Release v0.5.4 - #11
Merged
Merged
Conversation
The gitleaks release tarball has all files at the archive root (no top-level directory). node-tar's strip:1 reduces single-component paths to empty strings; the filter never matches "gitleaks" so the binary is skipped entirely, leaving only LICENSE/README.md. Node: remove strip:1 from extractTarball — the basename filter alone correctly selects the binary and excludes packaging extras. Python: make filter="data" conditional on Python >= 3.12; the parameter didn't exist before 3.12 and raises TypeError on older runtimes. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Windows zip extraction (Node + Python): - Node: PowerShell Expand-Archive, copies binary from temp dir - Python: built-in zipfile module with rglob binary search - Removes NotImplementedError / "coming soon" stubs rafter agent init --update: - Forces gitleaks re-download even if already installed - Skips PATH check (downloads fresh managed binary) - Leaves config and risk level untouched rafter agent update-gitleaks [--version X.Y.Z]: - New subcommand to reinstall or upgrade the managed binary - Shows current version before updating - Node + Python parity BinaryManager refactor (both sides): - downloadGitleaks() accepts optional version param (default: bundled) - GITLEAKS_VERSION exported from Node module - getDownloadUrl() passes version through Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- rafter agent install-hook --push: installs pre-push hook that scans commits being pushed via --diff, blocking pushes with secrets - rafter agent baseline create/show/clear/add: manage a findings allowlist at ~/.rafter/baseline.json for known/accepted findings - rafter agent scan --baseline: filter findings against saved baseline - Node + Python parity across all three features - 19 new Python tests, 12 new Node tests (214 Python / 104 Node total) Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
The "Check version not already published" step in validate-release.yml false-positives after a version is released to npm. Since v0.5.3 is now published, this step blocks all subsequent PRs to prod and pushes to main. The version-match and CHANGELOG checks remain intact. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
…force-if-includes, and +refspec Updated HIGH_PATTERNS and DEFAULT_REQUIRE_APPROVAL in both Node (risk-rules.ts) and Python (risk_rules.py) with identical coverage. Patterns now detect flags in any position (e.g., git push origin --force). Added 22 tests per language covering all variants and false positive checks. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Add notification support to audit logger. Config keys: - agent.notifications.webhook (URL) - agent.notifications.minRiskLevel (high/critical) When an event at or above minRiskLevel is logged, POST JSON payload to webhook URL. Payload includes event, risk, command, timestamp, agent fields plus text/content fields for Slack/Discord compatibility. Fire-and-forget with 5s timeout. Both Node and Python implementations. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
…s, tests Recovered and integrated work from 8 zombie polecat branches: - audit-skill: file-not-found exits 2 (was 1); JSON path exits 0/1 correctly - scan: SARIF schema URL → json.schemastore.org; add tool.driver.version; reject invalid --format with exit 2; fix force-push patterns to match flags after remote (git push origin --force) and combined flags (git push -vf) - completion.ts: expanded zsh + fish completions (was bash-only); includes baseline, update-gitleaks, status subcommands - risk rules (Node + Python): 4 patterns replace 3, now matching all variants: --force/-f anywhere after push, combined flags, --force-with-lease/if-includes, +refspec - Tests: binary-manager, scan-sarif, risk-rules (Node); audit-skill exit contract (Python) Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Bump node/package.json, python/pyproject.toml, node/src/index.ts to 0.5.5. Add CHANGELOG entry covering pre-push hook, baseline management, webhook notifications, expanded completions, force-push detection, SARIF fixes, and audit-skill exit code contracts. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Raftersecurity
self-requested a review
February 23, 2026 02:45
Raftersecurity
approved these changes
Feb 23, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
strip:1caused the binary to be skipped; onlyLICENSE/README.mdlanded in~/.rafter/bin/)filter="data"TypeError on Python < 3.12Expand-Archive) and Python (zipfile) now work; removes allNotImplementedErrorstubsrafter agent init --update— force-reinstall gitleaks and hooks without resetting configrafter agent update-gitleaks [--version X.Y.Z]— standalone binary management command (Node + Python parity)Test plan
npm test— 92 Node tests passpython -m pytest— 195 Python tests passrafter agent initon a clean machine installs gitleaks binary correctlyrafter agent update-gitleaksreinstalls binary and reports versionrafter agent init --updatere-downloads binary, leaves config intactrafter --versionreturns0.5.4🤖 Generated with Claude Code