python-packaging-git-audit

Python Packaging Git Audit

Inspects the recent git history of a Python package repository for commits that modify supply-chain-sensitive files (setup.py, CI configs, .pth files, etc.) and contain suspicious patterns. Produces a self-contained "Git History Analysis" report section with triaged findings and a risk assessment.

Inputs

• repo_path (required): Local filesystem path to a git repository
• output_file (optional): Write the report section to this file path instead of returning it inline. The first line of the file must be RISK_RATING:<value> so the orchestrator can parse it without reading the full report.

Step 1: Enumerate Commits

Determine the number of commits available and scan up to the last 50:

git -C <repo-path> log -50 --format='%H'

Step 2: Filter Sensitive Files

From those commits, identify ones that modify supply-chain-sensitive files:

• setup.py, setup.cfg, pyproject.toml, MANIFEST.in
• .github/workflows/*.yml, .gitlab-ci.yml
• Any .pth files
• __init__.py files at package root

git -C <repo-path> log -50 --diff-filter=ACMR --name-only --format='COMMIT:%H|%aI|%ae' -- \
  setup.py setup.cfg pyproject.toml MANIFEST.in \
  '.github/workflows/*.yml' .gitlab-ci.yml \
  '*.pth' '*/__init__.py'

Step 3: Search for Suspicious Patterns

For each flagged commit, extract the diff and search for suspicious patterns:

• Code execution: eval(, exec(, compile(
• Process spawning: subprocess, os.system, os.popen
• Encoding/serialization: base64, marshal, pickle
• Network access: socket, urllib, requests.get, httpx
• Native code: ctypes, cffi
• Embedded URLs: http://, https://

git -C "<repo-path>" show --format= -m --first-parent "<commit>" -- "<file>" | \
  grep -nE 'eval\(|exec\(|compile\(|subprocess|os\.system|os\.popen|base64|marshal|pickle|socket|urllib|requests\.get|httpx|ctypes|cffi|https?://'

Collect per finding: commit hash, author, date, file modified, and matching patterns.