From 4356c823d64bcb210dbfd344fa8e401a2bc08453 Mon Sep 17 00:00:00 2001
From: bgard68 <30295154+bgard68@users.noreply.github.com>
Date: Mon, 24 Aug 2026 11:34:14 -0500
Subject: [PATCH] feat: scan any public repository by name, anonymously
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Type owner/repository, get per-file deterministic findings. The demo asked a
visitor to paste YAML; this asks for a name and nothing else — the same fetch
path the 564-workflow field scan already proved, now a product surface.

The quota is the design constraint. GitHub allows 60 unauthenticated API calls
per hour per source address, shared by every visitor this host serves. So the
directory listing is the only metered call — file bodies come from
raw.githubusercontent.com, which is not counted — and every outcome is cached,
failures included: a repository that does not exist is an answer worth
remembering, or one stranger retrying a typo drains the hour for everyone.
Exhaustion is reported as exhaustion, not as a missing repository.

The trust boundary widens by one stated step and no more. The middleware's
justification for anonymous access was "no outbound call"; this endpoint makes
one, so the amended boundary is written down where the old one was: only
api.github.com and raw.githubusercontent.com, no credential attached, read-only
by construction. Owner and repository names are validated against GitHub's own
shape before they touch a URL. Private repositories cannot appear — an
anonymous request cannot see them, which is why this needs no allowlist while
the GitHub App integration does.

Limits are counted, not silent: files beyond the 30-file cap or the 100k
character cap are reported as skipped.

The UI grows a third tab beside Simulation and GitHub Sandbox. Its tests caught
a real race on the way in: the scenario-loading effect's promise could resolve
after a tab switch and wipe newer results via resetResults(). The effect now
cancels on cleanup, so a stale response is a no-op.

218 backend tests and 22 frontend tests pass.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 Directory.Packages.props                      |   1 +
 .../Endpoints/PublicScanEndpoints.cs          |  74 ++++++
 src/DevSecOpsSentinel.Api/Program.cs          |  16 ++
 .../PublicScanContracts.cs                    |  69 ++++++
 .../DevSecOpsSentinel.Infrastructure.csproj   |   1 +
 .../GitHub/PublicRepositoryScanner.cs         | 227 ++++++++++++++++++
 src/devsecops-sentinel-web/src/App.tsx        |  60 ++++-
 .../src/PublicScan.test.tsx                   | 147 ++++++++++++
 src/devsecops-sentinel-web/src/api.ts         |  24 ++
 src/devsecops-sentinel-web/src/models.ts      |  17 ++
 .../PublicScanEndpointTests.cs                | 118 +++++++++
 .../PublicRepositoryScannerTests.cs           | 220 +++++++++++++++++
 12 files changed, 966 insertions(+), 8 deletions(-)
 create mode 100644 src/DevSecOpsSentinel.Api/Endpoints/PublicScanEndpoints.cs
 create mode 100644 src/DevSecOpsSentinel.Application/PublicScanContracts.cs
 create mode 100644 src/DevSecOpsSentinel.Infrastructure/GitHub/PublicRepositoryScanner.cs
 create mode 100644 src/devsecops-sentinel-web/src/PublicScan.test.tsx
 create mode 100644 tests/DevSecOpsSentinel.Api.Integration.Tests/PublicScanEndpointTests.cs
 create mode 100644 tests/DevSecOpsSentinel.Infrastructure.Tests/PublicRepositoryScannerTests.cs

diff --git a/Directory.Packages.props b/Directory.Packages.props
index 107a44a..8d0c91f 100644
--- a/Directory.Packages.props
+++ b/Directory.Packages.props
@@ -8,6 +8,7 @@
     <PackageVersion Include="Microsoft.AspNetCore.Mvc.Testing" Version="10.0.11" />
     <PackageVersion Include="Microsoft.AspNetCore.OpenApi" Version="10.0.11" />
     <PackageVersion Include="Microsoft.Extensions.Http" Version="10.0.11" />
+    <PackageVersion Include="Microsoft.Extensions.Caching.Memory" Version="10.0.11" />
     <!--
       Explicitly pins the transitive OpenAPI.NET dependency above the patched 2.x floor
       for GHSA-v5pm-xwqc-g5wc. No project directly references this package.
diff --git a/src/DevSecOpsSentinel.Api/Endpoints/PublicScanEndpoints.cs b/src/DevSecOpsSentinel.Api/Endpoints/PublicScanEndpoints.cs
new file mode 100644
index 0000000..f113de9
--- /dev/null
+++ b/src/DevSecOpsSentinel.Api/Endpoints/PublicScanEndpoints.cs
@@ -0,0 +1,74 @@
+using DevSecOpsSentinel.Application;
+using Microsoft.AspNetCore.Mvc;
+
+namespace DevSecOpsSentinel.Api.Endpoints;
+
+/// <summary>
+/// Scan any public repository's workflows by name, anonymously.
+///
+/// This deliberately amends the middleware's "no outbound call" justification for
+/// anonymous access: this endpoint does call out, and the amended boundary is
+/// stated rather than implied — api.github.com and raw.githubusercontent.com
+/// only, no credential attached, read-only by construction, results cached so a
+/// visitor cannot spend the unauthenticated GitHub quota one refresh at a time.
+/// Private repositories cannot appear here: an anonymous request cannot see them,
+/// which is why this path needs no allowlist while /api/github does.
+/// </summary>
+public static class PublicScanEndpoints
+{
+    public static WebApplication MapPublicScanEndpoints(this WebApplication app)
+    {
+        app.MapGet(
+            "/api/public-scan/{owner}/{repository}",
+            async (
+                string owner,
+                string repository,
+                IPublicRepositoryScanner scanner,
+                CancellationToken cancellationToken) =>
+            {
+                PublicScanResult result =
+                    await scanner.ScanAsync(owner, repository, cancellationToken);
+
+                return result.Status switch
+                {
+                    PublicScanStatus.Completed or PublicScanStatus.NoWorkflows =>
+                        Results.Ok(result),
+
+                    PublicScanStatus.InvalidName => Results.BadRequest(new ProblemDetails
+                    {
+                        Title = "Invalid repository name",
+                        Detail = result.Detail,
+                        Status = StatusCodes.Status400BadRequest
+                    }),
+
+                    PublicScanStatus.RepositoryNotFound => Results.NotFound(new ProblemDetails
+                    {
+                        Title = "Repository not found",
+                        Detail = result.Detail,
+                        Status = StatusCodes.Status404NotFound
+                    }),
+
+                    PublicScanStatus.QuotaExhausted => Results.Json(
+                        new ProblemDetails
+                        {
+                            Title = "GitHub quota exhausted",
+                            Detail = result.Detail,
+                            Status = StatusCodes.Status503ServiceUnavailable
+                        },
+                        statusCode: StatusCodes.Status503ServiceUnavailable),
+
+                    _ => Results.Json(
+                        new ProblemDetails
+                        {
+                            Title = "GitHub unavailable",
+                            Detail = result.Detail,
+                            Status = StatusCodes.Status502BadGateway
+                        },
+                        statusCode: StatusCodes.Status502BadGateway)
+                };
+            })
+            .RequireRateLimiting("workflow-analysis");
+
+        return app;
+    }
+}
diff --git a/src/DevSecOpsSentinel.Api/Program.cs b/src/DevSecOpsSentinel.Api/Program.cs
index eca9ade..3f39ed1 100644
--- a/src/DevSecOpsSentinel.Api/Program.cs
+++ b/src/DevSecOpsSentinel.Api/Program.cs
@@ -174,6 +174,21 @@
     client.Timeout = TimeSpan.FromSeconds(30);
 });
 
+// The anonymous public-repository scanner. A separate named client from "GitHub" on
+// purpose: that one carries an installation token, this one must never carry anything.
+// GitHub rejects requests without a User-Agent, and asking for the JSON media type keeps
+// the contents API's answers stable.
+builder.Services.AddHttpClient("GitHubPublic", client =>
+{
+    client.BaseAddress = new Uri("https://api.github.com");
+    client.Timeout = TimeSpan.FromSeconds(30);
+    client.DefaultRequestHeaders.UserAgent.ParseAdd("DevSecOpsSentinel");
+    client.DefaultRequestHeaders.Accept.ParseAdd("application/vnd.github+json");
+});
+
+builder.Services.AddSingleton(TimeProvider.System);
+builder.Services.AddSingleton<IPublicRepositoryScanner, PublicRepositoryScanner>();
+
 builder.Services.AddSingleton<
     IGitHubPrivateKeySource,
     GitHubPrivateKeySource>();
@@ -279,6 +294,7 @@
 app.MapStatusEndpoints(openAiOptions, gitHubOptions)
    .MapGitHubEndpoints(gitHubOptions)
    .MapCatalogueEndpoints()
+   .MapPublicScanEndpoints()
    .MapWorkflowEndpoints(maximumWorkflowCharacters);
 
 app.Run();
diff --git a/src/DevSecOpsSentinel.Application/PublicScanContracts.cs b/src/DevSecOpsSentinel.Application/PublicScanContracts.cs
new file mode 100644
index 0000000..bb4defb
--- /dev/null
+++ b/src/DevSecOpsSentinel.Application/PublicScanContracts.cs
@@ -0,0 +1,69 @@
+using DevSecOpsSentinel.Domain;
+
+namespace DevSecOpsSentinel.Application;
+
+/// <summary>
+/// Scan of a public repository's workflows, requested by name alone.
+///
+/// This is the one feature that makes an outbound call on behalf of an anonymous
+/// visitor, so its boundaries are the point: only api.github.com and
+/// raw.githubusercontent.com are contacted, no credential is attached, nothing is
+/// written, and results are cached so a popular repository costs one fetch rather
+/// than one per visitor. Private repositories are invisible to it by construction —
+/// an unauthenticated request cannot see them, which is the whole reason this needs
+/// no allowlist while the GitHub App integration does.
+/// </summary>
+public interface IPublicRepositoryScanner
+{
+    Task<PublicScanResult> ScanAsync(
+        string owner,
+        string repository,
+        CancellationToken cancellationToken);
+}
+
+public enum PublicScanStatus
+{
+    /// <summary>Workflows were fetched and analysed.</summary>
+    Completed,
+
+    /// <summary>The repository does not exist, or is private — indistinguishable
+    /// without credentials, and deliberately reported the same way.</summary>
+    RepositoryNotFound,
+
+    /// <summary>The repository exists but has no workflow files.</summary>
+    NoWorkflows,
+
+    /// <summary>The owner or repository name is not a name GitHub could accept.</summary>
+    InvalidName,
+
+    /// <summary>GitHub's unauthenticated quota for this host is exhausted.</summary>
+    QuotaExhausted,
+
+    /// <summary>GitHub answered with something unexpected.</summary>
+    GitHubUnavailable
+}
+
+/// <summary>One workflow file and what the deterministic rules made of it.</summary>
+public sealed record PublicScanFile(
+    string FileName,
+    string HtmlUrl,
+    WorkflowAnalysisResult Analysis);
+
+public sealed record PublicScanResult(
+    string Owner,
+    string Repository,
+    PublicScanStatus Status,
+    string? Detail,
+    IReadOnlyList<PublicScanFile> Files,
+    int SkippedFiles,
+    DateTimeOffset FetchedAtUtc,
+    bool FromCache)
+{
+    public static PublicScanResult Failure(
+        string owner,
+        string repository,
+        PublicScanStatus status,
+        string detail,
+        DateTimeOffset atUtc) =>
+        new(owner, repository, status, detail, [], 0, atUtc, FromCache: false);
+}
diff --git a/src/DevSecOpsSentinel.Infrastructure/DevSecOpsSentinel.Infrastructure.csproj b/src/DevSecOpsSentinel.Infrastructure/DevSecOpsSentinel.Infrastructure.csproj
index 9db84ac..476873c 100644
--- a/src/DevSecOpsSentinel.Infrastructure/DevSecOpsSentinel.Infrastructure.csproj
+++ b/src/DevSecOpsSentinel.Infrastructure/DevSecOpsSentinel.Infrastructure.csproj
@@ -11,6 +11,7 @@
   <ItemGroup>
     <PackageReference Include="OpenAI" />
     <PackageReference Include="Microsoft.Extensions.Http" />
+    <PackageReference Include="Microsoft.Extensions.Caching.Memory" />
     <PackageReference Include="YamlDotNet" />
   </ItemGroup>
   <ItemGroup>
diff --git a/src/DevSecOpsSentinel.Infrastructure/GitHub/PublicRepositoryScanner.cs b/src/DevSecOpsSentinel.Infrastructure/GitHub/PublicRepositoryScanner.cs
new file mode 100644
index 0000000..09382dc
--- /dev/null
+++ b/src/DevSecOpsSentinel.Infrastructure/GitHub/PublicRepositoryScanner.cs
@@ -0,0 +1,227 @@
+using System.Net;
+using System.Net.Http.Json;
+using System.Text.Json.Serialization;
+using System.Text.RegularExpressions;
+using DevSecOpsSentinel.Application;
+using DevSecOpsSentinel.Domain;
+using Microsoft.Extensions.Caching.Memory;
+using Microsoft.Extensions.Logging;
+
+namespace DevSecOpsSentinel.Infrastructure.GitHub;
+
+/// <summary>
+/// Fetches a public repository's workflows without credentials and runs the
+/// deterministic analysis over them.
+///
+/// The quota is the design constraint. GitHub allows 60 unauthenticated API
+/// requests per hour per source address, shared by every visitor this host
+/// serves — so the directory listing is the only call that spends it. File
+/// bodies come from raw.githubusercontent.com, which is not metered, and every
+/// outcome is cached, including the failures: a repository that does not exist
+/// is an answer worth remembering too, or one stranger retrying a typo drains
+/// the hour for everyone.
+/// </summary>
+public sealed partial class PublicRepositoryScanner(
+    IHttpClientFactory httpClientFactory,
+    IWorkflowAnalysisService analysisService,
+    IMemoryCache cache,
+    TimeProvider clock,
+    ILogger<PublicRepositoryScanner> logger) : IPublicRepositoryScanner
+{
+    /// <summary>
+    /// Enough for the overwhelming majority of repositories (the field scan's
+    /// median was well under it) while bounding the work a single request can
+    /// cause. Files beyond the cap are counted, not silently dropped.
+    /// </summary>
+    internal const int MaximumWorkflowFiles = 30;
+
+    /// <summary>Matches the request-body limit the analyze endpoint enforces.</summary>
+    internal const int MaximumWorkflowCharacters = 100_000;
+
+    private static readonly TimeSpan SuccessTtl = TimeSpan.FromMinutes(10);
+    private static readonly TimeSpan NotFoundTtl = TimeSpan.FromMinutes(2);
+    private static readonly TimeSpan QuotaTtl = TimeSpan.FromSeconds(90);
+
+    [GeneratedRegex("^[A-Za-z0-9](?:[A-Za-z0-9-]{0,38})$")]
+    private static partial Regex OwnerPattern();
+
+    [GeneratedRegex(@"^[A-Za-z0-9._-]{1,100}$")]
+    private static partial Regex RepositoryPattern();
+
+    public async Task<PublicScanResult> ScanAsync(
+        string owner,
+        string repository,
+        CancellationToken cancellationToken)
+    {
+        DateTimeOffset now = clock.GetUtcNow();
+
+        // Validated before anything else touches them: these two strings become a
+        // URL path on a host we chose, and the pattern is what keeps them from
+        // becoming anything more interesting than a repository name.
+        if (!OwnerPattern().IsMatch(owner) || !RepositoryPattern().IsMatch(repository))
+        {
+            return PublicScanResult.Failure(
+                owner,
+                repository,
+                PublicScanStatus.InvalidName,
+                "Owner and repository must be plain GitHub names.",
+                now);
+        }
+
+        string key = $"public-scan:{owner.ToLowerInvariant()}/{repository.ToLowerInvariant()}";
+        if (cache.TryGetValue(key, out PublicScanResult? cached) && cached is not null)
+        {
+            return cached with { FromCache = true };
+        }
+
+        PublicScanResult result = await FetchAndAnalyzeAsync(owner, repository, now, cancellationToken);
+
+        cache.Set(key, result, result.Status switch
+        {
+            PublicScanStatus.Completed or PublicScanStatus.NoWorkflows => SuccessTtl,
+            PublicScanStatus.QuotaExhausted => QuotaTtl,
+            _ => NotFoundTtl
+        });
+
+        return result;
+    }
+
+    private async Task<PublicScanResult> FetchAndAnalyzeAsync(
+        string owner,
+        string repository,
+        DateTimeOffset now,
+        CancellationToken cancellationToken)
+    {
+        HttpClient client = httpClientFactory.CreateClient("GitHubPublic");
+
+        string listingPath =
+            $"/repos/{Uri.EscapeDataString(owner)}/{Uri.EscapeDataString(repository)}/contents/.github/workflows";
+
+        using HttpResponseMessage listing = await client.GetAsync(listingPath, cancellationToken);
+
+        if (IsQuotaExhausted(listing))
+        {
+            logger.LogWarning(
+                "GitHub unauthenticated quota exhausted while listing workflows.");
+            return PublicScanResult.Failure(
+                owner,
+                repository,
+                PublicScanStatus.QuotaExhausted,
+                "GitHub limits anonymous lookups per hour for this host, and the "
+                + "budget is spent. Cached results are unaffected; try again shortly.",
+                now);
+        }
+
+        if (listing.StatusCode == HttpStatusCode.NotFound)
+        {
+            // A missing repository and a repository with no .github/workflows both
+            // 404 here. One more request could tell them apart, but it would double
+            // the quota cost of every typo, so the listing's answer is refined only
+            // when it succeeds and the distinction is reported honestly otherwise.
+            return PublicScanResult.Failure(
+                owner,
+                repository,
+                PublicScanStatus.RepositoryNotFound,
+                "No public repository with workflows was found under that name. "
+                + "Private repositories are invisible to an anonymous scan.",
+                now);
+        }
+
+        if (!listing.IsSuccessStatusCode)
+        {
+            logger.LogWarning(
+                "GitHub listing returned {StatusCode}.",
+                (int)listing.StatusCode);
+            return PublicScanResult.Failure(
+                owner,
+                repository,
+                PublicScanStatus.GitHubUnavailable,
+                $"GitHub answered {(int)listing.StatusCode} for the workflow listing.",
+                now);
+        }
+
+        ContentItem[] items =
+            await listing.Content.ReadFromJsonAsync<ContentItem[]>(cancellationToken) ?? [];
+
+        ContentItem[] workflows =
+        [
+            .. items
+                .Where(item => string.Equals(item.Type, "file", StringComparison.OrdinalIgnoreCase))
+                .Where(item =>
+                    item.Name.EndsWith(".yml", StringComparison.OrdinalIgnoreCase) ||
+                    item.Name.EndsWith(".yaml", StringComparison.OrdinalIgnoreCase))
+                .Where(item => !string.IsNullOrWhiteSpace(item.DownloadUrl))
+                .OrderBy(item => item.Name, StringComparer.OrdinalIgnoreCase)
+        ];
+
+        if (workflows.Length == 0)
+        {
+            return PublicScanResult.Failure(
+                owner,
+                repository,
+                PublicScanStatus.NoWorkflows,
+                "The repository exists but .github/workflows contains no workflow files.",
+                now);
+        }
+
+        int skipped = 0;
+        List<PublicScanFile> files = [];
+
+        foreach (ContentItem item in workflows)
+        {
+            if (files.Count >= MaximumWorkflowFiles || item.Size > MaximumWorkflowCharacters)
+            {
+                skipped++;
+                continue;
+            }
+
+            // download_url points at raw.githubusercontent.com, which does not
+            // count against the API quota — the reason one scan costs one metered
+            // request no matter how many workflows the repository has.
+            string content = await client.GetStringAsync(item.DownloadUrl, cancellationToken);
+            if (content.Length > MaximumWorkflowCharacters)
+            {
+                skipped++;
+                continue;
+            }
+
+            WorkflowAnalysisResult analysis = await analysisService.AnalyzeAsync(
+                new WorkflowDocument(item.Name, content),
+                cancellationToken);
+
+            files.Add(new PublicScanFile(item.Name, item.HtmlUrl, analysis));
+        }
+
+        return new PublicScanResult(
+            owner,
+            repository,
+            PublicScanStatus.Completed,
+            Detail: null,
+            files,
+            skipped,
+            now,
+            FromCache: false);
+    }
+
+    private static bool IsQuotaExhausted(HttpResponseMessage response)
+    {
+        if (response.StatusCode is not (HttpStatusCode.Forbidden or HttpStatusCode.TooManyRequests))
+        {
+            return false;
+        }
+
+        // GitHub reports quota exhaustion as 403 with a zeroed remaining-count
+        // header; a plain 403 without it is something else and falls through to
+        // the generic unavailable path via the success-status check.
+        return response.Headers.TryGetValues("X-RateLimit-Remaining", out IEnumerable<string>? values) &&
+               values.FirstOrDefault() == "0" ||
+               response.StatusCode == HttpStatusCode.TooManyRequests;
+    }
+
+    private sealed record ContentItem(
+        [property: JsonPropertyName("name")] string Name,
+        [property: JsonPropertyName("type")] string Type,
+        [property: JsonPropertyName("size")] long Size,
+        [property: JsonPropertyName("html_url")] string HtmlUrl,
+        [property: JsonPropertyName("download_url")] string? DownloadUrl);
+}
diff --git a/src/devsecops-sentinel-web/src/App.tsx b/src/devsecops-sentinel-web/src/App.tsx
index e1bbda9..eab3248 100644
--- a/src/devsecops-sentinel-web/src/App.tsx
+++ b/src/devsecops-sentinel-web/src/App.tsx
@@ -16,6 +16,7 @@ import {
   getScenarios,
   getRemediationReport,
   downloadRemediationExport,
+  getPublicScan,
 } from './api';
 import type {
   AiStatus,
@@ -29,10 +30,11 @@ import type {
   WorkflowExplanationResult,
   WorkflowFinding,
   RemediationReport,
+  PublicScanResult,
 } from './models';
 
 const severityOrder = ['Critical', 'High', 'Medium', 'Low'];
-type SourceMode = 'simulation' | 'github';
+type SourceMode = 'simulation' | 'github' | 'public';
 type ResultTab = 'findings' | 'remediation' | 'comparison' | 'advisor';
 
 function getRiskLabel(findings: WorkflowFinding[]) {
@@ -83,6 +85,8 @@ function App() {
   const [selectedWorkflowPath, setSelectedWorkflowPath] = useState('');
   const [gitHubSource, setGitHubSource] = useState<GitHubWorkflowFile | null>(null);
   const [remediation, setRemediation] = useState<RemediationReport | null>(null);
+  const [publicRepoInput, setPublicRepoInput] = useState('');
+  const [publicScan, setPublicScan] = useState<PublicScanResult | null>(null);
 
   useEffect(() => {
     getSecurityStatus()
@@ -119,9 +123,18 @@ function App() {
 
   useEffect(() => {
     if (sourceMode !== 'simulation' || !selectedId) return;
+    // The guard above runs when the effect starts; the promise resolves later,
+    // by which point the user may have switched tabs and produced results this
+    // callback would wipe. Cancellation makes the stale response a no-op — the
+    // public-scan tests caught exactly that clobber.
+    let cancelled = false;
     getScenario(selectedId).then((scenario) => {
+      if (cancelled) return;
       setFileName(scenario.fileName); setContent(scenario.content); resetResults();
-    }).catch((reason: unknown) => setError(reason instanceof Error ? reason.message : 'Scenario could not be loaded.'));
+    }).catch((reason: unknown) => {
+      if (!cancelled) setError(reason instanceof Error ? reason.message : 'Scenario could not be loaded.');
+    });
+    return () => { cancelled = true; };
   }, [selectedId, sourceMode]);
 
   useEffect(() => {
@@ -199,11 +212,19 @@ function App() {
     resetResults();
   }
 
-  function resetResults() { setResult(null); setExplanation(null); setRemediation(null); setActiveResultTab('findings'); setError(''); }
+  function resetResults() { setResult(null); setExplanation(null); setRemediation(null); setPublicScan(null); setActiveResultTab('findings'); setError(''); }
 
   async function submit(event: React.FormEvent) {
     event.preventDefault(); setIsLoading(true); setError(''); setResult(null); setExplanation(null); setRemediation(null); setActiveResultTab(includeAi ? 'advisor' : 'findings');
     try {
+      if (sourceMode === 'public') {
+        const [owner, ...rest] = publicRepoInput.trim().replace(/^https?:\/\/github\.com\//i, '').split('/');
+        const repository = rest.join('/').replace(/\/.*$/, '') || rest[0];
+        if (!owner || !repository) throw new Error('Enter a repository as owner/name, e.g. facebook/react.');
+        setPublicScan(await getPublicScan(owner, repository));
+        setMobilePane('results');
+        return;
+      }
       if (sourceMode === 'github') {
         if (!selectedRepository || !selectedWorkflowPath) throw new Error('Select a GitHub workflow first.');
         const [owner, repository] = selectedRepository.split('/');
@@ -302,6 +323,7 @@ function App() {
     <div className="source-switcher" role="tablist" aria-label="Workflow source">
       <button type="button" role="tab" aria-selected={sourceMode === 'simulation'} className={sourceMode === 'simulation' ? 'active' : ''} onClick={() => { setSourceMode('simulation'); resetResults(); }}>Simulation</button>
       <button type="button" role="tab" aria-selected={sourceMode === 'github'} className={sourceMode === 'github' ? 'active' : ''} onClick={() => { setSourceMode('github'); resetResults(); }}>GitHub Sandbox <span className="read-only-tag">READ ONLY</span></button>
+      <button type="button" role="tab" aria-selected={sourceMode === 'public'} className={sourceMode === 'public' ? 'active' : ''} onClick={() => { setSourceMode('public'); resetResults(); }}>Public repo <span className="read-only-tag">NO SIGN-IN</span></button>
     </div>
 
     {/* Phone only; CSS hides it once both panes fit side by side. */}
@@ -317,9 +339,13 @@ function App() {
     </div>
 
     <section className="workspace" data-mobile-pane={mobilePane}><form className="control-panel" onSubmit={submit}>
-      <div className="panel-heading"><div><span className="panel-kicker">Analysis workspace</span><h2>{sourceMode === 'github' ? 'GitHub workflow' : 'Workflow input'}</h2></div><span className={`mode-pill ${sourceMode === 'github' ? 'mode-pill-readonly' : 'mode-pill-safe'}`}>{sourceMode === 'github' ? 'Read only' : 'Simulation'}</span></div>
+      <div className="panel-heading"><div><span className="panel-kicker">Analysis workspace</span><h2>{sourceMode === 'github' ? 'GitHub workflow' : sourceMode === 'public' ? 'Public repository' : 'Workflow input'}</h2></div><span className={`mode-pill ${sourceMode === 'simulation' ? 'mode-pill-safe' : 'mode-pill-readonly'}`}>{sourceMode === 'github' ? 'Read only' : sourceMode === 'public' ? 'Anonymous' : 'Simulation'}</span></div>
 
-      {sourceMode === 'simulation' ? <>
+      {sourceMode === 'public' ? <>
+        <label htmlFor="public-repo">Public repository</label>
+        <input id="public-repo" placeholder="owner/repository — e.g. facebook/react" value={publicRepoInput} onChange={(event) => setPublicRepoInput(event.target.value)} autoComplete="off" spellCheck={false} />
+        <p className="scenario-description">Every workflow under .github/workflows is fetched anonymously and run through the deterministic rules. Nothing is written, no credential is attached, and results are cached for ten minutes — a popular repository costs one fetch, not one per visitor.</p>
+      </> : sourceMode === 'simulation' ? <>
         <label htmlFor="scenario">Sample scenario</label><select id="scenario" value={selectedId} onChange={(event) => setSelectedId(event.target.value)}>{scenarios.map((scenario) => <option key={scenario.id} value={scenario.id}>{scenario.name}</option>)}</select>
         {selectedScenario && <p className="scenario-description">{selectedScenario.description}</p>}
         <label htmlFor="file-name">Workflow file</label><input id="file-name" value={fileName} onChange={(event) => setFileName(event.target.value)} />
@@ -330,16 +356,34 @@ function App() {
         {gitHubSource && <div className="source-metadata"><span>Branch <strong>{gitHubSource.defaultBranch}</strong></span><span>SHA <code>{gitHubSource.sha.slice(0, 10)}</code></span><a href={gitHubSource.htmlUrl} target="_blank" rel="noreferrer">View on GitHub</a></div>}
       </>}
 
+      {sourceMode !== 'public' && <>
       <div className="editor-label-row"><label htmlFor="workflow">Workflow YAML</label><span>{content.length.toLocaleString()} characters</span></div>
       <div className="editor-shell"><div className="editor-toolbar"><span className="editor-dot" /><span className="editor-dot" /><span className="editor-dot" /><strong>{fileName}</strong>{sourceMode === 'github' && <span className="editor-readonly">READ ONLY</span>}</div><textarea id="workflow" value={content} onChange={(event) => setContent(event.target.value)} spellCheck={false} readOnly={sourceMode === 'github'} aria-describedby="workflow-help" /></div>
 
       <div className="ai-control-card"><label className="ai-toggle" htmlFor="include-ai"><input id="include-ai" type="checkbox" aria-label="Include AI explanation" checked={includeAi} onChange={(event) => setIncludeAi(event.target.checked)} disabled={aiStatus?.enabled === false} /><span><strong>Include AI explanation</strong><small>Explain confirmed findings and remediation steps.</small></span></label><span className="mode-pill">{aiModeLabel}</span></div>
       <p id="workflow-help" className="helper-text">{sourceMode === 'github' ? 'The selected GitHub workflow is retrieved and analyzed without modifying the repository.' : 'Live AI mode sends sanitized context; Mock mode uses no credits.'}</p>
-      <button className="primary-action" type="submit" disabled={isLoading || content.trim().length === 0 || (sourceMode === 'github' && !selectedWorkflowPath)}>{isLoading ? <><span className="spinner" aria-hidden="true" />Loading…</> : sourceMode === 'github' ? 'Analyze GitHub workflow' : 'Analyze workflow'}</button>
+      </>}
+      <button className="primary-action" type="submit" disabled={isLoading || (sourceMode === 'public' ? !publicRepoInput.includes('/') : content.trim().length === 0 || (sourceMode === 'github' && !selectedWorkflowPath))}>{isLoading ? <><span className="spinner" aria-hidden="true" />Loading…</> : sourceMode === 'github' ? 'Analyze GitHub workflow' : sourceMode === 'public' ? 'Scan public repository' : 'Analyze workflow'}</button>
       {error && <p className="error" role="alert">{error}</p>}
     </form>
 
-    <section className="results" aria-live="polite">{!result && !error && <div className="empty-state"><div className="empty-icon" aria-hidden="true">✓</div><h2>{sourceMode === 'github' ? 'Select a GitHub workflow' : 'Ready to analyze'}</h2><p>{sourceMode === 'github' ? 'Choose an allowlisted repository and workflow. DevSecOps Sentinel will read and analyze it without making repository changes.' : 'Select a scenario or edit the YAML, then run the scanner.'}</p></div>}
+    <section className="results" aria-live="polite">{sourceMode === 'public' && publicScan && <>
+      <div className="summary-grid">
+        <article className="metric-card"><span>Repository</span><strong>{publicScan.owner}/{publicScan.repository}</strong><small>{publicScan.fromCache ? 'Cached result' : 'Fetched live'}</small></article>
+        <article className="metric-card"><span>Workflows scanned</span><strong>{publicScan.files.length}</strong><small>{publicScan.skippedFiles > 0 ? `${publicScan.skippedFiles} skipped (size/cap)` : 'All within limits'}</small></article>
+        <article className="metric-card"><span>With findings</span><strong>{publicScan.files.filter((file) => file.analysis.findings.length > 0).length}</strong><small>{publicScan.files.filter((file) => file.analysis.findings.length === 0).length} clean</small></article>
+        <article className="metric-card"><span>Total findings</span><strong>{publicScan.files.reduce((sum, file) => sum + file.analysis.findings.length, 0)}</strong><small>Deterministic rules only</small></article>
+      </div>
+      {publicScan.status === 'NoWorkflows' && <div className="success-card"><strong>The repository has no workflow files.</strong><span>{publicScan.detail}</span></div>}
+      {publicScan.files.map((file) => <section className="findings-panel" key={file.fileName}>
+        <div className="section-heading"><div><span className="panel-kicker">{file.analysis.findings.length === 0 ? 'Clean' : getRiskLabel(file.analysis.findings)} · {file.analysis.findings.length} finding{file.analysis.findings.length === 1 ? '' : 's'}</span><h2>{file.fileName}</h2></div><a className="result-badge" href={file.htmlUrl} target="_blank" rel="noreferrer">View on GitHub</a></div>
+        {file.analysis.findings.length === 0
+          ? <div className="success-card"><strong>No configured rule violations were detected.</strong><span>This workflow passed all deterministic checks.</span></div>
+          : severityOrder.flatMap((severity) => file.analysis.findings.filter((finding) => finding.severity === severity)).map((finding) => <article className={`finding finding-${finding.severity.toLowerCase()}`} key={`${file.fileName}-${finding.ruleId}-${finding.lineNumber}`}><div className="finding-heading"><span className={`severity severity-${finding.severity.toLowerCase()}`}>{finding.severity}</span><code>{finding.ruleId}</code>{finding.lineNumber && <span>Line {finding.lineNumber}</span>}</div><h3>{finding.title}</h3><p>{finding.description}</p><div className="recommendation"><strong>Recommended remediation</strong><span>{finding.recommendation}</span></div></article>)}
+      </section>)}
+    </>}
+    {sourceMode === 'public' && !publicScan && !error && <div className="empty-state"><div className="empty-icon" aria-hidden="true">✓</div><h2>Scan any public repository</h2><p>Enter owner/repository. Every workflow file is fetched read-only and analyzed; private repositories are invisible to an anonymous scan.</p></div>}
+    {sourceMode !== 'public' && <>{!result && !error && <div className="empty-state"><div className="empty-icon" aria-hidden="true">✓</div><h2>{sourceMode === 'github' ? 'Select a GitHub workflow' : 'Ready to analyze'}</h2><p>{sourceMode === 'github' ? 'Choose an allowlisted repository and workflow. DevSecOps Sentinel will read and analyze it without making repository changes.' : 'Select a scenario or edit the YAML, then run the scanner.'}</p></div>}
       {result && <><div className="summary-grid"><article className="metric-card"><span>Risk level</span><strong className={`risk-${riskLabel.toLowerCase().replace(' ', '-')}`}>{riskLabel}</strong><small>Deterministic findings</small></article><article className="metric-card"><span>Total findings</span><strong>{result.findingCount ?? findings.length}</strong><small>{countBySeverity(findings, 'Critical')} critical · {countBySeverity(findings, 'High')} high</small></article><article className="metric-card"><span>Auto-fixes</span><strong>{result.patch?.appliedRuleIds.length ?? 0}</strong><small>Proposed only</small></article><article className="metric-card"><span>Source</span><strong>{sourceMode === 'github' ? 'GitHub' : 'Local'}</strong><small>{sourceMode === 'github' ? 'Read-only retrieval' : 'Simulation scenario'}</small></article></div>
         <nav className="result-tabs" aria-label="Analysis result sections"><button type="button" className={activeResultTab === 'findings' ? 'active' : ''} onClick={() => setActiveResultTab('findings')}>Findings <span>{result.findingCount}</span></button><button type="button" disabled={!remediation} className={activeResultTab === 'remediation' ? 'active' : ''} onClick={() => setActiveResultTab('remediation')}>Remediation plan</button><button type="button" className={activeResultTab === 'comparison' ? 'active' : ''} onClick={() => setActiveResultTab('comparison')}>Workflow comparison</button><button type="button" disabled={!explanation} className={activeResultTab === 'advisor' ? 'active' : ''} onClick={() => setActiveResultTab('advisor')}>AI advisor</button></nav>
         {activeResultTab === 'findings' && <section className="findings-panel"><div className="section-heading"><div><span className="panel-kicker">Authoritative results</span><h2>Deterministic findings</h2></div><span className="result-badge">{result.findingCount === 0 ? 'Compliant' : 'Action required'}</span></div>{result.findings.length === 0 ? <div className="success-card"><strong>No configured rule violations were detected.</strong><span>The workflow passed all deterministic security checks.</span></div> : sortedFindings.map((finding) => <article className={`finding finding-${finding.severity.toLowerCase()}`} key={`${finding.ruleId}-${finding.lineNumber}`}><div className="finding-heading"><span className={`severity severity-${finding.severity.toLowerCase()}`}>{finding.severity}</span><code>{finding.ruleId}</code>{finding.lineNumber && <span>Line {finding.lineNumber}</span>}{finding.isAutomaticallyFixable && <span className="auto-fix-label">Proposed fix available</span>}</div><h3>{finding.title}</h3><p>{finding.description}</p><div className="recommendation"><strong>Recommended remediation</strong><span>{finding.recommendation}</span></div></article>)}</section>}
@@ -355,7 +399,7 @@ function App() {
           <strong>The model was not used.</strong> {explanation.explanation.fallbackReason} The explanation below is deterministic text derived from the findings.
         </p>}{explanation.sensitiveContentRedacted && <p className="warning">Potentially sensitive values were redacted.</p>}<div className="advisor-summary"><span className="panel-kicker">Executive summary</span><p>{explanation.explanation.summary}</p></div>{explanation.explanation.findings.map((item) => <article className="ai-finding" key={item.ruleId}><header><code>{item.ruleId}</code><span>{item.confidence} confidence</span></header><p><strong>Why it matters</strong>{item.whyItMatters}</p><p><strong>Recommended action</strong>{item.recommendedAction}</p></article>)}</section>}
         {activeResultTab === 'comparison' && result.patch && <><div className="readonly-banner"><strong>Preview only</strong><span>Phase D does not write this patch back to GitHub.</span></div><div className="comparison"><CodePanel title="Original workflow" subtitle="Repository content" content={result.patch.originalContent} tone="original" /><CodePanel title="Proposed workflow" subtitle="Validated remediation preview" content={result.patch.proposedContent} tone="proposed" /></div></>}
-      </>}
+      </>}</>}
     </section></section>
   </main>;
 }
diff --git a/src/devsecops-sentinel-web/src/PublicScan.test.tsx b/src/devsecops-sentinel-web/src/PublicScan.test.tsx
new file mode 100644
index 0000000..be7bbd9
--- /dev/null
+++ b/src/devsecops-sentinel-web/src/PublicScan.test.tsx
@@ -0,0 +1,147 @@
+import { fireEvent, render, screen, waitFor } from '@testing-library/react';
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+import App from './App';
+
+/**
+ * Public repository scanning: type owner/repository, get per-file findings,
+ * no key involved.
+ *
+ * The regression worth guarding is the feature quietly requiring something —
+ * a key, a paste, a second step. Its entire value is that it asks for a name
+ * and nothing else.
+ */
+const scenario = { id: 'sample', name: 'Sample', description: 'Sample', fileName: 'sample.yml' };
+
+const publicMode = {
+  required: false,
+  headerName: 'X-API-Key',
+  sessionOnlyBrowserKey: true,
+  mode: 'Public',
+  keyUnlocksGitHub: true,
+  keyUnlocksLiveAi: true,
+};
+
+const scanResult = {
+  owner: 'octo',
+  repository: 'app',
+  status: 'Completed',
+  detail: null,
+  files: [
+    {
+      fileName: 'ci.yml',
+      htmlUrl: 'https://github.com/octo/app/blob/main/.github/workflows/ci.yml',
+      analysis: {
+        fileName: 'ci.yml',
+        isValid: true,
+        validationErrors: [],
+        findings: [
+          {
+            ruleId: 'GHA001',
+            severity: 'High',
+            title: 'Action reference is not pinned to a commit SHA',
+            description: 'A movable tag can resolve to different code.',
+            lineNumber: 8,
+            recommendation: 'Pin the action to a full commit SHA.',
+            isAutomaticallyFixable: true,
+          },
+        ],
+        patch: null,
+        findingCount: 1,
+      },
+    },
+    {
+      fileName: 'release.yml',
+      htmlUrl: 'https://github.com/octo/app/blob/main/.github/workflows/release.yml',
+      analysis: {
+        fileName: 'release.yml',
+        isValid: true,
+        validationErrors: [],
+        findings: [],
+        patch: null,
+        findingCount: 0,
+      },
+    },
+  ],
+  skippedFiles: 0,
+  fetchedAtUtc: '2026-08-24T00:00:00Z',
+  fromCache: false,
+};
+
+function respond(handlers: Record<string, () => Response>) {
+  return async (input: RequestInfo | URL): Promise<Response> => {
+    const url = String(input);
+    if (url === '/api/security/status') return Response.json(publicMode);
+    if (url === '/api/scenarios') return Response.json([scenario]);
+    if (url === '/api/scenarios/sample') return Response.json({ ...scenario, content: 'name: Sample\non:\n  push:\n' });
+    if (url === '/api/ai/status') return Response.json({ enabled: true, configured: false, provider: 'OpenAI', mode: 'Mock', model: 'gpt-5-mini', costProtection: { explicitRequestOnly: true, mockModeConsumesCredits: false } });
+    if (url === '/api/github/status') return Response.json({ enabled: false, configured: false, connected: false, mode: 'ReadOnly', allowedRepositoryCount: 0, message: 'Not configured.' });
+    for (const [prefix, handler] of Object.entries(handlers)) {
+      if (url.includes(prefix)) return handler();
+    }
+    return new Response('{}', { status: 404 });
+  };
+}
+
+afterEach(() => {
+  vi.unstubAllGlobals();
+  sessionStorage.clear();
+});
+
+describe('Public repository scan', () => {
+  beforeEach(() => {
+    vi.stubGlobal('fetch', vi.fn(respond({
+      '/api/public-scan/octo/app': () => Response.json(scanResult),
+    })));
+  });
+
+  it('scans by name and shows per-file findings without any key', async () => {
+    render(<App />);
+    await waitFor(() => expect(screen.getByRole('tab', { name: /Public repo/ })).toBeInTheDocument());
+
+    fireEvent.click(screen.getByRole('tab', { name: /Public repo/ }));
+    fireEvent.change(screen.getByLabelText('Public repository'), { target: { value: 'octo/app' } });
+    fireEvent.click(screen.getByRole('button', { name: 'Scan public repository' }));
+
+    await waitFor(() => expect(screen.getByText('ci.yml')).toBeInTheDocument());
+
+    // The vulnerable file shows its finding; the clean file says so.
+    expect(screen.getByText('Action reference is not pinned to a commit SHA')).toBeInTheDocument();
+    expect(screen.getByText('release.yml')).toBeInTheDocument();
+    expect(screen.getByText('No configured rule violations were detected.')).toBeInTheDocument();
+
+    // And the whole path involved no key gate.
+    expect(screen.queryByText('Access key required')).not.toBeInTheDocument();
+  });
+
+  it('accepts a pasted github.com URL, not only owner/name', async () => {
+    render(<App />);
+    await waitFor(() => expect(screen.getByRole('tab', { name: /Public repo/ })).toBeInTheDocument());
+
+    fireEvent.click(screen.getByRole('tab', { name: /Public repo/ }));
+    fireEvent.change(screen.getByLabelText('Public repository'), {
+      target: { value: 'https://github.com/octo/app' },
+    });
+    fireEvent.click(screen.getByRole('button', { name: 'Scan public repository' }));
+
+    await waitFor(() => expect(screen.getByText('ci.yml')).toBeInTheDocument());
+  });
+
+  it('surfaces the problem detail when the repository is not found', async () => {
+    vi.stubGlobal('fetch', vi.fn(respond({
+      '/api/public-scan/octo/gone': () =>
+        Response.json(
+          { title: 'Repository not found', detail: 'No public repository with workflows was found under that name.', status: 404 },
+          { status: 404 }),
+    })));
+
+    render(<App />);
+    await waitFor(() => expect(screen.getByRole('tab', { name: /Public repo/ })).toBeInTheDocument());
+
+    fireEvent.click(screen.getByRole('tab', { name: /Public repo/ }));
+    fireEvent.change(screen.getByLabelText('Public repository'), { target: { value: 'octo/gone' } });
+    fireEvent.click(screen.getByRole('button', { name: 'Scan public repository' }));
+
+    await waitFor(() => expect(
+      screen.getByText('No public repository with workflows was found under that name.')).toBeInTheDocument());
+  });
+});
diff --git a/src/devsecops-sentinel-web/src/api.ts b/src/devsecops-sentinel-web/src/api.ts
index 7b6c9ec..6c89303 100644
--- a/src/devsecops-sentinel-web/src/api.ts
+++ b/src/devsecops-sentinel-web/src/api.ts
@@ -1,5 +1,6 @@
 import type {
   AiStatus,
+  PublicScanResult,
   ApiSecurityStatus,
   ScenarioDetail,
   ScenarioSummary,
@@ -185,3 +186,26 @@ export async function downloadRemediationExport(fileName: string, content: strin
   anchor.click();
   URL.revokeObjectURL(url);
 }
+
+export async function getPublicScan(
+  owner: string,
+  repository: string,
+): Promise<PublicScanResult> {
+  const response = await apiFetch(
+    `/api/public-scan/${encodeURIComponent(owner)}/${encodeURIComponent(repository)}`,
+  );
+
+  if (!response.ok) {
+    // The API answers failures with problem details whose detail is written
+    // for a person - the quota message, the not-found message. Surface it
+    // rather than a status code.
+    const problem = (await response.json().catch(() => null)) as
+      | { detail?: string; title?: string }
+      | null;
+    throw new Error(
+      problem?.detail ?? problem?.title ?? `Scan failed (${response.status}).`,
+    );
+  }
+
+  return (await response.json()) as PublicScanResult;
+}
diff --git a/src/devsecops-sentinel-web/src/models.ts b/src/devsecops-sentinel-web/src/models.ts
index 14d0b9a..ad6691f 100644
--- a/src/devsecops-sentinel-web/src/models.ts
+++ b/src/devsecops-sentinel-web/src/models.ts
@@ -146,3 +146,20 @@ export interface RemediationReport {
   resolvedFindingCount: number;
   remainingFindingCount: number;
 }
+
+export interface PublicScanFile {
+  fileName: string;
+  htmlUrl: string;
+  analysis: WorkflowAnalysisResult;
+}
+
+export interface PublicScanResult {
+  owner: string;
+  repository: string;
+  status: 'Completed' | 'RepositoryNotFound' | 'NoWorkflows' | 'InvalidName' | 'QuotaExhausted' | 'GitHubUnavailable';
+  detail: string | null;
+  files: PublicScanFile[];
+  skippedFiles: number;
+  fetchedAtUtc: string;
+  fromCache: boolean;
+}
diff --git a/tests/DevSecOpsSentinel.Api.Integration.Tests/PublicScanEndpointTests.cs b/tests/DevSecOpsSentinel.Api.Integration.Tests/PublicScanEndpointTests.cs
new file mode 100644
index 0000000..9a92e21
--- /dev/null
+++ b/tests/DevSecOpsSentinel.Api.Integration.Tests/PublicScanEndpointTests.cs
@@ -0,0 +1,118 @@
+using System.Net;
+using System.Net.Http.Json;
+using System.Text.Json;
+using System.Text.Json.Serialization;
+using DevSecOpsSentinel.Application;
+using Microsoft.AspNetCore.Hosting;
+using Microsoft.AspNetCore.Mvc.Testing;
+using Microsoft.Extensions.DependencyInjection;
+using Microsoft.Extensions.DependencyInjection.Extensions;
+
+namespace DevSecOpsSentinel.Api.Integration.Tests;
+
+/// <summary>
+/// The endpoint's job is translation: scanner outcomes to status codes, without the
+/// endpoint inventing behaviour of its own. The scanner is stubbed, so what these
+/// tests pin is exactly that mapping — including that the route accepts an anonymous
+/// caller, which is the property the feature exists for.
+/// </summary>
+public sealed class PublicScanEndpointTests : IClassFixture<PublicScanEndpointTests.Factory>
+{
+    private readonly HttpClient _client;
+
+    public PublicScanEndpointTests(Factory factory) => _client = factory.CreateClient();
+
+    [Fact]
+    public async Task Completed_scan_returns_ok_with_the_findings()
+    {
+        HttpResponseMessage response = await _client.GetAsync("/api/public-scan/octo/app");
+
+        Assert.Equal(HttpStatusCode.OK, response.StatusCode);
+        // The API writes enums as strings; the reader has to agree with it.
+        JsonSerializerOptions options = new(JsonSerializerDefaults.Web)
+        {
+            Converters = { new JsonStringEnumConverter() }
+        };
+        PublicScanResult? result =
+            await response.Content.ReadFromJsonAsync<PublicScanResult>(options);
+        Assert.NotNull(result);
+        Assert.Equal(PublicScanStatus.Completed, result.Status);
+        Assert.Single(result.Files);
+    }
+
+    [Fact]
+    public async Task Missing_repository_maps_to_not_found()
+    {
+        HttpResponseMessage response = await _client.GetAsync("/api/public-scan/octo/missing");
+
+        Assert.Equal(HttpStatusCode.NotFound, response.StatusCode);
+    }
+
+    [Fact]
+    public async Task Exhausted_quota_maps_to_service_unavailable()
+    {
+        HttpResponseMessage response = await _client.GetAsync("/api/public-scan/octo/quota");
+
+        Assert.Equal(HttpStatusCode.ServiceUnavailable, response.StatusCode);
+    }
+
+    [Fact]
+    public async Task Invalid_name_maps_to_bad_request()
+    {
+        HttpResponseMessage response = await _client.GetAsync("/api/public-scan/octo/bad");
+
+        Assert.Equal(HttpStatusCode.BadRequest, response.StatusCode);
+    }
+
+    public sealed class Factory : WebApplicationFactory<Program>
+    {
+        protected override void ConfigureWebHost(IWebHostBuilder builder)
+        {
+            builder.UseEnvironment("Testing");
+            builder.ConfigureServices(services =>
+            {
+                services.RemoveAll<IPublicRepositoryScanner>();
+                services.AddSingleton<IPublicRepositoryScanner, StubScanner>();
+            });
+        }
+    }
+
+    private sealed class StubScanner : IPublicRepositoryScanner
+    {
+        public Task<PublicScanResult> ScanAsync(
+            string owner,
+            string repository,
+            CancellationToken cancellationToken)
+        {
+            DateTimeOffset now = DateTimeOffset.UnixEpoch;
+
+            PublicScanResult result = repository switch
+            {
+                "missing" => PublicScanResult.Failure(
+                    owner, repository, PublicScanStatus.RepositoryNotFound, "gone", now),
+                "quota" => PublicScanResult.Failure(
+                    owner, repository, PublicScanStatus.QuotaExhausted, "spent", now),
+                "bad" => PublicScanResult.Failure(
+                    owner, repository, PublicScanStatus.InvalidName, "bad name", now),
+                _ => new PublicScanResult(
+                    owner,
+                    repository,
+                    PublicScanStatus.Completed,
+                    Detail: null,
+                    Files:
+                    [
+                        new PublicScanFile(
+                            "ci.yml",
+                            "https://github.test/ci.yml",
+                            new Domain.WorkflowAnalysisResult(
+                                "ci.yml", IsValid: true, [], [], Patch: null))
+                    ],
+                    SkippedFiles: 0,
+                    now,
+                    FromCache: false)
+            };
+
+            return Task.FromResult(result);
+        }
+    }
+}
diff --git a/tests/DevSecOpsSentinel.Infrastructure.Tests/PublicRepositoryScannerTests.cs b/tests/DevSecOpsSentinel.Infrastructure.Tests/PublicRepositoryScannerTests.cs
new file mode 100644
index 0000000..f6a8402
--- /dev/null
+++ b/tests/DevSecOpsSentinel.Infrastructure.Tests/PublicRepositoryScannerTests.cs
@@ -0,0 +1,220 @@
+using System.Net;
+using System.Text;
+using DevSecOpsSentinel.Application;
+using DevSecOpsSentinel.Domain;
+using DevSecOpsSentinel.Infrastructure;
+using DevSecOpsSentinel.Infrastructure.GitHub;
+using DevSecOpsSentinel.Infrastructure.Rules;
+using Microsoft.Extensions.Caching.Memory;
+using Microsoft.Extensions.Logging.Abstractions;
+
+namespace DevSecOpsSentinel.Infrastructure.Tests;
+
+public sealed class PublicRepositoryScannerTests
+{
+    private const string VulnerableWorkflow = """
+        name: CI
+        on:
+          push:
+        jobs:
+          build:
+            runs-on: ubuntu-latest
+            steps:
+              - uses: actions/checkout@v4
+        """;
+
+    [Fact]
+    public async Task Scans_a_repository_and_reports_findings_per_file()
+    {
+        FakeGitHub github = new();
+        github.Listing("octo", "app",
+            File("ci.yml", VulnerableWorkflow.Length, "https://raw.test/ci.yml"));
+        github.Raw("https://raw.test/ci.yml", VulnerableWorkflow);
+
+        PublicScanResult result = await Scanner(github).ScanAsync("octo", "app", CancellationToken.None);
+
+        Assert.Equal(PublicScanStatus.Completed, result.Status);
+        PublicScanFile file = Assert.Single(result.Files);
+        Assert.Equal("ci.yml", file.FileName);
+        Assert.Contains(file.Analysis.Findings, finding => finding.RuleId == "GHA001");
+        Assert.False(result.FromCache);
+    }
+
+    [Fact]
+    public async Task Second_scan_of_the_same_repository_is_served_from_cache()
+    {
+        FakeGitHub github = new();
+        github.Listing("octo", "app",
+            File("ci.yml", VulnerableWorkflow.Length, "https://raw.test/ci.yml"));
+        github.Raw("https://raw.test/ci.yml", VulnerableWorkflow);
+
+        IPublicRepositoryScanner scanner = Scanner(github);
+        await scanner.ScanAsync("octo", "app", CancellationToken.None);
+        PublicScanResult second = await scanner.ScanAsync("OCTO", "APP", CancellationToken.None);
+
+        // One metered listing request total — the second scan, even differently
+        // cased, must not spend quota. That is the property the cache exists for.
+        Assert.Equal(1, github.ListingRequests);
+        Assert.True(second.FromCache);
+    }
+
+    [Fact]
+    public async Task Missing_repository_is_not_found_and_the_failure_is_cached()
+    {
+        FakeGitHub github = new() { ListingStatus = HttpStatusCode.NotFound };
+
+        IPublicRepositoryScanner scanner = Scanner(github);
+        PublicScanResult first = await scanner.ScanAsync("octo", "gone", CancellationToken.None);
+        await scanner.ScanAsync("octo", "gone", CancellationToken.None);
+
+        Assert.Equal(PublicScanStatus.RepositoryNotFound, first.Status);
+        // A typo retried must not spend the shared quota a second time.
+        Assert.Equal(1, github.ListingRequests);
+    }
+
+    [Fact]
+    public async Task Exhausted_quota_is_reported_as_such_not_as_a_missing_repository()
+    {
+        FakeGitHub github = new()
+        {
+            ListingStatus = HttpStatusCode.Forbidden,
+            RateLimitRemaining = "0"
+        };
+
+        PublicScanResult result = await Scanner(github).ScanAsync("octo", "app", CancellationToken.None);
+
+        Assert.Equal(PublicScanStatus.QuotaExhausted, result.Status);
+    }
+
+    [Theory]
+    [InlineData("../etc", "app")]
+    [InlineData("octo", "app/../../secrets")]
+    [InlineData("", "app")]
+    [InlineData("octo", "a b")]
+    public async Task Names_that_are_not_plain_github_names_are_rejected_before_any_request(
+        string owner,
+        string repository)
+    {
+        FakeGitHub github = new();
+
+        PublicScanResult result = await Scanner(github).ScanAsync(owner, repository, CancellationToken.None);
+
+        Assert.Equal(PublicScanStatus.InvalidName, result.Status);
+        // The whole point: a hostile name never becomes a URL.
+        Assert.Equal(0, github.ListingRequests);
+    }
+
+    [Fact]
+    public async Task Oversized_files_are_skipped_and_counted_rather_than_fetched()
+    {
+        FakeGitHub github = new();
+        github.Listing("octo", "app",
+            File("huge.yml", PublicRepositoryScanner.MaximumWorkflowCharacters + 1, "https://raw.test/huge.yml"),
+            File("ci.yml", VulnerableWorkflow.Length, "https://raw.test/ci.yml"));
+        github.Raw("https://raw.test/ci.yml", VulnerableWorkflow);
+
+        PublicScanResult result = await Scanner(github).ScanAsync("octo", "app", CancellationToken.None);
+
+        Assert.Equal(PublicScanStatus.Completed, result.Status);
+        Assert.Single(result.Files);
+        Assert.Equal(1, result.SkippedFiles);
+        // The oversized file's body was never downloaded.
+        Assert.DoesNotContain("https://raw.test/huge.yml", github.RawRequests);
+    }
+
+    [Fact]
+    public async Task A_repository_with_a_workflows_directory_but_no_yml_files_reports_no_workflows()
+    {
+        FakeGitHub github = new();
+        github.Listing("octo", "app", File("README.md", 10, "https://raw.test/readme"));
+
+        PublicScanResult result = await Scanner(github).ScanAsync("octo", "app", CancellationToken.None);
+
+        Assert.Equal(PublicScanStatus.NoWorkflows, result.Status);
+    }
+
+    private static PublicRepositoryScanner Scanner(FakeGitHub github) =>
+        new(
+            github,
+            new WorkflowAnalysisService(
+                new WorkflowParser(),
+                RuleDiscovery.All(),
+                new WorkflowPatchGenerator(
+                    new WorkflowParser(),
+                    RuleDiscovery.All(),
+                    new NeverResolvesActionReferenceResolver(),
+                    new GitHubOptions())),
+            new MemoryCache(new MemoryCacheOptions()),
+            TimeProvider.System,
+            NullLogger<PublicRepositoryScanner>.Instance);
+
+    private sealed class NeverResolvesActionReferenceResolver : IWorkflowActionReferenceResolver
+    {
+        public Task<ActionReferenceResolutionResult> ResolveAsync(
+            string actionReference,
+            CancellationToken cancellationToken) =>
+            Task.FromResult(new ActionReferenceResolutionResult(
+                ActionReferenceResolutionStatus.Failed,
+                null,
+                "Scanner tests do not resolve action references."));
+    }
+
+    private static string File(string name, long size, string downloadUrl) =>
+        $$"""
+        { "name": "{{name}}", "type": "file", "size": {{size}},
+          "html_url": "https://github.test/{{name}}", "download_url": "{{downloadUrl}}" }
+        """;
+
+    /// <summary>
+    /// The GitHub surface the scanner touches, faked at the HttpClient layer so the
+    /// scanner's real request pipeline — URL construction included — is what is tested.
+    /// </summary>
+    private sealed class FakeGitHub : IHttpClientFactory
+    {
+        private readonly Dictionary<string, string> _raw = [];
+        private string _listingBody = "[]";
+
+        public HttpStatusCode ListingStatus { get; set; } = HttpStatusCode.OK;
+        public string? RateLimitRemaining { get; set; }
+        public int ListingRequests { get; private set; }
+        public List<string> RawRequests { get; } = [];
+
+        public void Listing(string owner, string repository, params string[] files) =>
+            _listingBody = "[" + string.Join(",", files) + "]";
+
+        public void Raw(string url, string content) => _raw[url] = content;
+
+        public HttpClient CreateClient(string name) =>
+            new(new Handler(this)) { BaseAddress = new Uri("https://api.github.test") };
+
+        private sealed class Handler(FakeGitHub fake) : HttpMessageHandler
+        {
+            protected override Task<HttpResponseMessage> SendAsync(
+                HttpRequestMessage request,
+                CancellationToken cancellationToken)
+            {
+                string url = request.RequestUri!.ToString();
+
+                if (url.Contains("/contents/.github/workflows"))
+                {
+                    fake.ListingRequests++;
+                    HttpResponseMessage response = new(fake.ListingStatus)
+                    {
+                        Content = new StringContent(fake._listingBody, Encoding.UTF8, "application/json")
+                    };
+                    if (fake.RateLimitRemaining is not null)
+                    {
+                        response.Headers.Add("X-RateLimit-Remaining", fake.RateLimitRemaining);
+                    }
+
+                    return Task.FromResult(response);
+                }
+
+                fake.RawRequests.Add(url);
+                return Task.FromResult(fake._raw.TryGetValue(url, out string? content)
+                    ? new HttpResponseMessage(HttpStatusCode.OK) { Content = new StringContent(content) }
+                    : new HttpResponseMessage(HttpStatusCode.NotFound));
+            }
+        }
+    }
+}