GitGalaxy Scanner

Version updated for https://github.com/squid-protocol/gitgalaxy to version v2.3.0.

  • This action is used across all versions by 0 repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

What’s Changed

This release represents a massive architectural maturation for GitGalaxy. The primary focus of v2.3.0 is the total alignment of the core parsing engine with formal, enterprise-grade DevSecOps terminology, alongside a complete overhaul of the CI/CD ingestion pipelines for air-gapped resilience and absolute data provenance.

Furthermore, we have upgraded key risk exposures from flat heuristics to N-Dimensional physics equations, vastly improving the precision of the engine. All structural changes in this release were subjected to a Full Differential Scan against our 80-repo calibrated baseline to mathematically guarantee zero regressions in accuracy or speed.

🚀 Major Features & Architectural Upgrades

  • The DevSecOps Terminology Overhaul: The entire core engine, including the 5-tier optical extraction pipelines (prism.py) and security sensors (ai_appsec_sensor.py, security_lens.py), has been refactored to use formal industry terminology (e.g., SAST, RCE Funnels, Taint Tracking). Legacy Sci-Fi terminology has been deprecated in favor of explicit architectural mapping.
  • Zero-Trust Licensing & Environmental Friction: Deployed aggressive Commercial Licensing guardrails (PolyForm Noncommercial 1.0.0). Unverified pipelines now face environmental friction traps and RSA validation checks, ensuring the engine cannot be silently deployed in unauthorized enterprise environments.
  • The Muninn Security Gauntlet: Integrated Muninn (v0.3.4) and Poutine for rigorous internal AppSec scanning. Sealed multiple O(N^2) ReDoS vulnerabilities discovered in our C/C++ regex definitions, uploaded SARIF reports for strict vulnerability gating, and suppressed CI log-scraping vectors to protect output telemetry.

🧮 Mathematical Upgrades (The Physics Engine)

  • Algorithmic DoS Vector (Big-O Detection): Upgraded algorithmic complexity scanning. We abandoned flat heuristics and introduced an N-Dimensional physics equation that correlates the mathematical depth of a loop (e.g., O(N^3)) with its “Data Gravity” (DB complexity) and “Choke Points” (Public APIs) to detect weaponizable performance bottlenecks.
  • N-Dimensional Verification Risk (Test Coverage): Integrated the Asymptotic Dampener and Opacity Tax. The engine now applies structural cross-file test tethers to prove that defensive mass accurately shields vulnerable execution paths.
  • GuideStar Documentation Umbrellas: Upgraded the Documentation Risk equation to project “GuideStar Umbrellas,” factoring in markdown instructional density and instructional multipliers, rather than just counting docstrings.

🛡️ CI/CD & Pipeline Resilience

  • The Dynamic Golden Crucible: Completely rebuilt the test architecture. Deprecated static fixtures in favor of a dynamic language-crucible ingestion pipeline. The workflow now strictly enforces a Golden Master baseline file against a locked matrix of test targets.
  • Deep GitHub Actions Hardening: Pinned all third-party actions to strict commit SHAs, established explicit workflow permissions, fixed template injection vectors in action.yml, and resolved zizmor cache-poisoning flags. Upgraded core workflow environments to actions/checkout@v7.0.0 and actions/setup-python@v6.2.0.
  • Native Air-Gapped Checkout: Replaced actions/checkout with native, scope-stripped git clone protocols to bypass scoped token auth bugs, eliminate credential persistence, and ensure perfect execution on underpowered or restricted GitHub Runners.
  • Supply Chain RAM-Firewall: Upgraded the Supply Chain firewall to a RAM-exclusive architecture and deployed the formal ManifestParser for deep dependency-spoofing detection.

🧹 Chore & Dependency Management

  • Visual Observatory Validation: Verified that all JSON payload updates successfully render within the Airgap Observatory and GitGalaxy.io without breaking flexbox constraints or 3D WebGL rendering.
  • Stable Documentation: Pinned mkdocs to <2.0 to protect the newly deployed topological web architecture from upstream material theme breakages.
  • Dependency Bumps: Massive, repo-wide dependency resolution via Dependabot, bringing flask, cryptography, werkzeug, and data-science libraries (xgboost, plotly, umap-learn, matplotlib-inline, tqdm) to their latest secure versions.

🏆 Community Shoutouts

A massive thank you to our first community contributor, @sg0nzalez (Santiago González), for architecting and deploying the Muninn security scanning gauntlet across the GitGalaxy pipeline. Your work on PRs #71 and #95 fundamentally hardened our CI/CD workflows and helped seal critical ReDoS vulnerabilities. Thank you for elevating the security posture of the blAST engine!