feat: add dependency catalog, enhance install scripts, and improve modules #17
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,87 @@ | ||
| --- | ||
| name: git-cross-env-divergence | ||
| description: Diagnose and resolve git pull/rebase failures caused by uncommitted local work that overlaps or duplicates work already pushed from another environment (e.g. WSL2 vs Windows clones of the same repo). | ||
| source: auto-skill | ||
| extracted_at: '2026-08-17T21:42:19.793Z' | ||
| --- | ||
|
|
||
| # Git cross-environment divergence (WSL2 ↔ Windows) | ||
|
|
||
| Use this when `git pull --rebase` (or VS Code's Sync) fails with | ||
| `cannot pull with rebase: You have unstaged changes`, and the user suspects a | ||
| dual-environment (e.g. WSL2 Ubuntu + Windows) repo split. | ||
|
|
||
| ## Symptom signature | ||
|
|
||
| - `git pull --tags -r origin main` → `error: cannot pull with rebase: You have unstaged changes.` | ||
| - Root cause is almost always: the *other* environment pushed N commits to | ||
| `origin` while *this* clone has uncommitted work on the same files. | ||
|
|
||
| ## Diagnose before acting (don't stash blindly) | ||
|
|
||
| 1. `git status` — look for the two-part signature: branch is **behind | ||
| `origin/main` by N commits** *and* has uncommitted changes. Both together = | ||
| the classic dual-environment divergence. | ||
| 2. `git rev-parse --show-toplevel` — confirm which working tree you're in | ||
| (`D:/...` = Windows, `/mnt/d/...` or `~/...` = WSL2 clone). | ||
| 3. Detect overlap between local work and the incoming commits: | ||
| - `git log --oneline <local-head>..origin/main -- <modified-files...>` | ||
| - If those commits touch the **same files** as the local uncommitted work, | ||
| expect real conflicts, not a clean fast-forward. | ||
|
|
||
| ## Detect a *divergent/duplicate* implementation (the non-obvious step) | ||
|
|
||
| When local changes and incoming commits both touch the same feature, ask | ||
| whether the local work is a parallel re-implementation of something already | ||
| merged upstream. Two cheap probes: | ||
|
|
||
| - `git ls-tree origin/main <untracked-file>` — empty output means the file does | ||
| NOT exist on the remote; it is local-only. | ||
| - `git log --oneline --all --diff-filter=AD -- <file>` — empty across **all** | ||
| refs means the file was **never committed anywhere**. A feature-named commit | ||
| that touches *related* files in the incoming range, but a local file that | ||
| appears nowhere in history, means the same feature was implemented | ||
| differently (e.g. inline in `events.go` instead of a separate `findings.go`). | ||
|
Comment on lines
+40
to
+44
There was a problem hiding this comment. 🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win Do not use the filtered history query as proof that a file was never committed.
Use full path history and inspect the exact tree entry before choosing discard. Suggested probe- `git log --oneline --all --diff-filter=AD -- <file>` — empty across **all**
- refs means the file was **never committed anywhere**.
+ `git log --all --follow --oneline -- <file>` — inspect path history,
+ including ordinary modifications and renames.
+ `git cat-file -e origin/main:<file>` — test whether the exact path exists
+ in `origin/main`.🤖 Prompt for AI Agents |
||
|
|
||
| This determines the resolution: **merge** (independent work) vs **discard one | ||
| side** (superseded duplicate). | ||
|
|
||
| ## Resolution | ||
|
|
||
| 1. `git stash push -u -m "wip: <description>"` — the `-u` is mandatory to | ||
| capture **untracked** files too. | ||
| 2. `git pull --rebase --tags origin main` — when the branch is strictly behind | ||
| ("behind by N commits, can be fast-forwarded"), this **fast-forwards** with | ||
| no real rebase and no conflicts (there are no local commits to replay). The | ||
| "rebase" wording in the error is misleading in this case. | ||
| 3. `git stash pop` — conflicts (if any) surface here, on files changed in both. | ||
| Safety: a `stash pop` that hits conflicts **keeps the stash entry** in | ||
| `git stash list`, so nothing is lost yet. | ||
| 4. Decide keep vs discard based on step "detect divergent implementation": | ||
| - **Discard** (superseded work): | ||
| `git restore --source=HEAD --staged --worktree -- <files>`, delete the | ||
| untracked file (`del /f /q <path>` on Windows), then `git stash drop`. | ||
|
There was a problem hiding this comment. 🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win Provide deletion commands for each supported shell.
🤖 Prompt for AI Agents🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win Do not run an unqualified A successful Suggested stash cleanup- then `git stash drop`.
+ If `git stash pop` reports conflicts, confirm that the retained entry is
+ the WIP stash before running `git stash drop <wip-stash>`.
+ If `git stash pop` succeeds, do not run `git stash drop`; Git already
+ removed the WIP entry.🤖 Prompt for AI Agents |
||
| - **Keep**: resolve each conflict marker normally (`<<<<<<< Updated upstream` | ||
| vs `>>>>>>> Stashed changes`) and reconcile both sides. | ||
|
|
||
| ## Verify | ||
|
|
||
| - `git status` → `working tree clean`, `up to date with 'origin/main'`. | ||
| - No `<<<<<<<`/`=======`/`>>>>>>>` markers remain. | ||
| - `git rev-parse HEAD` equals `git rev-parse origin/main`. | ||
|
Comment on lines
+69
to
+71
There was a problem hiding this comment. 🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win Make the verification checks conditional on the resolution. The Keep path may intentionally retain uncommitted changes or local commits. In those cases, 🧰 Tools🪛 LanguageTool[grammar] ~69-~69: Use a hyphen to join words. (QB_NEW_EN_HYPHEN) 🤖 Prompt for AI Agents |
||
| - `go build ./...` passes (for Go repos). | ||
|
|
||
| ## Prevention | ||
|
|
||
| Working across two clones of the same repo (WSL2 + Windows): always `git | ||
| status` + `git pull` in the environment you're about to edit, or use a | ||
| dedicated branch per environment, so uncommitted work doesn't silently drift | ||
| out of sync with what the other side already pushed. | ||
|
|
||
| ## Why | ||
|
|
||
| Local uncommitted work and already-pushed work are frequently the *same | ||
| feature written twice* — a fact invisible from `git status` alone but exposed | ||
| by `git log --all --diff-filter=AD -- <file>` returning empty. Classifying the | ||
| divergence (duplicate vs independent) *before* resolving conflicts avoids a | ||
| broken hybrid or wasted merge effort. | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
🔒 Security & Privacy | 🟡 Minor | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
Repository: MikeRoss27/scanforge
Length of output: 525
🏁 Script executed:
Repository: MikeRoss27/scanforge
Length of output: 4062
🏁 Script executed:
Repository: MikeRoss27/scanforge
Length of output: 1715
🌐 Web query:
GitHub actions/checkout persist-credentials default true pull_request GITHUB_TOKEN permissions documentation💡 Result:
In the
actions/checkoutGitHub Action, thepersist-credentialsinput defaults totrue[1][2][3]. When set totrue, this configuration persists the authentication token (such as theGITHUB_TOKEN) in the local Git configuration of the runner [2][3]. This allows subsequent steps in the same job to execute authenticated Git commands using the persisted credentials [2][4]. Regarding theGITHUB_TOKENand its interaction withpull_requestevents: 1. Persistence Security: Whilepersist-credentials: truepersists the token in the local Git config, security documentation and discussions indicate that theGITHUB_TOKENis inherently accessible to all steps within a GitHub Actions job via thegithub.tokencontext, regardless of whetherpersist-credentialsis enabled [5][6][7]. The primary security purpose ofpersist-credentials: false(or keeping the defaulttruebut ensuring restricted token permissions) is to limit the risk of accidental exposure or misuse by subsequent steps or processes within the job [8][5]. 2. GITHUB_TOKEN Permissions: TheGITHUB_TOKENpermissions are determined by the repository, organization, or enterprise settings, which can be further restricted within the workflow file using thepermissionskey [9][10][7]. 3. Pull Request Restrictions: For workflows triggered bypull_requestevents from forked repositories, theGITHUB_TOKENis automatically granted only read-only permissions by default to prevent unauthorized modifications, even if the workflow configuration attempts to request write permissions [9][10][11]. To perform write operations on a pull request from a fork, one would typically need a different authentication method (like a Personal Access Token or a GitHub App installation token) or use thepull_request_targetevent (which requires careful security consideration as it runs in the context of the base repository) [12][11]. Best practice dictates that you should use thepermissionskey to explicitly define the minimum required access for yourGITHUB_TOKENin every workflow [13][9][7]. If you do not require authenticated Git commands for subsequent steps, you should setpersist-credentials: false[2][4].Citations:
Security Misconfiguration (CWE-732): Incorrect Permission Assignment for Critical Resource
Reachability: External
Restrict the workflow token before executing pull-request code.
This workflow executes checked-out pull-request code, and each checkout persists the token in local Git configuration by default. Add top-level
permissions: contents: readand setpersist-credentials: falseon everyactions/checkoutstep in theinstallers,installer-arch,installer-windows,lint,test, anddockerjobs.🧰 Tools
🪛 zizmor (1.29.0)
[warning] 18-19: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
[warning] 1-119: overly broad permissions (excessive-permissions): default permissions used due to no permissions: block
(excessive-permissions)
[warning] 10-32: overly broad permissions (excessive-permissions): default permissions used due to no permissions: block
(excessive-permissions)
📍 Affects 1 file
.github/workflows/ci.yml#L19-L19(this comment).github/workflows/ci.yml#L40-L40.github/workflows/ci.yml#L53-L53🤖 Prompt for AI Agents
Source: Linters/SAST tools