repoglance 0.2.2__tar.gz → 0.4.0__tar.gz

repoglance-0.4.0/.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,41 @@
+name: Bug report
+description: Something in repoglance is broken or wrong
+labels: ["bug"]
+body:
+  - type: markdown
+    attributes:
+      value: Thanks for taking the time to file a bug! Please fill in the details below.
+  - type: input
+    id: version
+    attributes:
+      label: repoglance version
+      description: Output of `repoglance --version`
+      placeholder: "repoglance, version 0.2.2"
+    validations:
+      required: true
+  - type: input
+    id: python
+    attributes:
+      label: Python version & OS
+      placeholder: "Python 3.11 on macOS 14"
+    validations:
+      required: true
+  - type: textarea
+    id: what-happened
+    attributes:
+      label: What happened?
+      description: What did you run, what did you expect, and what did you get?
+      placeholder: |
+        Command: repoglance .
+        Expected: ...
+        Actual: ...
+    validations:
+      required: true
+  - type: textarea
+    id: traceback
+    attributes:
+      label: Traceback / output
+      description: Paste any error output. This will be rendered as code.
+      render: shell
+    validations:
+      required: false

repoglance-0.4.0/.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,5 @@
+blank_issues_enabled: false
+contact_links:
+  - name: Question or discussion
+    url: https://github.com/SRJ-ai/repoglance/discussions
+    about: Ask a question or share an idea before opening an issue.

repoglance-0.4.0/.github/ISSUE_TEMPLATE/feature_request.yml

@@ -0,0 +1,24 @@
+name: Feature request
+description: Suggest an idea for repoglance
+labels: ["enhancement"]
+body:
+  - type: textarea
+    id: problem
+    attributes:
+      label: What problem would this solve?
+      description: Describe the use case, not just the feature.
+    validations:
+      required: true
+  - type: textarea
+    id: proposal
+    attributes:
+      label: Proposed solution
+      description: What would you like repoglance to do?
+    validations:
+      required: false
+  - type: textarea
+    id: alternatives
+    attributes:
+      label: Alternatives considered
+    validations:
+      required: false

repoglance-0.4.0/.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,16 @@
+<!-- Thanks for contributing to repoglance! -->
+
+## What does this change?
+
+<!-- A short description of the change and why. -->
+
+## Checklist
+
+- [ ] Tests added or updated (`python -m pytest -q` passes)
+- [ ] Docs / README updated if behavior changed
+- [ ] Runtime deps still limited to `rich` + `click`
+- [ ] For a new language: added to `EXT_LANG` (and comment prefixes if relevant)
+
+## Related issues
+
+<!-- e.g. Closes #123 -->

repoglance-0.4.0/.repoglance-badge.json

@@ -0,0 +1 @@
+{"schemaVersion": 1, "label": "repoglance", "message": "2.7k loc \u2022 Python", "color": "blue"}

repoglance-0.4.0/CHANGELOG.md

@@ -0,0 +1,84 @@
+# Changelog
+
+All notable changes to this project are documented here. The format is based on
+[Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and this project
+adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [0.4.0] - 2026-08-01
+
+### Added
+- **Duplicate-code detection** (`--duplicates`): sliding line-window hashing
+  surfaces copy-paste blocks and a duplication percentage.
+- **Vendored/generated detection**: minified bundles, `_pb2.py`, lock files,
+  `node_modules`, and files marked `@generated` are excluded by default;
+  `--include-vendored` keeps them.
+- **Ownership** (`--owners`): attributes the top complexity hotspots to authors
+  via `git blame`.
+- **Incremental cache** (`--cache <file>`): unchanged files are reused across
+  runs by mtime + size, speeding up repeated scans.
+- **Plugin API**: third-party packages can register metrics under the
+  `repoglance.metrics` entry-point group; results appear under `plugins`.
+- **Watch mode** (`--watch`): re-render the report whenever files change.
+- Homebrew formula template and a minimal VS Code extension (Problems panel).
+
+### Fixed
+- Git subprocesses now decode as UTF-8, fixing crashes on non-Latin-1 blame
+  output on Windows.
+
+## [0.3.0] - 2026-08-01
+
+### Added
+- **Real cyclomatic complexity across 15+ languages** via `lizard` (C/C++, Java,
+  C#, JavaScript, TypeScript, Go, Rust, Ruby, PHP, Swift, Kotlin, Python and
+  more). Python keeps an AST fallback; a keyword heuristic remains as last
+  resort. Complexity for non-Python languages is now trustworthy, not a guess.
+- **Maintainability index** (0–100), approximate Microsoft MI from complexity,
+  size and token counts.
+- **Diff mode** `--since <rev>`: analyze only files changed since a git ref —
+  ideal for PRs. The Action exposes it via `diff-base`.
+- **Baselines & regression ratchet**: `--baseline` snapshots a report;
+  `--compare` shows health/complexity/TODO/LOC deltas; `--fail-on-regression`
+  fails only on new or worse complexity.
+- **SARIF output** (`--sarif`) for GitHub code scanning; the Action can upload
+  it (`sarif: true`) so hotspots appear inline on the Files changed tab.
+- **CSV output** (`--csv`) and a **per-directory rollup** (report + JSON).
+- **Config file**: `.repoglance.toml` or `[tool.repoglance]` in pyproject.
+- **Glob include/exclude** (`--include` / `--exclude`) beyond directory names.
+- **Parallel scanning** (`--jobs`) via a thread pool.
+- Docker image, GitLab CI template, and mkdocs docs scaffold.
+
+## [0.2.2] - 2026-08-01
+
+### Added
+- Respect the repository's `.gitignore`: when scanning a git repo, the file
+  list comes from `git ls-files` so ignored files are excluded (matches the
+  behavior of `tokei`/`scc`). Non-git directories still use a pruned walk.
+- Count C-style `/* ... */` block comments when classifying lines, improving the
+  comment ratio (and therefore the health score) for C-family languages.
+- Expanded test suite: CLI end-to-end (`click` runner), `.gitignore` handling,
+  block comments, and inline complexity scoring.
+
+### Changed
+- Every file is now read exactly once. Complexity is computed during the scan
+  from the text already in memory instead of re-reading every file in a second
+  pass — roughly halving I/O on large repositories.
+
+## [0.2.1] - 2026-08-01
+
+### Changed
+- Marketplace listing name set to a globally-unique title.
+
+## [0.2.0] - 2026-08-01
+
+### Changed
+- Renamed the PyPI package and CLI to **repoglance** (the GitHub repository is
+  unchanged). Only line-comment TODO markers are counted, avoiding false
+  positives from prose and marker lists.
+
+## [0.1.0] - 2026-08-01
+
+### Added
+- Initial release: rich terminal report (languages, complexity hotspots, TODO
+  tracker, biggest files, git activity), health score, JSON/Markdown/SVG/HTML
+  output, self-contained and dynamic badges, CI gate, GitHub Action, and
+  pre-commit hook.

repoglance-0.4.0/CODE_OF_CONDUCT.md

@@ -0,0 +1,35 @@
+# Code of Conduct
+
+## Our pledge
+
+We as members, contributors, and maintainers pledge to make participation in
+the repoglance community a harassment-free experience for everyone, regardless
+of age, body size, visible or invisible disability, ethnicity, sex
+characteristics, gender identity and expression, level of experience,
+education, socio-economic status, nationality, personal appearance, race,
+religion, or sexual identity and orientation.
+
+## Our standards
+
+Examples of behavior that contributes to a positive environment:
+
+- Being respectful of differing opinions, viewpoints, and experiences
+- Giving and gracefully accepting constructive feedback
+- Focusing on what is best for the community
+- Showing empathy toward other community members
+
+Unacceptable behavior includes harassment, insulting or derogatory comments,
+personal or political attacks, publishing others' private information, and
+other conduct which could reasonably be considered inappropriate.
+
+## Enforcement
+
+Instances of abusive, harassing, or otherwise unacceptable behavior may be
+reported to the project maintainers. All complaints will be reviewed and
+investigated promptly and fairly. Maintainers are obligated to respect the
+privacy and security of the reporter of any incident.
+
+## Attribution
+
+This Code of Conduct is adapted from the
+[Contributor Covenant](https://www.contributor-covenant.org), version 2.1.

repoglance-0.4.0/Dockerfile

@@ -0,0 +1,10 @@
+# Minimal image to run repoglance against a mounted repository.
+#   docker build -t repoglance .
+#   docker run --rm -v "$PWD:/repo" repoglance /repo
+FROM python:3.12-slim
+
+RUN pip install --no-cache-dir repoglance
+
+WORKDIR /repo
+ENTRYPOINT ["repoglance"]
+CMD ["."]

{repoglance-0.2.2 → repoglance-0.4.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: repoglance
-Version: 0.2.2
+Version: 0.4.0
 Summary: Instant, gorgeous insight into any code repository — languages, complexity hotspots, TODOs and git activity in one terminal command.
 Project-URL: Homepage, https://github.com/SRJ-ai/repoglance
 Project-URL: Repository, https://github.com/SRJ-ai/repoglance
@@ -21,7 +21,9 @@ Classifier: Programming Language :: Python :: 3.12
 Classifier: Topic :: Software Development :: Quality Assurance
 Requires-Python: >=3.9
 Requires-Dist: click>=8.0
+Requires-Dist: lizard>=1.17
 Requires-Dist: rich>=13.0
+Requires-Dist: tomli>=2.0; python_version < '3.11'
 Provides-Extra: dev
 Requires-Dist: pytest-cov; extra == 'dev'
 Requires-Dist: pytest>=7.0; extra == 'dev'
@@ -37,10 +39,11 @@ Point it at any folder. In under a second you get a beautiful terminal report:
 language breakdown, complexity hotspots, TODO tracker, biggest files, and git
 activity. **Zero config. Zero API keys. Zero telemetry.**
 
+[![PyPI](https://img.shields.io/pypi/v/repoglance.svg)](https://pypi.org/project/repoglance/)
+[![Downloads](https://img.shields.io/pypi/dm/repoglance.svg)](https://pypi.org/project/repoglance/)
 [![CI](https://github.com/SRJ-ai/repoglance/actions/workflows/ci.yml/badge.svg)](https://github.com/SRJ-ai/repoglance/actions/workflows/ci.yml)
-[![Python](https://img.shields.io/badge/python-3.9%2B-blue.svg)](https://www.python.org/)
+[![Python](https://img.shields.io/pypi/pyversions/repoglance.svg)](https://pypi.org/project/repoglance/)
 [![License: MIT](https://img.shields.io/badge/license-MIT-green.svg)](LICENSE)
-[![PRs Welcome](https://img.shields.io/badge/PRs-welcome-brightgreen.svg)](CONTRIBUTING.md)
 [![repoglance](https://img.shields.io/endpoint?url=https://raw.githubusercontent.com/SRJ-ai/repoglance/main/.repoglance-badge.json)](https://github.com/SRJ-ai/repoglance)
 
 </div>
@@ -69,9 +72,9 @@ repoglance run against well-known projects (click to view the full report):
 
 | Project | Files | Lines of code | Health |
 |---|--:|--:|:--:|
-| [flask](assets/showcase/flask.svg) | 209 | 25,293 | D (64) |
-| [httpie](assets/showcase/httpie.svg) | 236 | 20,114 | D (62) |
-| [requests](assets/showcase/requests.svg) | 89 | 13,785 | C (70) |
+| [flask](assets/showcase/flask.svg) | 207 | 25,266 | D (67) |
+| [httpie](assets/showcase/httpie.svg) | 234 | 20,023 | D (66) |
+| [requests](assets/showcase/requests.svg) | 88 | 13,709 | C (70) |
 
 <div align="center">
 
@@ -97,12 +100,21 @@ pipx run repoglance .
 repoglance                       # analyze current directory
 repoglance path/to/repo          # analyze another repo
 repoglance --json                # machine-readable output for scripts / CI
+repoglance --csv                 # per-file CSV
+repoglance --sarif               # SARIF for GitHub code scanning
 repoglance --svg report.svg      # export a vector report
 repoglance --html report.html    # export a browser report
 repoglance --badge badge.svg     # export an embeddable badge
-repoglance --ci --max-complexity 25   # fail CI on hotspots
-repoglance --no-git              # skip git history
-repoglance --ignore dist --ignore fixtures
+repoglance --since origin/main   # only files changed since a revision
+repoglance --baseline base.json                         # snapshot now
+repoglance --compare base.json --fail-on-regression     # fail on new complexity
+repoglance --ci --fail-under 70 --max-complexity 25     # gate a build
+repoglance --include "src/**" --exclude "**/*_pb2.py"   # glob filters
+repoglance --duplicates          # detect copy-paste blocks
+repoglance --owners              # attribute hotspots to authors (git blame)
+repoglance --cache .rg.cache     # incremental cache for fast repeat runs
+repoglance --watch               # live re-render on file changes
+repoglance --no-git --jobs 8
 ```
 
 ### JSON output
@@ -118,11 +130,18 @@ repoglance --json | jq '.languages.Python.code'
 | Section | What you get |
 |---|---|
 | **Languages** | Lines of code per language, ranked, with % bars |
-| **Complexity hotspots** | Per-function cyclomatic complexity (Python via AST; heuristic for other langs) |
+| **Complexity hotspots** | Real per-function cyclomatic complexity across 15+ languages (C/C++, Java, C#, JS, TS, Go, Rust, Ruby, PHP, Swift, Kotlin, Python…) via [lizard](https://github.com/terryyin/lizard) |
+| **Maintainability index** | Approximate MI (0–100) from complexity, size and token counts |
+| **Duplicate code** | Copy-paste blocks across files, with a duplication % |
 | **TODO tracker** | Every `TODO` / `FIXME` / `HACK` / `XXX` / `BUG` with file:line |
-| **Biggest files** | The files most likely to need splitting |
+| **Biggest files & directories** | Where the mass and the worst complexity live |
+| **Ownership** | Which author owns each hotspot (`--owners`, git blame) |
 | **Git activity** | Top authors, most-churned files, active days, project lifespan |
 
+Vendored and generated files (minified bundles, `_pb2.py`, `node_modules`, files
+marked `@generated`) are detected and excluded by default — pass
+`--include-vendored` to keep them.
+
 Binary files, `node_modules`, `.venv`, build dirs and friends are skipped
 automatically.
 
@@ -135,14 +154,17 @@ gives you artifacts you can put in a PR or a README.
 | | repoglance | tokei | scc | cloc |
 |---|:---:|:---:|:---:|:---:|
 | Lines-of-code by language | ✅ | ✅ | ✅ | ✅ |
-| Complexity hotspots (per function) | ✅ | ❌ | ⚠️ file-level | ❌ |
+| Per-function complexity (15+ langs) | ✅ | ❌ | ⚠️ file-level | ❌ |
+| Maintainability index | ✅ | ❌ | ❌ | ❌ |
 | TODO / FIXME tracker | ✅ | ❌ | ❌ | ❌ |
 | Git activity (authors, churn) | ✅ | ❌ | ❌ | ❌ |
-| JSON output | ✅ | ✅ | ✅ | ✅ |
+| Respects `.gitignore` | ✅ | ✅ | ✅ | ❌ |
+| JSON / CSV / **SARIF** output | ✅ | ⚠️ | ⚠️ | ⚠️ |
 | **HTML / SVG report export** | ✅ | ❌ | ❌ | ❌ |
 | **Embeddable repo badge** | ✅ | ❌ | ❌ | ❌ |
-| **CI gate (`--max-complexity`)** | ✅ | ❌ | ❌ | ❌ |
-| Zero install deps beyond one `pip` | ✅ | (binary) | (binary) | (perl) |
+| **Diff mode (`--since`) + baselines** | ✅ | ❌ | ❌ | ❌ |
+| **CI gate + regression ratchet** | ✅ | ❌ | ❌ | ❌ |
+| **Config file** (`[tool.repoglance]`) | ✅ | ✅ | ❌ | ❌ |
 
 ## Share it: badges & reports
 
@@ -235,6 +257,27 @@ repoglance --badge-json .repoglance-badge.json   # commit this file
 repoglance --md   # paste into a PR, wiki, or Slack
 ```
 
+### Configuration file
+
+Set defaults once via `.repoglance.toml` or a `[tool.repoglance]` table in
+`pyproject.toml` (CLI flags always win):
+
+```toml
+[tool.repoglance]
+exclude = ["**/*_pb2.py", "vendor/**"]
+max_complexity = 25
+fail_under = 70
+```
+
+### Docker & GitLab
+
+```bash
+docker run --rm -v "$PWD:/repo" repoglance /repo
+```
+
+A ready-to-copy GitLab CI job lives in
+[`integrations/gitlab-ci.yml`](integrations/gitlab-ci.yml).
+
 ## Design goals
 
 - **Fast** — a single pass, no external services.

{repoglance-0.2.2 → repoglance-0.4.0}/README.md

@@ -8,10 +8,11 @@ Point it at any folder. In under a second you get a beautiful terminal report:
 language breakdown, complexity hotspots, TODO tracker, biggest files, and git
 activity. **Zero config. Zero API keys. Zero telemetry.**
 
+[![PyPI](https://img.shields.io/pypi/v/repoglance.svg)](https://pypi.org/project/repoglance/)
+[![Downloads](https://img.shields.io/pypi/dm/repoglance.svg)](https://pypi.org/project/repoglance/)
 [![CI](https://github.com/SRJ-ai/repoglance/actions/workflows/ci.yml/badge.svg)](https://github.com/SRJ-ai/repoglance/actions/workflows/ci.yml)
-[![Python](https://img.shields.io/badge/python-3.9%2B-blue.svg)](https://www.python.org/)
+[![Python](https://img.shields.io/pypi/pyversions/repoglance.svg)](https://pypi.org/project/repoglance/)
 [![License: MIT](https://img.shields.io/badge/license-MIT-green.svg)](LICENSE)
-[![PRs Welcome](https://img.shields.io/badge/PRs-welcome-brightgreen.svg)](CONTRIBUTING.md)
 [![repoglance](https://img.shields.io/endpoint?url=https://raw.githubusercontent.com/SRJ-ai/repoglance/main/.repoglance-badge.json)](https://github.com/SRJ-ai/repoglance)
 
 </div>
@@ -40,9 +41,9 @@ repoglance run against well-known projects (click to view the full report):
 
 | Project | Files | Lines of code | Health |
 |---|--:|--:|:--:|
-| [flask](assets/showcase/flask.svg) | 209 | 25,293 | D (64) |
-| [httpie](assets/showcase/httpie.svg) | 236 | 20,114 | D (62) |
-| [requests](assets/showcase/requests.svg) | 89 | 13,785 | C (70) |
+| [flask](assets/showcase/flask.svg) | 207 | 25,266 | D (67) |
+| [httpie](assets/showcase/httpie.svg) | 234 | 20,023 | D (66) |
+| [requests](assets/showcase/requests.svg) | 88 | 13,709 | C (70) |
 
 <div align="center">
 
@@ -68,12 +69,21 @@ pipx run repoglance .
 repoglance                       # analyze current directory
 repoglance path/to/repo          # analyze another repo
 repoglance --json                # machine-readable output for scripts / CI
+repoglance --csv                 # per-file CSV
+repoglance --sarif               # SARIF for GitHub code scanning
 repoglance --svg report.svg      # export a vector report
 repoglance --html report.html    # export a browser report
 repoglance --badge badge.svg     # export an embeddable badge
-repoglance --ci --max-complexity 25   # fail CI on hotspots
-repoglance --no-git              # skip git history
-repoglance --ignore dist --ignore fixtures
+repoglance --since origin/main   # only files changed since a revision
+repoglance --baseline base.json                         # snapshot now
+repoglance --compare base.json --fail-on-regression     # fail on new complexity
+repoglance --ci --fail-under 70 --max-complexity 25     # gate a build
+repoglance --include "src/**" --exclude "**/*_pb2.py"   # glob filters
+repoglance --duplicates          # detect copy-paste blocks
+repoglance --owners              # attribute hotspots to authors (git blame)
+repoglance --cache .rg.cache     # incremental cache for fast repeat runs
+repoglance --watch               # live re-render on file changes
+repoglance --no-git --jobs 8
 ```
 
 ### JSON output
@@ -89,11 +99,18 @@ repoglance --json | jq '.languages.Python.code'
 | Section | What you get |
 |---|---|
 | **Languages** | Lines of code per language, ranked, with % bars |
-| **Complexity hotspots** | Per-function cyclomatic complexity (Python via AST; heuristic for other langs) |
+| **Complexity hotspots** | Real per-function cyclomatic complexity across 15+ languages (C/C++, Java, C#, JS, TS, Go, Rust, Ruby, PHP, Swift, Kotlin, Python…) via [lizard](https://github.com/terryyin/lizard) |
+| **Maintainability index** | Approximate MI (0–100) from complexity, size and token counts |
+| **Duplicate code** | Copy-paste blocks across files, with a duplication % |
 | **TODO tracker** | Every `TODO` / `FIXME` / `HACK` / `XXX` / `BUG` with file:line |
-| **Biggest files** | The files most likely to need splitting |
+| **Biggest files & directories** | Where the mass and the worst complexity live |
+| **Ownership** | Which author owns each hotspot (`--owners`, git blame) |
 | **Git activity** | Top authors, most-churned files, active days, project lifespan |
 
+Vendored and generated files (minified bundles, `_pb2.py`, `node_modules`, files
+marked `@generated`) are detected and excluded by default — pass
+`--include-vendored` to keep them.
+
 Binary files, `node_modules`, `.venv`, build dirs and friends are skipped
 automatically.
 
@@ -106,14 +123,17 @@ gives you artifacts you can put in a PR or a README.
 | | repoglance | tokei | scc | cloc |
 |---|:---:|:---:|:---:|:---:|
 | Lines-of-code by language | ✅ | ✅ | ✅ | ✅ |
-| Complexity hotspots (per function) | ✅ | ❌ | ⚠️ file-level | ❌ |
+| Per-function complexity (15+ langs) | ✅ | ❌ | ⚠️ file-level | ❌ |
+| Maintainability index | ✅ | ❌ | ❌ | ❌ |
 | TODO / FIXME tracker | ✅ | ❌ | ❌ | ❌ |
 | Git activity (authors, churn) | ✅ | ❌ | ❌ | ❌ |
-| JSON output | ✅ | ✅ | ✅ | ✅ |
+| Respects `.gitignore` | ✅ | ✅ | ✅ | ❌ |
+| JSON / CSV / **SARIF** output | ✅ | ⚠️ | ⚠️ | ⚠️ |
 | **HTML / SVG report export** | ✅ | ❌ | ❌ | ❌ |
 | **Embeddable repo badge** | ✅ | ❌ | ❌ | ❌ |
-| **CI gate (`--max-complexity`)** | ✅ | ❌ | ❌ | ❌ |
-| Zero install deps beyond one `pip` | ✅ | (binary) | (binary) | (perl) |
+| **Diff mode (`--since`) + baselines** | ✅ | ❌ | ❌ | ❌ |
+| **CI gate + regression ratchet** | ✅ | ❌ | ❌ | ❌ |
+| **Config file** (`[tool.repoglance]`) | ✅ | ✅ | ❌ | ❌ |
 
 ## Share it: badges & reports
 
@@ -206,6 +226,27 @@ repoglance --badge-json .repoglance-badge.json   # commit this file
 repoglance --md   # paste into a PR, wiki, or Slack
 ```
 
+### Configuration file
+
+Set defaults once via `.repoglance.toml` or a `[tool.repoglance]` table in
+`pyproject.toml` (CLI flags always win):
+
+```toml
+[tool.repoglance]
+exclude = ["**/*_pb2.py", "vendor/**"]
+max_complexity = 25
+fail_under = 70
+```
+
+### Docker & GitLab
+
+```bash
+docker run --rm -v "$PWD:/repo" repoglance /repo
+```
+
+A ready-to-copy GitLab CI job lives in
+[`integrations/gitlab-ci.yml`](integrations/gitlab-ci.yml).
+
 ## Design goals
 
 - **Fast** — a single pass, no external services.

repoglance-0.4.0/SECURITY.md

@@ -0,0 +1,27 @@
+# Security Policy
+
+## Reporting a vulnerability
+
+If you find a security issue in repoglance, please report it privately:
+
+- Open a [GitHub security advisory](https://github.com/SRJ-ai/repoglance/security/advisories/new), **or**
+- Email the maintainers with the details.
+
+Please do **not** open a public issue for security problems.
+
+We aim to acknowledge reports within 3 business days and to ship a fix or
+mitigation as quickly as the severity warrants.
+
+## Scope notes
+
+repoglance is a local, read-only analysis tool: it does not make network
+requests, send telemetry, or write outside the paths you explicitly pass for
+report/badge output. It does shell out to `git` for repository metadata. The
+most relevant considerations are therefore:
+
+- Handling of untrusted repository contents (file parsing, path handling).
+- The `git` subprocess invocations in `gitinfo.py` and `scanner.py`.
+
+## Supported versions
+
+The latest released version on PyPI receives security fixes.

{repoglance-0.2.2 → repoglance-0.4.0}/action.yml

@@ -21,6 +21,14 @@ inputs:
     description: "Fail the job if any function exceeds this cyclomatic complexity. Empty to disable."
     required: false
     default: ""
+  sarif:
+    description: "Generate SARIF and upload it to GitHub code scanning (requires security-events: write)."
+    required: false
+    default: "false"
+  diff-base:
+    description: "Only analyze files changed since this git ref (e.g. origin/main). Empty = whole repo."
+    required: false
+    default: ""
   github-token:
     description: "Token used to post the PR comment."
     required: false
@@ -41,9 +49,22 @@ runs:
     - name: Job summary + Markdown report
       shell: bash
       run: |
-        repoglance "${{ inputs.path }}" --md > "$RUNNER_TEMP/repoglance.md"
+        since=""
+        [ -n "${{ inputs.diff-base }}" ] && since="--since ${{ inputs.diff-base }}"
+        repoglance "${{ inputs.path }}" $since --md > "$RUNNER_TEMP/repoglance.md"
         cat "$RUNNER_TEMP/repoglance.md" >> "$GITHUB_STEP_SUMMARY"
 
+    - name: Generate SARIF
+      if: ${{ inputs.sarif == 'true' }}
+      shell: bash
+      run: repoglance "${{ inputs.path }}" --sarif > "$RUNNER_TEMP/repoglance.sarif"
+
+    - name: Upload SARIF
+      if: ${{ inputs.sarif == 'true' }}
+      uses: github/codeql-action/upload-sarif@v3
+      with:
+        sarif_file: ${{ runner.temp }}/repoglance.sarif
+
     - name: Comment on PR
       if: ${{ inputs.comment == 'true' && github.event_name == 'pull_request' }}
       shell: bash

{repoglance-0.2.2 → repoglance-0.4.0}/assets/badge.svg

@@ -1,19 +1,19 @@
-<svg xmlns="http://www.w3.org/2000/svg" width="200" height="20" role="img" aria-label="repoglance: 1.6k loc • Python">
-  <title>repoglance: 1.6k loc • Python</title>
+<svg xmlns="http://www.w3.org/2000/svg" width="202" height="20" role="img" aria-label="repoglance: 2.3k loc • Python">
+  <title>repoglance: 2.3k loc • Python</title>
   <linearGradient id="s" x2="0" y2="100%">
     <stop offset="0" stop-color="#bbb" stop-opacity=".1"/>
     <stop offset="1" stop-opacity=".1"/>
   </linearGradient>
-  <clipPath id="r"><rect width="200" height="20" rx="3" fill="#fff"/></clipPath>
+  <clipPath id="r"><rect width="202" height="20" rx="3" fill="#fff"/></clipPath>
   <g clip-path="url(#r)">
     <rect width="84" height="20" fill="#555"/>
-    <rect x="84" width="117" height="20" fill="#3572A5"/>
-    <rect width="200" height="20" fill="url(#s)"/>
+    <rect x="84" width="118" height="20" fill="#3572A5"/>
+    <rect width="202" height="20" fill="url(#s)"/>
   </g>
   <g fill="#fff" text-anchor="middle" font-family="Verdana,Geneva,DejaVu Sans,sans-serif" font-size="110" text-rendering="geometricPrecision">
     <text aria-hidden="true" x="418" y="150" fill="#010101" fill-opacity=".3" transform="scale(.1)" textLength="635">repoglance</text>
     <text x="418" y="140" transform="scale(.1)" textLength="635">repoglance</text>
-    <text aria-hidden="true" x="1420" y="150" fill="#010101" fill-opacity=".3" transform="scale(.1)" textLength="970">1.6k loc • Python</text>
-    <text x="1420" y="140" transform="scale(.1)" textLength="970">1.6k loc • Python</text>
+    <text aria-hidden="true" x="1425" y="150" fill="#010101" fill-opacity=".3" transform="scale(.1)" textLength="980">2.3k loc • Python</text>
+    <text x="1425" y="140" transform="scale(.1)" textLength="980">2.3k loc • Python</text>
   </g>
 </svg>