git-path-audit v0.0.1

git-path-audit v0.0.1

The first public release of git-path-audit, a read-only CLI for finding Git
path names that can collide, change interpretation, mislead reviewers, or fail
to check out across Windows, macOS, and Linux.

Highlights

• Audits the complete Git index, staged destination paths, a named tree or
  revision, or arbitrary NUL-delimited raw paths from stdin.
• Detects Unicode normalization and case-fold collisions, ASCII case
  collisions, bidirectional and invisible controls, Windows-forbidden names
  and characters, trailing dots/spaces, and bounded Windows canonical
  collisions.
• Produces deterministic text, JSON, and SARIF 2.1.0 reports.
• Preserves exact path identity with raw-byte/base64 fields while safely
  escaping hostile terminal and machine-output content.
• Treats root and same-filesystem descendant invocations as the same complete
  repository scope for index, staged, and tree scans.
• Invokes Git without a shell, disables fsmonitor hooks, optional locks, and
  lazy object fetching, and isolates inherited repository-routing and pathspec
  environment state.
• Ships with cross-platform CI, race tests, fuzz tests, and a documented
  Unicode 15.0.0 behavior contract.

Install

go install github.com/bunta-expert/git-path-audit/cmd/git-path-audit@v0.0.1

Then audit the current repository:

git-path-audit scan

Because the binary follows Git's external-subcommand naming convention, this
also works when the binary directory is on PATH:

git path-audit scan

Requirements

• Go 1.25 or newer to install or build
• Git 2.45 or newer for index, staged, and tree scans

--stdin0 does not invoke Git.

Scope

This release implements a conservative portability model, not exact emulation
of every filesystem, locale, or API. It intentionally omits path-length rules,
8.3 aliases, fuzzy homoglyph detection, untracked/content scanning,
suppressions, baselines, and automatic renames. See the README and rule catalog
for the full contract and limitations.