Skip to content

ClonePeek v0.5.0 — Reusable GitHub Action

Choose a tag to compare

View all tags
@harshitethic harshitethic released this 15 Oct 09:45
· 28 commits to main since this release
v0.5.0
65adee2
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

ClonePeek v0.5.0 — reusable GitHub Action

ClonePeek is an offline, read-only execution-surface inventory for unfamiliar repositories. It examines modeled npm lifecycle scripts, VS Code folder-open tasks, devcontainers, Claude Code and Cursor hooks, MCP process configs, and bounded explicit local shell-script references. It does not execute repository code or prove that a repository is safe.

New: use ClonePeek directly in GitHub Actions

- uses: actions/checkout@v4
  with:
    fetch-depth: 0
- uses: harshitethic/clonepeek@v0.5.0
  with:
    path: .
    fail-on: high
    format: sarif
    output: clonepeek.sarif

The composite action runs the scanner from the separate, versioned action checkout, using Python's standard library. It does not install dependencies from the repository being scanned. The workflow may fetch a Python runtime through GitHub's setup-python action; the scan itself makes no network requests.

Action capabilities

  • Report-only by default (fail-on: none); optional low, medium, high, or critical threshold.
  • Optional changed-since Git ref and reviewed fingerprint baseline.
  • Text, JSON, and SARIF reports; optional private output file instead of full console report.
  • Machine-readable finding counts and a GitHub job summary with counts only.
  • Runnable on Windows, macOS, and Linux.

Verification

  • 64 passing Python unit tests.
  • Separate reusable-action GitHub CI smoke tests pass on Ubuntu, macOS, and Windows.
  • 6/6 unit-test CI jobs pass across operating systems and Python 3.10/3.13.
  • Wheel and source distribution builds verified.
  • The 51-fixture synthetic evaluation is not a representative estimate of security detection accuracy. Known false positives and misses remain documented.

Try the CLI directly

uvx --from git+https://github.com/harshitethic/clonepeek@v0.5.0 clonepeek /path/to/repo

See the GitHub Action guide, limitations and threat model, and community discussions. Contributions with harmless, redacted reproducible examples are welcome.

Important: A finding is a review prompt, not a malware verdict. Reports may include sensitive source excerpts; review them before making artifacts public.

Assets 4
Loading