pwnguard 0.2.4__tar.gz

pwnguard-0.2.4/.github/workflows/publish.yml

@@ -0,0 +1,44 @@
+name: Publish to PyPI
+
+on:
+  push:
+    tags:
+      - "v*"
+
+jobs:
+  build-and-publish:
+    name: Build and publish PwnGuard to PyPI
+    runs-on: ubuntu-latest
+    environment:
+      name: pypi
+      url: https://pypi.org/p/pwnguard
+    permissions:
+      id-token: write
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+
+      - name: Install build tooling
+        run: python -m pip install --upgrade build
+
+      - name: Verify tag matches package version
+        run: |
+          TAG="${GITHUB_REF_NAME#v}"
+          PKG_VERSION=$(grep -E '^__version__' pwnguard/__init__.py | cut -d'"' -f2)
+          if [ "$TAG" != "$PKG_VERSION" ]; then
+            echo "::error::Tag $TAG does not match pwnguard/__init__.py version $PKG_VERSION"
+            exit 1
+          fi
+          echo "Tag and package version both at $TAG"
+
+      - name: Build wheel + sdist
+        run: python -m build
+
+      - name: Publish to PyPI via Trusted Publishing
+        uses: pypa/gh-action-pypi-publish@release/v1

pwnguard-0.2.4/.gitignore

@@ -0,0 +1,44 @@
+# Secrets / local config
+.env
+.env.*
+.pwnguard.env
+!.env.example
+!.pwnguard.env.example
+pwnguard.local.yaml
+.pwnguard.local.yaml
+*.pem
+*.key
+credentials*
+.netrc
+
+# Python
+__pycache__/
+*.py[cod]
+*$py.class
+.venv/
+venv/
+env/
+.pytest_cache/
+.mypy_cache/
+.ruff_cache/
+*.egg-info/
+build/
+dist/
+
+# Editors / OS
+.DS_Store
+.idea/
+.vscode/
+*.swp
+*.swo
+
+# Tool output
+audit-report.*
+*.log
+
+# Monitor mode cache (per-cwd state file, never to be committed)
+.pwnguard-monitor.json
+
+# TUI export files (timestamped findings dumps from --review / --monitor)
+pwnguard-findings-*.md
+pwnguard-monitor-findings-*.md

pwnguard-0.2.4/.gitlab-ci.example.yml

@@ -0,0 +1,44 @@
+# .gitlab-ci.yml (add this stage to your existing pipeline)
+#
+# Option A: Ollama on self-hosted runner (no API key needed)
+# Option B: Claude API (requires ANTHROPIC_API_KEY CI/CD variable)
+#
+# For MR comments, set GITLAB_TOKEN (personal access token, api scope)
+# in Settings > CI/CD > Variables (masked, protected)
+
+stages:
+  # ... your existing stages ...
+  - security
+
+# --- Option A: Self-hosted runner with Ollama (recommended) ---
+pwnguard:
+  stage: security
+  tags:
+    - security-runner  # your self-hosted runner tag
+  rules:
+    - if: $CI_MERGE_REQUEST_IID
+  before_script:
+    - pip install pwnguard --quiet
+    # Ensure Ollama is running on the runner
+    - ollama list || echo "Warning: Ollama not available"
+  script:
+    - pwnguard --mode ci --mr-diff --backend ollama
+  allow_failure: false
+
+# --- Option B: Claude API (if org has API access) ---
+# pwnguard:
+#   stage: security
+#   image: python:3.12-slim
+#   rules:
+#     - if: $CI_MERGE_REQUEST_IID
+#   variables:
+#     PIP_CACHE_DIR: "$CI_PROJECT_DIR/.pip-cache"
+#   cache:
+#     key: pwnguard-pip
+#     paths:
+#       - .pip-cache/
+#   before_script:
+#     - pip install "pwnguard[claude-api]" --quiet
+#   script:
+#     - pwnguard --mode ci --mr-diff --backend claude-api
+#   allow_failure: false

pwnguard-0.2.4/.pwnguard.env.example

@@ -0,0 +1,46 @@
+# PwnGuard environment file (example)
+#
+# Copy this file to .pwnguard.env in the same directory and fill in the
+# values you need. PwnGuard auto-loads .pwnguard.env (and .env) from
+# the current working directory at startup. Process env vars exported
+# in your shell always take precedence over what's loaded from a file.
+#
+# IMPORTANT: never commit a populated .pwnguard.env to git - it's
+# already in .gitignore for this repo. Only this *.example file
+# should ever be in version control.
+
+# --- Backend tokens -------------------------------------------------------
+
+# Required for --backend claude-api. Get one from the Anthropic console:
+# https://console.anthropic.com/settings/keys
+ANTHROPIC_API_KEY=
+
+# Required for --backend openai-compat. Bearer token sent to any
+# OpenAI-compatible Chat Completions endpoint (LiteLLM, vLLM, OpenRouter,
+# Groq, Together, Fireworks, llama.cpp server, LM Studio, etc.). The
+# env var name can be overridden via openai.api_key_env in pwnguard.yaml.
+OPENAI_API_KEY=
+
+# --- Remote diff fetching --------------------------------------------------
+
+# Required for --from-url against GitLab MRs / commits.
+# Personal Access Token with the `read_api` scope is enough.
+# https://gitlab.com/-/user_settings/personal_access_tokens
+GITLAB_TOKEN=
+
+# Optional for --from-url against GitHub PRs / commits on public repos
+# (lifts the anonymous rate limit). Required for private repos.
+# https://github.com/settings/tokens
+GITHUB_TOKEN=
+
+# --- Behaviour toggles -----------------------------------------------------
+
+# Set to 1 to bypass PwnGuard for a single commit without skipping all
+# git hooks. Usually set inline at the commit ("PWNGUARD_SKIP=1 git commit")
+# rather than persisted here, but the option exists.
+# PWNGUARD_SKIP=
+
+# Set to 1 to suppress the "large prompt" confirmation that --backend
+# claude-api shows when a scan would exceed ~50k tokens. Useful for
+# automated/scripted runs.
+# PWNGUARD_NO_PROMPT=

pwnguard-0.2.4/LICENSE

@@ -0,0 +1,34 @@
+PwnGuard License
+
+Copyright (c) 2026 Power to Logic. All rights reserved.
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of
+this software and associated documentation files (the "Software"), to use the
+Software for personal, educational, and internal business purposes.
+
+The following conditions apply:
+
+1. Redistribution of the Software, in whole or in part, in original or modified
+   form, requires prior written consent from the copyright holder.
+
+2. Where redistribution is authorized, the following attribution must be
+   included in all copies or substantial portions of the Software and in any
+   accompanying documentation or distribution materials:
+
+       "PwnGuard by Power to Logic (https://powertologic.com)"
+
+3. The Software may not be sold, sublicensed, or offered as a paid product or
+   service without prior written consent from the copyright holder.
+
+4. Contributions submitted to the official repository (via pull requests,
+   patches, or other means) are granted to the copyright holder under the same
+   terms as this license, unless otherwise agreed in writing.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
+FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
+COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER
+IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+For redistribution inquiries, contact: privacy@powertologic.com