Skip to content

feat: transactional publish, JSON reports and composable hooks #3

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
megamen32 wants to merge 1 commit into from
Closed

feat: transactional publish, JSON reports and composable hooks #3

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
15 changes: 15 additions & 0 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -254,3 +254,18 @@ git-private2public doctor
the pre-push hook, and source/target remote access. Secret findings are always
redacted and shown as type + location + safe prefix/suffix hint + length + short SHA-256 fingerprint; the
matched credential itself is never printed.

### Safe publication transactions

`publish` records the current target branch SHA before sanitizing and uses an
explicit `--force-with-lease` tied to that SHA. If somebody updates the public
branch while the private history is being cleaned, publication stops instead
of overwriting their work. After a successful push, the remote SHA is verified.
Targets under 100 MiB are cloned and scanned again automatically; larger repos
skip the extra clone but still receive SHA verification. Existing tags are
never force-overwritten.

For CI, `scan`, `publish --scan`, and `guard run` support `--format json`.

The managed pre-push dispatcher can run both guard and auto-publish while
preserving and chaining an existing user hook.
15 changes: 15 additions & 0 deletions README.ru.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -254,3 +254,18 @@ git-private2public doctor
файлы правил, pre-push hook и доступ к source/target. Найденные секреты всегда
редактируются: выводятся только тип, расположение, безопасная подсказка из префикса/последних 4 символов, длина и короткий SHA-256,
само значение учётных данных в отчёт не попадает.

### Безопасная транзакция публикации

`publish` запоминает SHA целевой ветки до очистки и использует точный
`--force-with-lease`. Если во время обработки кто-то обновил публичную ветку,
публикация остановится и не затрёт чужие изменения. После push проверяется SHA
на сервере. Репозитории меньше 100 МиБ автоматически клонируются и сканируются
повторно; для больших выполняется проверка SHA без дополнительного клона.
Существующие теги никогда не перезаписываются принудительно.

Для CI команды `scan`, `publish --scan` и `guard run` поддерживают
`--format json`.

Управляемый pre-push dispatcher умеет одновременно запускать guard и
автопубликацию, сохраняя и вызывая уже существующий пользовательский hook.
Loading
Loading