools (`find`, `xargs`, `grep`, `sed`, `awk`, `diff`, `patch`, `ssh`, `rsync`, `htop`).
+- Added Windows case-insensitive path collision protection in `_output_overwrites_protected` to prevent accidental overwrites of critical project files (e.g. `README.md`).
+
+## [0.9.5] - 2026-11-08
+
+### Added
+- Extended structured failure diagnostics to handle exit code 126 (`permission_denied` and `exec_format_error`) and exit code 137 (`oom_killed`) with targeted remediation suggestions.
+- Added native distribution family detection for Amazon Linux (`amazonlinux`, `amzn`) and Oracle Linux (`oracle`, `ol:`) to support RHEL-family package recommendations.
+- Added GitHub Composite Action `outputs` for `all-passed` and `report-file`, exporting execution status via `$GITHUB_OUTPUT`.
+- Surfaced package installation recommendations and package names directly in Markdown compatibility tables, failure diagnostic log drawers, and terminal detail outputs.
+- Added convenient counting properties (`passed_count`, `failed_count`, `total_count`) on `RunReport` and `MultiScriptReport`.
+
 ## [0.9.4] - 2026-10-11
 
 ### Fixed

{opsscript_gate-0.9.4 → opsscript_gate-0.9.6}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: opsscript-gate
-Version: 0.9.4
+Version: 0.9.6
 Summary: Cross-distro shell script compatibility and portability checker for Debian, Ubuntu, and Alpine. Runs real containers to diagnose command not found.
 Project-URL: Homepage, https://mresyzz.github.io/opsscript-gate/
 Project-URL: Demo, https://mresyzz.github.io/opsscript-gate/
@@ -28,6 +28,7 @@ Requires-Dist: docker>=7.0.0
 Provides-Extra: test
 Requires-Dist: markdown-it-py>=3.0.0; extra == 'test'
 Requires-Dist: pytest>=8.0.0; extra == 'test'
+Requires-Dist: pyyaml>=6.0.0; extra == 'test'
 Description-Content-Type: text/markdown
 
 # OpsScript Gate — cross-distro shell script runtime compatibility checker
@@ -80,7 +81,7 @@ apt-get --version
 Run it locally with `opsscript-gate run ./install.sh`, or add the following step to CI:
 
 ```yaml
-- uses: Mresyzz/opsscript-gate@v0.9.2
+- uses: Mresyzz/opsscript-gate@v0.9.6
   with:
     script-path: install.sh
 ```
@@ -89,12 +90,9 @@ The result identifies the failing distribution, exit code, line, missing command
 
 ---
 
-## Current version: v0.9.2 (local candidate)
+## Current release: v0.9.6
 
-The current release includes a project config file, a dry-run plan, presets, exclusions,
-saved reports, changed-script selection for pull requests, and repeat runs for detecting
-flaky runtime behavior. The project controls
-were introduced in v0.5.0; projects on v0.4.1 and earlier do not include them.
+The current release includes safe environment variable passing (`--env`), host workspace context read-only mounting (`--workdir`), expanded package recommendations for standard Linux tools, structured diagnostic properties in SARIF, and composite action outputs.
 
 ```bash
 opsscript-gate init
@@ -103,6 +101,8 @@ opsscript-gate run --dry-run
 opsscript-gate run --format json --output reports/compatibility.json
 # Repeat each distro three times when diagnosing intermittent failures
 opsscript-gate run ./install.sh --repeat 3
+# Pass environment variables and mount repository workspace read-only
+opsscript-gate run ./install.sh --env APP_ENV=staging --workdir .
 ```
 
 `init` creates `.opsscript-gate.json` and a GitHub Actions workflow without replacing
@@ -119,6 +119,10 @@ image's native package manager before testing. Package setup is opt-in and
 requires bridge networking. See [configuration and migration](docs/configuration.md) and
 [why a shell script works on Ubuntu but fails on Alpine](docs/troubleshooting.md).
 
+Testing an installer? Use the [installation smoke test workflow](docs/installer-smoke-test.md)
+to check the installed binary inside each container. A script's zero exit status
+alone does not prove it installed successfully.
+
 ## Quickstart
 
 ### In GitHub Actions
@@ -143,7 +147,7 @@ jobs:
       - uses: actions/checkout@v7
         with:
           persist-credentials: false
-      - uses: Mresyzz/opsscript-gate@v0.9.2
+      - uses: Mresyzz/opsscript-gate@v0.9.6
 ```
 
 This zero-configuration form discovers shell scripts in the repository. Use
@@ -154,7 +158,7 @@ repository has a single installer. For self-hosted model installers, see the
 Or test a specific script with custom execution modes:
 
 ```yaml
-      - uses: Mresyzz/opsscript-gate@v0.9.2
+      - uses: Mresyzz/opsscript-gate@v0.9.6
         with:
           script-path: scripts/install.sh
           shell: auto
@@ -188,7 +192,7 @@ unrelated scripts:
         with:
           persist-credentials: false
           fetch-depth: 0
-      - uses: Mresyzz/opsscript-gate@v0.9.2
+      - uses: Mresyzz/opsscript-gate@v0.9.6
         with:
           changed-since: ${{ github.event.pull_request.base.sha }}
           preset: minimal
@@ -279,7 +283,7 @@ Use `sarif` when the result should appear in GitHub Code Scanning or another
 SARIF-compatible viewer. Upload it explicitly with the official upload action:
 
 ```yaml
-- uses: Mresyzz/opsscript-gate@v0.9.2
+- uses: Mresyzz/opsscript-gate@v0.9.6
   with:
     script-path: scripts/install.sh
     format: sarif

{opsscript_gate-0.9.4 → opsscript_gate-0.9.6}/README.md

@@ -48,7 +48,7 @@ apt-get --version
 Run it locally with `opsscript-gate run ./install.sh`, or add the following step to CI:
 
 ```yaml
-- uses: Mresyzz/opsscript-gate@v0.9.2
+- uses: Mresyzz/opsscript-gate@v0.9.6
   with:
     script-path: install.sh
 ```
@@ -57,12 +57,9 @@ The result identifies the failing distribution, exit code, line, missing command
 
 ---
 
-## Current version: v0.9.2 (local candidate)
+## Current release: v0.9.6
 
-The current release includes a project config file, a dry-run plan, presets, exclusions,
-saved reports, changed-script selection for pull requests, and repeat runs for detecting
-flaky runtime behavior. The project controls
-were introduced in v0.5.0; projects on v0.4.1 and earlier do not include them.
+The current release includes safe environment variable passing (`--env`), host workspace context read-only mounting (`--workdir`), expanded package recommendations for standard Linux tools, structured diagnostic properties in SARIF, and composite action outputs.
 
 ```bash
 opsscript-gate init
@@ -71,6 +68,8 @@ opsscript-gate run --dry-run
 opsscript-gate run --format json --output reports/compatibility.json
 # Repeat each distro three times when diagnosing intermittent failures
 opsscript-gate run ./install.sh --repeat 3
+# Pass environment variables and mount repository workspace read-only
+opsscript-gate run ./install.sh --env APP_ENV=staging --workdir .
 ```
 
 `init` creates `.opsscript-gate.json` and a GitHub Actions workflow without replacing
@@ -87,6 +86,10 @@ image's native package manager before testing. Package setup is opt-in and
 requires bridge networking. See [configuration and migration](docs/configuration.md) and
 [why a shell script works on Ubuntu but fails on Alpine](docs/troubleshooting.md).
 
+Testing an installer? Use the [installation smoke test workflow](docs/installer-smoke-test.md)
+to check the installed binary inside each container. A script's zero exit status
+alone does not prove it installed successfully.
+
 ## Quickstart
 
 ### In GitHub Actions
@@ -111,7 +114,7 @@ jobs:
       - uses: actions/checkout@v7
         with:
           persist-credentials: false
-      - uses: Mresyzz/opsscript-gate@v0.9.2
+      - uses: Mresyzz/opsscript-gate@v0.9.6
 ```
 
 This zero-configuration form discovers shell scripts in the repository. Use
@@ -122,7 +125,7 @@ repository has a single installer. For self-hosted model installers, see the
 Or test a specific script with custom execution modes:
 
 ```yaml
-      - uses: Mresyzz/opsscript-gate@v0.9.2
+      - uses: Mresyzz/opsscript-gate@v0.9.6
         with:
           script-path: scripts/install.sh
           shell: auto
@@ -156,7 +159,7 @@ unrelated scripts:
         with:
           persist-credentials: false
           fetch-depth: 0
-      - uses: Mresyzz/opsscript-gate@v0.9.2
+      - uses: Mresyzz/opsscript-gate@v0.9.6
         with:
           changed-since: ${{ github.event.pull_request.base.sha }}
           preset: minimal
@@ -247,7 +250,7 @@ Use `sarif` when the result should appear in GitHub Code Scanning or another
 SARIF-compatible viewer. Upload it explicitly with the official upload action:
 
 ```yaml
-- uses: Mresyzz/opsscript-gate@v0.9.2
+- uses: Mresyzz/opsscript-gate@v0.9.6
   with:
     script-path: scripts/install.sh
     format: sarif

{opsscript_gate-0.9.4 → opsscript_gate-0.9.6}/README.zh-CN.md

@@ -17,9 +17,9 @@ Bash 依赖、包管理器假设和交互式阻塞。它与 ShellCheck 互补。
 
 也可以直接打开 [OpsScript Gate 在线演示](https://mresyzz.github.io/opsscript-gate/)，先查看 ShellCheck 与运行时验证的差异，再复制 workflow 到自己的仓库。
 
-## 当前版本 v0.9.2
+## 当前版本 v0.9.6
 
-v0.9.2 是当前本地候选版本；如果你要从源码验证当前分支，也可以执行：
+v0.9.6 是当前已发布版本；如果你要从源码验证当前分支，也可以执行：
 
 ```bash
 pip install -e .
@@ -33,9 +33,11 @@ opsscript-gate init
 opsscript-gate doctor
 opsscript-gate run --dry-run
 opsscript-gate run --format json --output reports/compatibility.json
+# 传递环境变量并以只读方式挂载本地工作空间
+opsscript-gate run ./install.sh --env APP_ENV=staging --workdir .
 ```
 
-`init` 生成配置和 GitHub 工作流，不覆盖已有文件。工作流引用 `v0.9.2`。
+`init` 生成配置和 GitHub 工作流，不覆盖已有文件。工作流引用 `v0.9.6`。
 预览不需要 Docker；真实运行需要 Python 3.10+
 和可访问的 Linux Docker 引擎。
 `opsscript-gate doctor` 可以在真实运行前检查 Python 和 Docker。
@@ -74,7 +76,7 @@ Docker daemon 和可选的项目配置。
 - uses: actions/checkout@v7
   with:
     fetch-depth: 0
-- uses: Mresyzz/opsscript-gate@v0.9.2
+- uses: Mresyzz/opsscript-gate@v0.9.6
   with:
     changed-since: ${{ github.event.pull_request.base.sha }}
     preset: minimal

{opsscript_gate-0.9.4 → opsscript_gate-0.9.6}/action.yml

@@ -50,6 +50,14 @@ inputs:
     description: 'Optional comma- or newline-separated packages to install before running (requires network=bridge)'
     required: false
     default: ''
+  env:
+    description: 'Newline-separated list of environment variables to pass into containers (e.g. KEY=VALUE or KEY)'
+    required: false
+    default: ''
+  workdir:
+    description: 'Host directory to mount read-only into /workspace as the container working directory'
+    required: false
+    default: ''
 
   config:
     description: 'Path to project JSON configuration'
@@ -80,6 +88,14 @@ inputs:
     required: false
     default: ''
 
+outputs:
+  all-passed:
+    description: 'Whether all script compatibility checks passed (true or false)'
+    value: ${{ steps.gate.outputs.all-passed }}
+  report-file:
+    description: 'Path to saved report file if output input was set'
+    value: ${{ inputs.output }}
+
 runs:
   using: 'composite'
   steps:
@@ -94,6 +110,7 @@ runs:
         pip install "${{ github.action_path }}"
 
     - name: Run compatibility gate
+      id: gate
       shell: bash
       env:
         INPUT_SCRIPT_PATH: ${{ inputs.script-path }}
@@ -107,6 +124,8 @@ runs:
         INPUT_PIDS_LIMIT: ${{ inputs.pids-limit }}
         INPUT_NETWORK: ${{ inputs.network }}
         INPUT_PACKAGES: ${{ inputs.packages }}
+        INPUT_ENV: ${{ inputs.env }}
+        INPUT_WORKDIR: ${{ inputs.workdir }}
         INPUT_CONFIG: ${{ inputs.config }}
         INPUT_PRESET: ${{ inputs.preset }}
         INPUT_EXCLUDE: ${{ inputs.exclude }}
@@ -128,6 +147,7 @@ runs:
         [ -z "$INPUT_PIDS_LIMIT" ] || ARGS+=(--pids-limit "$INPUT_PIDS_LIMIT")
         [ -z "$INPUT_NETWORK" ] || ARGS+=(--network "$INPUT_NETWORK")
         [ -z "$INPUT_PACKAGES" ] || ARGS+=(--packages "$INPUT_PACKAGES")
+        [ -z "$INPUT_WORKDIR" ] || ARGS+=(--workdir "$INPUT_WORKDIR")
         [ -z "$INPUT_MATRIX" ] || ARGS+=(--matrix "$INPUT_MATRIX")
         [ -z "$INPUT_JOBS" ] || ARGS+=(--jobs "$INPUT_JOBS")
         [ -z "$INPUT_CONFIG" ] || ARGS+=(--config "$INPUT_CONFIG")
@@ -135,6 +155,10 @@ runs:
         [ -z "$INPUT_MAX_SCRIPTS" ] || ARGS+=(--max-scripts "$INPUT_MAX_SCRIPTS")
         [ -z "$INPUT_OUTPUT" ] || ARGS+=(--output "$INPUT_OUTPUT")
         [ -z "$INPUT_CHANGED_SINCE" ] || ARGS+=(--changed-since "$INPUT_CHANGED_SINCE")
+        while IFS= read -r env_var; do
+          env_var="${env_var%$'\r'}"
+          [ -z "$env_var" ] || ARGS+=("--env" "$env_var")
+        done <<< "$INPUT_ENV"
         while IFS= read -r pattern; do
           pattern="${pattern%$'\r'}"
           [ -z "$pattern" ] || ARGS+=("--exclude" "$pattern")
@@ -146,4 +170,11 @@ runs:
           echo "dry-run must be true or false" >&2
           exit 1
         fi
-        python -m opsscript_gate.cli "${ARGS[@]}"
+        GATE_STATUS=0
+        python -m opsscript_gate.cli "${ARGS[@]}" || GATE_STATUS=$?
+        if [ "$GATE_STATUS" -eq 0 ]; then
+          echo "all-passed=true" >> "$GITHUB_OUTPUT"
+        else
+          echo "all-passed=false" >> "$GITHUB_OUTPUT"
+        fi
+        exit "$GATE_STATUS"

{opsscript_gate-0.9.4 → opsscript_gate-0.9.6}/docs/command-not-found.html

@@ -134,7 +134,7 @@ jobs:
       - uses: actions/checkout@v7
         with:
           persist-credentials: false
-      - uses: Mresyzz/opsscript-gate@v0.9.2
+      - uses: Mresyzz/opsscript-gate@v0.9.4
         with:
           script-path: install.sh
           shell: auto
@@ -186,6 +186,7 @@ opsscript-gate run ./install.sh</code></pre>
     <a href="https://github.com/Mresyzz/opsscript-gate/blob/main/docs/troubleshooting.md">troubleshooting</a>,
     or <a href="https://github.com/Mresyzz/opsscript-gate/blob/main/SECURITY.md">security boundaries</a>.
     <a href="./">Open the interactive demo</a>.</footer>
+<p>Installer returns zero but the program is missing? <a href="installer-smoke-test.html">Verify the installed binary in the same container.</a></p>
 </main>
 </body>
 </html>