Address bounded release audit review findings

Handle root homes, bounded blob caching, non-fetching partial clones, explicit LFS review, and classic branch protection without expanding into generalized parsing.

Author: VladimirBrejcha

public-source-release-audit/SKILL.md

@@ -31,7 +31,9 @@ The supported categories are deliberately small:
 
 Stage all intended release changes before relying on the candidate result.
 Ignored files and submodule contents are outside this check. The checker does
-not inspect Git history.
+not inspect Git history. Git LFS pointers fail the check because their external
+objects require separate review. Missing index blobs, including unavailable
+partial-clone objects, fail without network fetching.
 
 ## Semantic Review
 
@@ -52,14 +54,17 @@ gh api repos/OWNER/REPO --jq '{visibility,security_and_analysis}'
 gh ruleset check --default --repo OWNER/REPO
 gh ruleset list --repo OWNER/REPO --parents --limit 100
 gh ruleset view RULESET-ID --repo OWNER/REPO
+gh api repos/OWNER/REPO/branches/DEFAULT-BRANCH/protection
 gh api 'repos/OWNER/REPO/actions/runners?per_page=100' \
   --jq '{total_count,runners:[.runners[] | {name,status,busy}]}'
 ```
 
-Inspect applicable rulesets when necessary to confirm the required hosted
-check, update strictness, and bypass actors. If authorization cannot expose a
-setting, report it as unconfirmed. Do not weaken or mutate settings unless the
-user separately authorizes that action.
+Inspect applicable rulesets and classic branch protection when necessary to
+confirm the required hosted check, update strictness, and bypass actors. A 404
+from the classic endpoint means no classic rule is configured; it does not
+invalidate an applicable ruleset. If authorization cannot expose a setting,
+report it as unconfirmed. Do not weaken or mutate settings unless the user
+separately authorizes that action.
 
 ## Result
 

public-source-release-audit/scripts/check_current_source.rb

@@ -7,7 +7,7 @@
 RULES = [
   [
     "machine-local home path",
-    %r{(?:\A|[\s"'`=:(,])/(?:Users|home)/[A-Za-z0-9._-]+(?:/|\b)|\b[A-Za-z]:[\\/]Users[\\/][^\\/\r\n]+(?:[\\/]|$)}
+    %r{(?:\A|[\s"'`=:(,])(?:/(?:Users|home)/[A-Za-z0-9._-]+(?:/|\b)|/root(?:/|(?![A-Za-z0-9._-])))|\b[A-Za-z]:[\\/]Users[\\/][^\\/\r\n]+(?:[\\/]|$)}
   ],
   ["AWS access key", /\b(?:AKIA|ASIA)[0-9A-Z]{16}\b/],
   ["bearer credential", /Authorization\s*:\s*Bearer\s+[A-Za-z0-9._~+\/=:-]{16,}/i],
@@ -23,11 +23,13 @@
 ].freeze
 
 INDEX_BLOB_MODES = %w[100644 100755 120000].freeze
+LFS_POINTER = %r{\Aversion https://git-lfs\.github\.com/spec/v1(?:\r?\n|\z)}.freeze
 GIT_ENVIRONMENT = {
   "GIT_ALTERNATE_OBJECT_DIRECTORIES" => nil,
   "GIT_COMMON_DIR" => nil,
   "GIT_DIR" => nil,
   "GIT_INDEX_FILE" => nil,
+  "GIT_NO_LAZY_FETCH" => "1",
   "GIT_NO_REPLACE_OBJECTS" => "1",
   "GIT_OBJECT_DIRECTORY" => nil,
   "GIT_WORK_TREE" => nil
@@ -43,16 +45,27 @@ def git_capture(repo, *arguments)
   Open3.capture3(GIT_ENVIRONMENT, "git", "-C", repo, *arguments)
 end
 
-def scan_source(content, relative_path, findings, sensitive_paths = nil)
+def matching_labels(content)
   source = content.b
-  RULES.each do |label, pattern|
-    next unless pattern.match?(source)
+  RULES.filter_map { |label, pattern| label if pattern.match?(source) }
+end
 
+def record_findings(labels, relative_path, findings, sensitive_paths = nil)
+  labels.each do |label|
     findings.add([relative_path, label])
     sensitive_paths&.add(relative_path)
   end
 end
 
+def scan_source(content, relative_path, findings, sensitive_paths = nil)
+  record_findings(
+    matching_labels(content),
+    relative_path,
+    findings,
+    sensitive_paths
+  )
+end
+
 def display_path(relative_path, sensitive_paths)
   sensitive_paths.include?(relative_path) ? "<redacted path>" : relative_path.dump
 end
@@ -72,7 +85,7 @@ def display_path(relative_path, sensitive_paths)
 errors = Set.new
 findings = Set.new
 sensitive_paths = Set.new
-blob_cache = {}
+blob_result_cache = {}
 index_entries = index_output.split("\0").reject(&:empty?).filter_map do |record|
   metadata, relative_path = record.split("\t", 2)
   mode, object_id, stage = metadata&.split(" ", 3)
@@ -100,8 +113,8 @@ def display_path(relative_path, sensitive_paths)
   end
 
   object_id = entry.fetch(:object_id)
-  content = blob_cache[object_id]
-  unless content
+  result = blob_result_cache[object_id]
+  unless result
     content, _blob_error, blob_status = git_capture(
       repo,
       "cat-file",
@@ -112,9 +125,16 @@ def display_path(relative_path, sensitive_paths)
       errors.add([relative_path, "unable to read Git index blob"])
       next
     end
-    blob_cache[object_id] = content
+    result = {
+      labels: matching_labels(content),
+      lfs_pointer: LFS_POINTER.match?(content.b)
+    }
+    blob_result_cache[object_id] = result
+  end
+  if result.fetch(:lfs_pointer)
+    errors.add([relative_path, "Git LFS object requires separate review"])
   end
-  scan_source(content, relative_path, findings)
+  record_findings(result.fetch(:labels), relative_path, findings)
 end
 
 worktree_output, _worktree_error, worktree_status = git_capture(

public-source-release-audit/tests/test_check_current_source.rb

@@ -123,6 +123,7 @@ def test_supported_high_confidence_formats_are_detected_and_redacted
         "openai.txt" => "s" + "k-proj-" + ("D" * 24),
         "private-key.txt" => "-----BEGIN " + "OPENSSH PRIVATE KEY-----",
         "posix-home.txt" => "/" + "Users/example/private.txt",
+        "root-home.txt" => "/" + "root/.ssh/id_ed25519",
         "windows-home.txt" => "C:" + "\\Users\\example\\private.txt"
       }
       fixtures.each { |path, content| stage(repo, path, content) }
@@ -186,6 +187,72 @@ def test_unrelated_home_directory_and_web_route_do_not_match_user_homes
     end
   end
 
+  def test_duplicate_index_blobs_report_each_candidate_path
+    with_repo do |repo|
+      token = github_token
+      stage(repo, "first.txt", token)
+      stage(repo, "second.txt", token)
+
+      _stdout, stderr, status = run_checker(repo)
+
+      refute status.success?
+      assert_includes stderr, "first.txt"
+      assert_includes stderr, "second.txt"
+      assert_includes stderr, "GitHub token"
+      refute_includes stderr, token
+    end
+  end
+
+  def test_git_commands_disable_lazy_object_fetching
+    with_repo do |repo|
+      stage(repo, "README.md", "Public documentation without credentials.\n")
+      real_git = ENV.fetch("PATH").split(File::PATH_SEPARATOR).filter_map do |dir|
+        candidate = File.join(dir, "git")
+        candidate if File.executable?(candidate)
+      end.first
+      refute_nil real_git
+
+      Dir.mktmpdir("public-source-check-bin-") do |bin_dir|
+        fake_git = File.join(bin_dir, "git")
+        File.write(fake_git, <<~RUBY)
+          #!/usr/bin/env ruby
+          abort "lazy fetching was not disabled" unless ENV["GIT_NO_LAZY_FETCH"] == "1"
+          exec #{real_git.dump}, *ARGV
+        RUBY
+        FileUtils.chmod(0o755, fake_git)
+
+        stdout, stderr, status = run_checker(
+          repo,
+          {
+            "GIT_NO_LAZY_FETCH" => "0",
+            "PATH" => [bin_dir, ENV.fetch("PATH")].join(File::PATH_SEPARATOR)
+          }
+        )
+
+        assert status.success?, stderr
+        assert_includes stdout, "current public-source check passed"
+      end
+    end
+  end
+
+  def test_git_lfs_pointer_requires_separate_review
+    with_repo do |repo|
+      pointer = [
+        "version https://git-lfs.github.com/spec/v1",
+        "oid sha256:#{'a' * 64}",
+        "size 123"
+      ].join("\n") + "\n"
+      stage(repo, "large.dat", pointer)
+
+      _stdout, stderr, status = run_checker(repo)
+
+      refute status.success?
+      assert_includes stderr, "large.dat"
+      assert_includes stderr, "Git LFS object requires separate review"
+      refute_includes stderr, "sha256:"
+    end
+  end
+
   def test_unresolved_index_entries_fail_closed
     with_repo do |repo|
       object_ids = %w[base ours theirs].map do |content|