Skip to content

feat: add git sparse checkout mode for batch scanning#1

Open
SecKatie wants to merge 1 commit intonorth-echo:mainfrom
SecKatie:feat/clone-based-batch-scan
Open

feat: add git sparse checkout mode for batch scanning#1
SecKatie wants to merge 1 commit intonorth-echo:mainfrom
SecKatie:feat/clone-based-batch-scan

Conversation

@SecKatie
Copy link
Copy Markdown

@SecKatie SecKatie commented Mar 30, 2026

Summary

  • Adds --clone flag to batch and discover commands to scan repos via local git sparse checkout instead of the GitHub API, avoiding rate limits at scale
  • Implements sliding star-count windows in FetchTopRepos to paginate beyond GitHub's 1,000-result search limit
  • Caches repo lists in SQLite so --resume with --top N skips re-fetching
  • Hardens SQLite for concurrent goroutine writes (single-conn serialization + busy_timeout)

Test plan

  • go test -short ./... passes
  • Verified with fluxgate batch --top 500 --clone --resume (389/500 scanned, 382 with findings)
  • Test --resume re-run skips already-scanned repos
  • Test --keep flag preserves cloned directories
  • Test discover --clone path

🤖 Generated with Claude Code

Adds --clone flag to batch and discover commands, scanning repos via
local git sparse checkout instead of the GitHub API. This avoids API
rate limits when scanning large numbers of repos.

Key changes:
- internal/git: sparse clone package with concurrent clone-and-scan
- Sliding star-count windows in FetchTopRepos to paginate beyond
  GitHub's 1,000-result search limit
- Repo list caching in SQLite for --resume with --top N
- SQLite hardening: single-conn serialization + busy_timeout for
  concurrent goroutine writes

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
@SecKatie
Copy link
Copy Markdown
Author

Test plan results

All items verified:

Test Result
go test ./... Passed — all packages pass
batch --top 500 --clone --resume Passed — 389/500 scanned, 382 with findings
--resume re-run skips already-scanned repos Passed — "All repos already scanned."
--keep flag preserves cloned directories Passed — 5 repos kept in temp dir with workflow files intact
discover --clone path Passed — 97 repos discovered via code search and scanned via clone

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant