Enforce whole-worktree non-mutating audit

Normalize subdirectory inputs, suppress repository fsmonitor hooks, and encode the classic-protection branch parameter without adding broader policy analysis.

Author: VladimirBrejcha

public-source-release-audit/SKILL.md

@@ -56,7 +56,11 @@ gh api repos/OWNER/REPO --jq '{visibility,security_and_analysis}'
 gh ruleset check --default --repo OWNER/REPO
 gh ruleset list --repo OWNER/REPO --parents --limit 100
 gh ruleset view RULESET-ID --repo OWNER/REPO
-gh api repos/OWNER/REPO/branches/DEFAULT-BRANCH/protection
+default_branch="$(gh repo view OWNER/REPO --json defaultBranchRef \
+  --jq '.defaultBranchRef.name')"
+encoded_branch="$(ruby -rerb -e \
+  'print ERB::Util.url_encode(ARGV.fetch(0))' "$default_branch")"
+gh api "repos/OWNER/REPO/branches/${encoded_branch}/protection"
 gh api 'repos/OWNER/REPO/actions/runners?per_page=100' \
   --jq '{total_count,runners:[.runners[] | {name,status,busy}]}'
 ```

public-source-release-audit/scripts/check_current_source.rb

@@ -42,7 +42,15 @@ def usage(message = nil)
 end
 
 def git_capture(repo, *arguments)
-  Open3.capture3(GIT_ENVIRONMENT, "git", "-C", repo, *arguments)
+  Open3.capture3(
+    GIT_ENVIRONMENT,
+    "git",
+    "-C",
+    repo,
+    "-c",
+    "core.fsmonitor=false",
+    *arguments
+  )
 end
 
 def matching_labels(content)
@@ -82,13 +90,22 @@ def symlinked_parent?(repo, relative_path)
 repo = File.expand_path(ARGV.first || ".")
 usage("Repository must be a directory") unless File.directory?(repo)
 
+toplevel_output, _toplevel_error, toplevel_status = git_capture(
+  repo,
+  "rev-parse",
+  "--show-toplevel"
+)
+usage("Repository must be a Git worktree") unless toplevel_status.success?
+repo = toplevel_output.b.sub(/\r?\n\z/, "".b)
+usage("Unable to resolve Git worktree root") unless File.directory?(repo)
+
 index_output, _index_error, index_status = git_capture(
   repo,
   "ls-files",
   "--stage",
   "-z"
 )
-usage("Repository must be a Git worktree") unless index_status.success?
+usage("Unable to enumerate Git index") unless index_status.success?
 
 errors = Set.new
 findings = Set.new

public-source-release-audit/tests/test_check_current_source.rb

@@ -60,6 +60,22 @@ def test_staged_credential_cannot_be_hidden_by_clean_worktree_replacement
     end
   end
 
+  def test_subdirectory_argument_still_scans_the_complete_worktree
+    with_repo do |repo|
+      token = github_token
+      stage(repo, "root-secret.txt", token)
+      child = File.join(repo, "child")
+      FileUtils.mkdir_p(child)
+
+      _stdout, stderr, status = run_checker(child)
+
+      refute status.success?
+      assert_includes stderr, "root-secret.txt"
+      assert_includes stderr, "GitHub token"
+      refute_includes stderr, token
+    end
+  end
+
   def test_unstaged_credential_is_checked_before_it_can_be_added
     with_repo do |repo|
       token = github_token
@@ -266,6 +282,48 @@ def test_git_commands_disable_lazy_object_fetching
     end
   end
 
+  def test_repository_fsmonitor_hook_is_disabled
+    with_repo do |repo|
+      stage(repo, "README.md", "Public documentation without credentials.\n")
+      hook = File.join(repo, "fsmonitor-hook")
+      marker = File.join(repo, "fsmonitor-ran")
+      File.write(hook, <<~'SH')
+        #!/bin/sh
+        printf 'ran\n' > "$FSMONITOR_MARKER"
+      SH
+      FileUtils.chmod(0o755, hook)
+      system(
+        "git",
+        "-C",
+        repo,
+        "config",
+        "core.fsmonitor",
+        hook,
+        exception: true
+      )
+
+      _output, error, status = Open3.capture3(
+        { "FSMONITOR_MARKER" => marker },
+        "git",
+        "-C",
+        repo,
+        "ls-files"
+      )
+      assert status.success?, error
+      assert File.exist?(marker), "fsmonitor fixture did not execute"
+      FileUtils.rm(marker)
+
+      stdout, stderr, checker_status = run_checker(
+        repo,
+        { "FSMONITOR_MARKER" => marker }
+      )
+
+      assert checker_status.success?, stderr
+      assert_includes stdout, "current public-source check passed"
+      refute File.exist?(marker), "checker executed the repository fsmonitor hook"
+    end
+  end
+
   def test_non_utf8_git_paths_are_scanned_without_crashing
     with_repo do |repo|
       token = github_token
@@ -275,7 +333,10 @@ def test_non_utf8_git_paths_are_scanned_without_crashing
           #!/usr/bin/env ruby
           STDOUT.binmode
           path = "raw-\xFF.txt".b
-          if ARGV.include?("--stage")
+          if ARGV.include?("rev-parse")
+            repo_index = ARGV.index("-C") + 1
+            STDOUT.write(ARGV.fetch(repo_index) + "\n")
+          elsif ARGV.include?("--stage")
             STDOUT.write("100644 #{'a' * 40} 0\t".b + path + "\0".b)
           elsif ARGV.include?("cat-file")
             STDOUT.write("gh" + "p_" + ("A" * 24))