skilltotal 0.78.0__tar.gz → 0.78.1__tar.gz

{skilltotal-0.78.0/skilltotal.egg-info → skilltotal-0.78.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: skilltotal
-Version: 0.78.0
+Version: 0.78.1
 Summary: Static security scanner for npm and PyPI packages, MCP servers and agent skills. Runs locally, never runs the code, no LLM.
 Author: SkillTotal
 License-Expression: Apache-2.0
@@ -102,7 +102,7 @@ skilltotal scan npm:express     # or pypi:name, a git URL, a folder, an archive
 ([full example with permissions](https://github.com/pezhik/skilltotal/blob/main/docs/ci.md)):
 
 ```yaml
-      - uses: pezhik/skilltotal@v0.78.0
+      - uses: pezhik/skilltotal@v0.78.1
         with: { source: ., fail-on: high }
 ```
 
@@ -241,7 +241,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - uses: pezhik/skilltotal@v0.78.0
+      - uses: pezhik/skilltotal@v0.78.1
         with:
           source: .             # a path, a git URL, or an npm:/pypi:<name> spec
           fail-on: high         # fail on a high/critical risk finding (or 'none')
@@ -259,7 +259,7 @@ out on an existing repository. Anywhere else Python 3.10+ runs, install a pinned
 on the exit code (0 passed, 2 a gate tripped, 1 the scan could not run):
 
 ```bash
-pip install skilltotal==0.78.0      # in a virtual environment outside the checkout
+pip install skilltotal==0.78.1      # in a virtual environment outside the checkout
 skilltotal scan . --fail-on high
 ```
 
@@ -317,7 +317,7 @@ With npx (it needs uv, pipx, or Python 3.11+ with `skilltotal` installed), name
 `--package` so npx does not run a `skilltotal` from the scanned repository's `node_modules/.bin`:
 
 ```bash
-npx -y --package=skilltotal@0.78.0 -- skilltotal scan https://github.com/owner/repo
+npx -y --package=skilltotal@0.78.1 -- skilltotal scan https://github.com/owner/repo
 ```
 
 ## Measured, not asserted

{skilltotal-0.78.0 → skilltotal-0.78.1}/README.md

@@ -61,7 +61,7 @@ skilltotal scan npm:express     # or pypi:name, a git URL, a folder, an archive
 ([full example with permissions](https://github.com/pezhik/skilltotal/blob/main/docs/ci.md)):
 
 ```yaml
-      - uses: pezhik/skilltotal@v0.78.0
+      - uses: pezhik/skilltotal@v0.78.1
         with: { source: ., fail-on: high }
 ```
 
@@ -200,7 +200,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - uses: pezhik/skilltotal@v0.78.0
+      - uses: pezhik/skilltotal@v0.78.1
         with:
           source: .             # a path, a git URL, or an npm:/pypi:<name> spec
           fail-on: high         # fail on a high/critical risk finding (or 'none')
@@ -218,7 +218,7 @@ out on an existing repository. Anywhere else Python 3.10+ runs, install a pinned
 on the exit code (0 passed, 2 a gate tripped, 1 the scan could not run):
 
 ```bash
-pip install skilltotal==0.78.0      # in a virtual environment outside the checkout
+pip install skilltotal==0.78.1      # in a virtual environment outside the checkout
 skilltotal scan . --fail-on high
 ```
 
@@ -276,7 +276,7 @@ With npx (it needs uv, pipx, or Python 3.11+ with `skilltotal` installed), name
 `--package` so npx does not run a `skilltotal` from the scanned repository's `node_modules/.bin`:
 
 ```bash
-npx -y --package=skilltotal@0.78.0 -- skilltotal scan https://github.com/owner/repo
+npx -y --package=skilltotal@0.78.1 -- skilltotal scan https://github.com/owner/repo
 ```
 
 ## Measured, not asserted

{skilltotal-0.78.0 → skilltotal-0.78.1}/skilltotal/__init__.py

@@ -22,7 +22,7 @@ from skilltotal.models import (
 # REPORT_SCHEMA_VERSION: shape of Report.to_dict(); bumps only on schema changes.
 # RULESET_VERSION: integer counter of the detection ruleset; bumps when rules change, so a
 #   consumer knows when re-scanning old reports may surface new findings.
-__version__ = "0.78.0"
+__version__ = "0.78.1"
 ENGINE_VERSION = __version__
 REPORT_SCHEMA_VERSION = "1.9"
 RULESET_VERSION = 79

{skilltotal-0.78.0 → skilltotal-0.78.1}/skilltotal/collector.py

@@ -841,10 +841,20 @@ def _collect_remote(
             raise CollectionError(f"path '{subpath}' not found in repository {clone_url}")
         root = candidate
 
-    component = detect_component(root, source=url)
+    # A whole repository is checked out into a temp folder named "repo": with no manifest to
+    # name it, the repository's own name stands in for that folder name.
+    default_name = None if subpath else _repo_name(clone_url)
+    component = detect_component(root, source=url, default_name=default_name)
     return SourceContext(root=root, component=component, _tempdir=tmp, note=note)
 
 
+def _repo_name(clone_url: str) -> str | None:
+    """The repository name a clone URL ends in (``owner/name.git`` -> ``name``), if any."""
+    tail = re.split(r"[/:]", clone_url.strip().rstrip("/"))[-1]
+    tail = tail[:-4] if tail.lower().endswith(".git") else tail
+    return tail or None
+
+
 # --------------------------------------------------------------- package registries
 
 # A company registry mirror (Artifactory, Nexus, Verdaccio, devpi) to fetch `npm:` / `pypi:`

{skilltotal-0.78.0 → skilltotal-0.78.1/skilltotal.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: skilltotal
-Version: 0.78.0
+Version: 0.78.1
 Summary: Static security scanner for npm and PyPI packages, MCP servers and agent skills. Runs locally, never runs the code, no LLM.
 Author: SkillTotal
 License-Expression: Apache-2.0
@@ -102,7 +102,7 @@ skilltotal scan npm:express     # or pypi:name, a git URL, a folder, an archive
 ([full example with permissions](https://github.com/pezhik/skilltotal/blob/main/docs/ci.md)):
 
 ```yaml
-      - uses: pezhik/skilltotal@v0.78.0
+      - uses: pezhik/skilltotal@v0.78.1
         with: { source: ., fail-on: high }
 ```
 
@@ -241,7 +241,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - uses: pezhik/skilltotal@v0.78.0
+      - uses: pezhik/skilltotal@v0.78.1
         with:
           source: .             # a path, a git URL, or an npm:/pypi:<name> spec
           fail-on: high         # fail on a high/critical risk finding (or 'none')
@@ -259,7 +259,7 @@ out on an existing repository. Anywhere else Python 3.10+ runs, install a pinned
 on the exit code (0 passed, 2 a gate tripped, 1 the scan could not run):
 
 ```bash
-pip install skilltotal==0.78.0      # in a virtual environment outside the checkout
+pip install skilltotal==0.78.1      # in a virtual environment outside the checkout
 skilltotal scan . --fail-on high
 ```
 
@@ -317,7 +317,7 @@ With npx (it needs uv, pipx, or Python 3.11+ with `skilltotal` installed), name
 `--package` so npx does not run a `skilltotal` from the scanned repository's `node_modules/.bin`:
 
 ```bash
-npx -y --package=skilltotal@0.78.0 -- skilltotal scan https://github.com/owner/repo
+npx -y --package=skilltotal@0.78.1 -- skilltotal scan https://github.com/owner/repo
 ```
 
 ## Measured, not asserted