feat: full scan mode, init command, 18 gates, and 100% test coverage by sadayamuthu · Pull Request #4 · sadayamuthu/controlgate

sadayamuthu · 2026-02-28T20:02:18Z

Summary

Full scan mode (--mode full): scans entire repo via git ls-files with extension/skip-dir/binary filtering
controlgate init command: interactive bootstrap for .controlgate.yml, pre-commit, and CI/CD configs
10 new security gates (9–18): deps, api, privacy, resilience, incident, observability, memsafe, license, aiml, container
100% test coverage enforced (277 tests, 0 missing lines)

Test plan

pytest --cov=controlgate reports 100% coverage
All pre-commit hooks pass (ruff, mypy)
Full scan detects secrets and passes on clean code
Init command creates expected files and respects --no-docs / CI flags

…incident, observability, memsafe, license, aiml, container) Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

…per-commit) Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

…er detection in DepsGate Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Implements APIGate with pattern-based detection of insecure API patterns: TLS verification disabled, wildcard CORS origins, API credentials in query params, credentialed CORS headers, and GraphQL introspection enabled. Wires gate into GATE_CONTROL_MAP (SC-8, AC-3, SC-5, SI-10) and ALL_GATES. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

…eclarations in APIGate

…SI-13)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

…39/AC-6/SI-7) Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

…n debt Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

… (MemSafeGate)

…Gate) Also fix pre-existing mypy import-not-found errors across all test gate files by setting ignore_missing_imports = true in [tool.mypy]; the controlgate package is installed in editable mode for pytest but not in the isolated pre-commit mypy environment. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

…mentation.md)

…les)

…ence

…erence

…rence

…eference

…erence

…ence

…rence

Captures approved design for: - controlgate scan --mode full (synthetic DiffFile approach, directory walk with git ls-files fallback) - controlgate init (interactive bootstrap: .controlgate.yml, .pre-commit-config.yaml, CONTROLGATE.md, GitHub/GitLab/Bitbucket CI templates) Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

7-task TDD plan covering: - Task 1: full_scan config fields - Task 2: _get_full_files() with git ls-files + fallback walk - Task 3: --mode full wired into scan_command + parser - Task 4: init_command.py with all 6 file templates - Task 5: init subcommand wired into CLI - Task 6: README + docs updates (8 → 18 gates) - Task 7: final validation Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

## Changes ### .controlgate.yml - Renamed `input` gate to `input_validation` for consistency with gate module naming - Renamed `change` gate to `change_control` for consistency with gate module naming - Added 10 new security gates, all enabled with `action: warn` by default: - `deps` – Dependency integrity and supply chain checks - `api` – API security (CORS, TLS verification, key exposure) - `privacy` – PII handling, data retention, and serialization checks - `resilience` – Deletion protection, retry logic, and snapshot policies - `incident` – Error suppression, silent catch blocks, traceback exposure - `observability` – Monitoring flags, log drivers, and liveness probes - `memsafe` – Unsafe memory ops, eval/exec, C FFI patterns - `license` – Copyleft license detection in dependencies and source - `aiml` – AI/ML model loading safety and prompt injection patterns - `container` – Container privilege escalation and image hygiene ### CHANGELOG.md - Added unreleased entry documenting the expansion to 18 gates Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Auto-formatted with `ruff format` to fix CI lint failures: - src/controlgate/gates/deps_gate.py - tests/test_gates/test_deps_gate.py - tests/test_gates/test_incident_gate.py - tests/test_gates/test_privacy_gate.py - tests/test_gates/test_resilience_gate.py No logic changes — whitespace and line-length fixes only. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Add 8 targeted tests covering the 12 previously uncovered lines: - _get_full_files: except ValueError (path outside root), OSError on read_bytes, and OSError on read_text - scan_command: else branch when _get_diff returns non-empty content - init_command: invalid baseline fallback, _prompt_yn empty-input default, and _prompt without a default value Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Implements bump_version.py in hooks/ with TDD: tests written first, confirmed failing, then implementation added to achieve 100% coverage. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

sadayamuthu and others added 30 commits February 27, 2026 00:17

docs: add design doc for gates 9-18 (deps, api, privacy, resilience, …

0824191

…incident, observability, memsafe, license, aiml, container) Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

docs: add implementation plan for gates 9-18 (10 new gates, TDD, one-…

8ae9abd

…per-commit) Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

feat: add Gate 9 — Dependency Vulnerability gate (deps, RA-5/SI-2/SA-12)

4c04200

fix: scope --no-verify pattern to package managers, add range specifi…

4f6d9a2

…er detection in DepsGate Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

fix: add missing GraphQL introspection test, remove dead SC-5/SI-10 d…

23baf6d

…eclarations in APIGate

feat: add Gate 11 — Data Privacy gate (privacy, PT-2/PT-3/SC-28)

768d64f

feat: add Gate 12 — Resilience & Backup gate (resilience, CP-9/CP-10/…

f7e2b59

…SI-13)

feat: add Gate 13 — Incident Response gate (incident, IR-4/IR-6/AU-6)

e016fb7

feat: add Gate 14 — Observability gate (observability, SI-4/AU-12)

8965fae

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

feat: add Gate 15 — Memory Safety gate (memsafe, SI-16/CM-7)

227d2d0

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

feat: add Gate 16 — License Compliance gate (license, SA-4/SR-3)

3c80867

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

feat: add Gate 17 — AI/ML Security gate (aiml, SI-10/SC-28/SR-3)

8554375

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

feat: add Gate 18 — Container Security gate (container, CM-7/SC-7/SC-…

56a987a

…39/AC-6/SI-7) Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

docs: add gate gap analysis — 3 bugs to fix, 4 items deferred as know…

54771a2

…n debt Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

docs: add implementation plan for gate gap fixes (3 tasks)

cad0ce5

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

fix: add SC-5 and SI-10 to APIGate control map (align with design)

154ea92

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

feat: add cffi memory operation detection to MemSafeGate (SI-16)

00af207

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

fix: add word-boundary guard to cffi pattern; add false-positive test…

55206cd

… (MemSafeGate)

feat: add plaintext model weights detection to AIMLGate (SC-28)

d840dc1

docs: mark gap analysis complete — all Approach A fixes applied

d8bc672

docs: add per-gate documentation design (18 gates × design.md + imple…

0bd89ff

…mentation.md)

docs: add per-gate documentation implementation plan (19 tasks, 36 fi…

392babc

…les)

docs: add Gate 1 — Secrets design and implementation reference

99c09e9

docs: fix Gate 1 test coverage table and entropy description

aebcffe

docs: add Gate 2 — Cryptography & TLS design and implementation refer…

591a453

…ence

docs: add Gate 3 — IAM & Access Control design and implementation ref…

97b580d

…erence

docs: add Gate 4 — Supply Chain & SBOM design and implementation refe…

c75cdae

…rence

docs: add Gate 5 — Infrastructure-as-Code design and implementation r…

e53bdcd

…eference

sadayamuthu and others added 29 commits February 27, 2026 17:05

docs: add Gate 10 — API Security design and implementation reference

cdc832f

docs: add Gate 11 — Data Privacy design and implementation reference

0d3806c

docs: add Gate 12 — Resilience & Backup design and implementation ref…

e835af2

…erence

docs: add Gate 13 — Incident Response design and implementation refer…

85386ee

…ence

docs: add Gate 14 — Observability design and implementation reference

8755b39

docs: add Gate 15 — Memory Safety design and implementation reference

c25cc3d

docs: add Gate 16 — License Compliance design and implementation refe…

b9cb0d1

…rence

docs: add Gate 18 — Container Security design and implementation refe…

ee2f389

…rence

feat: add full_scan config fields (extensions, skip_dirs)

d3b5396

fix: sync full_scan_skip_dirs default_factory with _DEFAULT_CONFIG

0a2ece8

test: add module docstring to test_config.py

2102b85

feat: add _get_full_files() for full-repo scan mode

a4b4d54

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

fix: use fnmatch for skip_dirs in _get_full_files, add glob pattern test

9245126

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

feat: add controlgate scan --mode full with --path option

9acb058

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

feat: add init_command with templates for all generated files

9a4b0ee

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

fix: add catalog comment to template, add GitLab/Bitbucket tests

219f160

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

feat: wire controlgate init subcommand into CLI

1da01fe

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

docs: update README for 18 gates, full scan mode, and init command

c0981a6

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

docs: add auto version bump pre-commit hook design

64532d2

docs: add auto version bump implementation plan

b67331e

feat: add auto-bump minor version pre-commit hook

6a5b85e

Implements bump_version.py in hooks/ with TDD: tests written first, confirmed failing, then implementation added to achieve 100% coverage. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

fix: address code review issues in bump_version hook

054f07d

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

chore: register bump-version as a local pre-commit hook

000ae61

fix: scope bump-version hook to pre-commit stage only

ce427ea

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

sadayamuthu merged commit b319510 into main Feb 28, 2026
12 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat: full scan mode, init command, 18 gates, and 100% test coverage #4

feat: full scan mode, init command, 18 gates, and 100% test coverage #4
sadayamuthu merged 72 commits into
mainfrom
develop

sadayamuthu commented Feb 28, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

sadayamuthu commented Feb 28, 2026

Summary

Test plan

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant