v 0.3

[PatrickAlphaC]

Big Changes

1. Make the packaging easier (people should be able to run this with a uv tool install audit_repo_cloner
2. Have tokens saved in an encrypted file or something that can be sourced with the CLI
3. Add the report generation pipeline into this tool

Notes

Here is the flow.

1. You get a link to the private repo & commit hash
2. I want to get the client's repo into our org
   • Run audit_repo_cloner which:
     • Setup a new repo in the cyfrin org
     • Clone a copy of our version locally
   • audit_repo_cloner

spectre:
init – set up existing repos for report generation (create .toml replacement for .env and source .conf)
Report generation needs to have:

• finding.md (issue template)
• Report branch, and the workflow (the .github stuff, it should be on main too)
• Save the .env stuff in an encrypted file, maybe have a prompt for the other stuff

Then run create_audit_repo.py. They are pretty content with what this script does. Need to change how it references the report "stuff".

They don't like:

add_subtree

They just want to run this command. So, we should turn that repo into a package, and have the audit_repo_cloner just install the package.

clone – clone a remote repository (private fork) and init for report generation
audit_repo_cloner clone <REMOTE_URL>

source – create report source files in independent step (sort of like compile, and it creates a folder with the files it'll use to generate a report) (see this)

report – generate the report (run on compatible repo locally or in workflow)

contain – set devcontainer path once and run command to copy into current directory

cyaudit contain # reads from like a `.cyaudit` folder and paste the stuff into this folder

[PatrickAlphaC]

Testing:

1. Make a new org
2. Make a private GitHub repo that's shared with my user
3. The cloner should make a repo of that repo
4. Issues are the findings, and generating the report will
   • They need a title, body, and a label
5. It outputs 3 files, a PDF, a markdown, and a CSV