Merge branch 'main' of https://github.com/omegaleo/SecretSecurity

Create CONTRIBUTING.md

.github/ISSUE_TEMPLATE/bug_report.md

@@ -0,0 +1,38 @@
+---
+name: Bug report
+about: Create a report to help us improve
+title: ''
+labels: ''
+assignees: ''
+
+---
+
+**Describe the bug**
+A clear and concise description of what the bug is.
+
+**To Reproduce**
+Steps to reproduce the behavior:
+1. Go to '...'
+2. Click on '....'
+3. Scroll down to '....'
+4. See error
+
+**Expected behavior**
+A clear and concise description of what you expected to happen.
+
+**Screenshots**
+If applicable, add screenshots to help explain your problem.
+
+**Desktop (please complete the following information):**
+ - OS: [e.g. iOS]
+ - Browser [e.g. chrome, safari]
+ - Version [e.g. 22]
+
+**Smartphone (please complete the following information):**
+ - Device: [e.g. iPhone6]
+ - OS: [e.g. iOS8.1]
+ - Browser [e.g. stock browser, safari]
+ - Version [e.g. 22]
+
+**Additional context**
+Add any other context about the problem here.

.github/ISSUE_TEMPLATE/feature_request.md

@@ -0,0 +1,20 @@
+---
+name: Feature request
+about: Suggest an idea for this project
+title: ''
+labels: ''
+assignees: ''
+
+---
+
+**Is your feature request related to a problem? Please describe.**
+A clear and concise description of what the problem is. Ex. I'm always frustrated when [...]
+
+**Describe the solution you'd like**
+A clear and concise description of what you want to happen.
+
+**Describe alternatives you've considered**
+A clear and concise description of any alternative solutions or features you've considered.
+
+**Additional context**
+Add any other context or screenshots about the feature request here.

.github/workflows/release.yml

@@ -4,6 +4,11 @@ on:
   push:
     tags:
       - 'v*'
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: 'Tag name to release (e.g. v1.0.0)'
+        required: true
 
 jobs:
   build-and-publish:
@@ -11,6 +16,7 @@ jobs:
     permissions:
       contents: write
       packages: write
+      id-token: write
 
     steps:
       - uses: actions/checkout@v4
@@ -22,7 +28,10 @@ jobs:
 
       - name: Extract version from tag
         id: version
-        run: echo "VERSION=${GITHUB_REF_NAME#v}" >> $GITHUB_OUTPUT
+        run: |
+          TAG=${{ github.event.inputs.tag || github.ref_name }}
+          echo "VERSION=${TAG#v}" >> $GITHUB_OUTPUT
+          echo "TAG=$TAG" >> $GITHUB_OUTPUT
 
       - name: Build
         run: dotnet build SecretSecurity/SecretSecurity.csproj --configuration Release
@@ -35,6 +44,18 @@ jobs:
           -p:Version=${{ steps.version.outputs.VERSION }}
           --output ./nupkg
 
+      - name: NuGet login (OIDC trusted publishing)
+        uses: NuGet/login@v1
+        id: nuget-login
+        with:
+          user: omegaleo
+
+      - name: Push to NuGet.org
+        run: >
+          dotnet nuget push ./nupkg/*.nupkg
+          --api-key ${{ steps.nuget-login.outputs.NUGET_API_KEY }}
+          --source https://api.nuget.org/v3/index.json
+
       - name: Push to GitHub Packages
         run: >
           dotnet nuget push ./nupkg/*.nupkg
@@ -44,5 +65,6 @@ jobs:
       - name: Create GitHub Release
         uses: softprops/action-gh-release@v2
         with:
+          tag_name: ${{ steps.version.outputs.TAG }}
           files: ./nupkg/*.nupkg
           generate_release_notes: true

CODE_OF_CONDUCT.md

@@ -0,0 +1,128 @@
+# Contributor Covenant Code of Conduct
+
+## Our Pledge
+
+We as members, contributors, and leaders pledge to make participation in our
+community a harassment-free experience for everyone, regardless of age, body
+size, visible or invisible disability, ethnicity, sex characteristics, gender
+identity and expression, level of experience, education, socio-economic status,
+nationality, personal appearance, race, religion, or sexual identity
+and orientation.
+
+We pledge to act and interact in ways that contribute to an open, welcoming,
+diverse, inclusive, and healthy community.
+
+## Our Standards
+
+Examples of behavior that contributes to a positive environment for our
+community include:
+
+* Demonstrating empathy and kindness toward other people
+* Being respectful of differing opinions, viewpoints, and experiences
+* Giving and gracefully accepting constructive feedback
+* Accepting responsibility and apologizing to those affected by our mistakes,
+  and learning from the experience
+* Focusing on what is best not just for us as individuals, but for the
+  overall community
+
+Examples of unacceptable behavior include:
+
+* The use of sexualized language or imagery, and sexual attention or
+  advances of any kind
+* Trolling, insulting or derogatory comments, and personal or political attacks
+* Public or private harassment
+* Publishing others' private information, such as a physical or email
+  address, without their explicit permission
+* Other conduct which could reasonably be considered inappropriate in a
+  professional setting
+
+## Enforcement Responsibilities
+
+Community leaders are responsible for clarifying and enforcing our standards of
+acceptable behavior and will take appropriate and fair corrective action in
+response to any behavior that they deem inappropriate, threatening, offensive,
+or harmful.
+
+Community leaders have the right and responsibility to remove, edit, or reject
+comments, commits, code, wiki edits, issues, and other contributions that are
+not aligned to this Code of Conduct, and will communicate reasons for moderation
+decisions when appropriate.
+
+## Scope
+
+This Code of Conduct applies within all community spaces, and also applies when
+an individual is officially representing the community in public spaces.
+Examples of representing our community include using an official e-mail address,
+posting via an official social media account, or acting as an appointed
+representative at an online or offline event.
+
+## Enforcement
+
+Instances of abusive, harassing, or otherwise unacceptable behavior may be
+reported to the community leaders responsible for enforcement at
+nunodiogo@omegaleo.pt.
+All complaints will be reviewed and investigated promptly and fairly.
+
+All community leaders are obligated to respect the privacy and security of the
+reporter of any incident.
+
+## Enforcement Guidelines
+
+Community leaders will follow these Community Impact Guidelines in determining
+the consequences for any action they deem in violation of this Code of Conduct:
+
+### 1. Correction
+
+**Community Impact**: Use of inappropriate language or other behavior deemed
+unprofessional or unwelcome in the community.
+
+**Consequence**: A private, written warning from community leaders, providing
+clarity around the nature of the violation and an explanation of why the
+behavior was inappropriate. A public apology may be requested.
+
+### 2. Warning
+
+**Community Impact**: A violation through a single incident or series
+of actions.
+
+**Consequence**: A warning with consequences for continued behavior. No
+interaction with the people involved, including unsolicited interaction with
+those enforcing the Code of Conduct, for a specified period of time. This
+includes avoiding interactions in community spaces as well as external channels
+like social media. Violating these terms may lead to a temporary or
+permanent ban.
+
+### 3. Temporary Ban
+
+**Community Impact**: A serious violation of community standards, including
+sustained inappropriate behavior.
+
+**Consequence**: A temporary ban from any sort of interaction or public
+communication with the community for a specified period of time. No public or
+private interaction with the people involved, including unsolicited interaction
+with those enforcing the Code of Conduct, is allowed during this period.
+Violating these terms may lead to a permanent ban.
+
+### 4. Permanent Ban
+
+**Community Impact**: Demonstrating a pattern of violation of community
+standards, including sustained inappropriate behavior,  harassment of an
+individual, or aggression toward or disparagement of classes of individuals.
+
+**Consequence**: A permanent ban from any sort of public interaction within
+the community.
+
+## Attribution
+
+This Code of Conduct is adapted from the [Contributor Covenant][homepage],
+version 2.0, available at
+https://www.contributor-covenant.org/version/2/0/code_of_conduct.html.
+
+Community Impact Guidelines were inspired by [Mozilla's code of conduct
+enforcement ladder](https://github.com/mozilla/diversity).
+
+[homepage]: https://www.contributor-covenant.org
+
+For answers to common questions about this code of conduct, see the FAQ at
+https://www.contributor-covenant.org/faq. Translations are available at
+https://www.contributor-covenant.org/translations.

CONTRIBUTING.md

@@ -0,0 +1,7 @@
+# Contributing
+Contributions are welcome! To get started:
+
+Fork the repository and create a branch from main.
+Make your changes and ensure the project builds (dotnet build).
+Open a pull request describing what you changed and why.
+Please open an issue first for any significant change so we can discuss the approach before you invest time in it.

README.md

@@ -24,7 +24,7 @@ Dev-safe connections (localhost, 127.0.0.1, integrated security) are automatical
 Requires [.NET 10 SDK](https://dotnet.microsoft.com/download) or later.
 
 ```bash
-dotnet tool install --global SecretSecurity --add-source https://nuget.pkg.github.com/omegaleo/index.json
+dotnet tool install --global SecretSecurity
 ```
 
 ## Usage
@@ -39,6 +39,22 @@ secretsecurity install
 
 This writes a `pre-commit` hook to `.git/hooks/` that runs `secretsecurity scan` automatically on every commit.
 
+### Uninstall the pre-commit hook
+
+```bash
+secretsecurity uninstall
+```
+
+Removes the hook if it was installed by SecretSecurity. If the hook was created by something else, it is left untouched.
+
+### Update
+
+```bash
+secretsecurity update
+```
+
+Updates the tool to the latest version via `dotnet tool update --global`.
+
 ### Scan manually
 
 ```bash

SecretSecurity/Program.cs

@@ -27,6 +27,12 @@ class Program
             case "install":
                 InstallCommand();
                 break;
+            case "uninstall":
+                UninstallCommand();
+                break;
+            case "update":
+                UpdateCommand();
+                break;
             default:
                 PrintHelp();
                 break;
@@ -59,7 +65,45 @@ fi
 
         File.WriteAllText(hookPath, script);
 
-        Console.WriteLine("✅ SecretSecurity installed successfully");
+        // make the hook executable on Unix
+        if (!OperatingSystem.IsWindows())
+            RunProcess("chmod", $"+x \"{hookPath}\"");
+
+        AnsiConsole.MarkupLine("[green]✅ SecretSecurity hook installed successfully[/]");
+    }
+
+    static void UninstallCommand()
+    {
+        var root = RunGit("rev-parse --show-toplevel").Trim();
+        var hookPath = Path.Combine(root, ".git", "hooks", "pre-commit");
+
+        if (!File.Exists(hookPath))
+        {
+            AnsiConsole.MarkupLine("[yellow]No pre-commit hook found — nothing to uninstall.[/]");
+            return;
+        }
+
+        var content = File.ReadAllText(hookPath);
+        if (!content.Contains("SecretSecurity"))
+        {
+            AnsiConsole.MarkupLine("[yellow]Pre-commit hook exists but was not installed by SecretSecurity — leaving it untouched.[/]");
+            return;
+        }
+
+        File.Delete(hookPath);
+        AnsiConsole.MarkupLine("[green]✅ SecretSecurity hook removed successfully[/]");
+    }
+
+    static void UpdateCommand()
+    {
+        AnsiConsole.MarkupLine("[cyan]Updating SecretSecurity...[/]");
+
+        var exitCode = RunProcess("dotnet", "tool update --global SecretSecurity");
+
+        if (exitCode == 0)
+            AnsiConsole.MarkupLine("[green]✅ SecretSecurity updated successfully[/]");
+        else
+            AnsiConsole.MarkupLine("[red]Update failed. Try running: dotnet tool update --global SecretSecurity[/]");
     }
 
     static void PrintHelp()
@@ -70,7 +114,8 @@ SecretSecurity CLI
 Commands:
   scan        Scan staged git changes
   install     Install git pre-commit hook
-  ignore     Add ignore-rule
+  uninstall   Remove the git pre-commit hook
+  update      Update SecretSecurity to the latest version
 ");
     }
 
@@ -101,7 +146,7 @@ Commands:
 
             foreach (var f in critical)
             {
-                AnsiConsole.MarkupLine($"[red]• {f.Type}[/] in [grey]{f.File}:{f.Line}[/]");
+                AnsiConsole.MarkupLine($"[red]• {f.Type}[/] in [grey]{Markup.Escape(f.File)}:{f.Line}[/]");
             }
 
             Environment.Exit(1);
@@ -134,8 +179,8 @@ Commands:
 
             AnsiConsole.MarkupLine($"""
 [{color}]{f.Severity}[/]
-📄 [bold]{f.File}:{f.Line}[/]
+📄 [bold]{Markup.Escape(f.File)}:{f.Line}[/]
-🔎 {f.ValuePreview}
+🔎 {Markup.Escape(f.ValuePreview)}
 
 ────────────────────────────
 """);
@@ -225,18 +270,30 @@ Commands:
         return results;
     }
 
-    public static string RunGit(string args)
+    public static string RunGit(string args) => RunProcessOutput("git", args);
+
+    static string RunProcessOutput(string fileName, string args)
     {
         var process = new Process();
-        process.StartInfo.FileName = "git";
+        process.StartInfo.FileName = fileName;
         process.StartInfo.Arguments = args;
         process.StartInfo.RedirectStandardOutput = true;
         process.StartInfo.UseShellExecute = false;
         process.Start();
-
         return process.StandardOutput.ReadToEnd();
     }
 
+    static int RunProcess(string fileName, string args)
+    {
+        var process = new Process();
+        process.StartInfo.FileName = fileName;
+        process.StartInfo.Arguments = args;
+        process.StartInfo.UseShellExecute = false;
+        process.Start();
+        process.WaitForExit();
+        return process.ExitCode;
+    }
+
     static bool IsIgnored(string file)
     {
         return _ignorePatterns.Any(p =>

SecretSecurity/SecretSecurity.csproj

@@ -12,8 +12,20 @@
     <Authors>Omega Leo</Authors>
     <Description>CLI tool for scanning secrets and sensitive data in files.</Description>
     <RepositoryUrl>https://github.com/omegaleo/SecretSecurity</RepositoryUrl>
+    <Title>SecretSecurity - Git Secret Scanner</Title>
+    <RepositoryType>git</RepositoryType>
+    <PackageReadmeFile>README.md</PackageReadmeFile>
+    <PackageTags>security secrets scanner git precommit ci cd devops dotnet cli static-analysis sast code-analysis credentials api-key leak-detection</PackageTags>
+    <GeneratePackageOnBuild>False</GeneratePackageOnBuild>
   </PropertyGroup>
 
+  <ItemGroup>
+    <None Include="..\README.md">
+      <Pack>True</Pack>
+      <PackagePath>\</PackagePath>
+    </None>
+  </ItemGroup>
+
   <ItemGroup>
     <PackageReference Include="Spectre.Console" Version="0.57.0" />
   </ItemGroup>