Skip to content

ClonePeek v0.5.1 — Safer reports & JSON Schema v1

Latest
Latest

Choose a tag to compare

View all tags
@harshitethic harshitethic released this 16 Oct 03:13
v0.5.1
01161b9
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

ClonePeek v0.5.1 is a maintenance release for the passive repository execution-surface scanner and reusable GitHub Action.

Improvements

  • Safer evidence output: best-effort masking for common credential-bearing CLI options (including separate argument values), quoted assignments and HTTP Bearer authorization headers. Added redaction regressions for text, JSON and SARIF reports. The masking is NOT comprehensive: review reports for sensitive source data before sharing.
  • Versioned JSON contract: published JSON Schema draft 2020-12 and an inert example. It describes required scan/finding fields and allows additive optional properties. The scanner version and schema version are separate. Valid JSON does NOT establish that a repository is safe.
  • Packaging and documentation: updated pinned usage examples and release metadata, synchronized version checks, and included documentation, scanner demo fixtures and the GitHub Action adapter in the source distribution.
  • Testing: 74 automated tests; hosted Linux, macOS and Windows Python CI and reusable GitHub Action jobs passed before release.

Install or run

Local CLI (requires Python 3.10+ and uv):

uvx --from git+https://github.com/harshitethic/clonepeek@v0.5.1 clonepeek /path/to/repo

GitHub Action (place in a workflow following actions/checkout):

- uses: harshitethic/clonepeek@v0.5.1
  with:
    path: .
    fail-on: none

The scanner does not execute the target repository's scripts; downloading the CLI or GitHub Action does use network access. This is a limited, heuristic review aid, not malware detection or a guarantee of safety.

JSON Schema: https://harshitethic.github.io/clonepeek/schema/scan-report-v1.schema.json
GitHub Action guide: https://github.com/harshitethic/clonepeek/blob/main/docs/GITHUB-ACTION.md
Threat model: https://github.com/harshitethic/clonepeek/blob/main/docs/THREAT_MODEL.md

The release includes an installable Python wheel and reproducible source archive. GitHub Marketplace listing is separate from this public GitHub release, and no independent user adoption is claimed.

Assets 4
Loading