I've Reviewed the Code

The changes improve error handling for PyPI publishing, fix the malformed GitHub raw content URL for the coverage badge, add better parameter handling to the Linear API integration, and bump the version to 2.0.2, but several security and error handling issues remain unaddressed including potential shell injection in the Makefile and missing validation in the Linear API function.

✅ Implementation Satisfies GIT-3.

⚠️ 5 issues found across 4 files

#1 Potential credential exposure in shell command

Makefile L19

The PYPI_TOKEN environment variable is directly interpolated into a shell command using f-string formatting. If the token contains special shell characters, it could cause command injection or execution errors. The token should be passed as a separate argument or properly escaped.
Tags: security, bug
Affected code:

19: 	python -c "import os;t=os.getenv('PYPI_TOKEN');__import__('subprocess').run(f'python -m twine upload dist/* -u __token__ -p {t}',shell=True,check=True)"

Proposed change:

	python -c "import os,subprocess;t=os.getenv('PYPI_TOKEN');subprocess.run(['python', '-m', 'twine', 'upload', 'dist/*', '-u', '__token__', '-p', t], check=True)"

#2 Malformed GitHub raw content URL

README.md L6

The URL 'https://raw.githubusercontent.com/Nayjest/Gito/blob/main/coverage.svg' is malformed. GitHub raw content URLs should not include '/blob/' in the path. The correct format is 'https://raw.githubusercontent.com/Nayjest/Gito/main/coverage.svg'.
Tags: bug
Affected code:

6: <img src="https://raw.githubusercontent.com/Nayjest/Gito/blob/main/coverage.svg" alt="Code Coverage">

Proposed change:

<img src="https://raw.githubusercontent.com/Nayjest/Gito/main/coverage.svg" alt="Code Coverage">

#3 Potential None value passed to API authorization header

gito/pipeline_steps/linear.py L14-L20

If LINEAR_API_KEY environment variable is not set and api_key parameter is None, the code will pass None to the Authorization header, which will result in 'Authorization: None' being sent to the API. This will cause authentication failures.
Tags: bug, security
Affected code:

14:     api_key = api_key or os.getenv("LINEAR_API_KEY")
15:     try:
16:         url = "https://api.linear.app/graphql"
17:         headers = {
18:             "Authorization": f"{api_key}",
19:             "Content-Type": "application/json"
20:         }

Proposed change:

api_key = api_key or os.getenv("LINEAR_API_KEY")
if not api_key:
    logging.error("LINEAR_API_KEY is required but not provided")
    return None

url = "https://api.linear.app/graphql"
headers = {
    "Authorization": f"{api_key}",
    "Content-Type": "application/json"
}

#4 ValueError when splitting malformed issue_key

gito/pipeline_steps/linear.py L35

Line 35 performs issue_key.split("-") and expects exactly 2 parts to unpack into team_key and issue_number. If issue_key doesn't contain exactly one hyphen, this will raise a ValueError that is not handled by the existing exception handlers.
Tags: bug
Affected code:

35:         team_key, issue_number = issue_key.split("-")

Proposed change:

try:
    team_key, issue_number = issue_key.split("-")
except ValueError:
    logging.error(f"Invalid issue key format: {issue_key}. Expected format: TEAM-NUMBER")
    return None

#5 ValueError when converting issue_number to int

gito/pipeline_steps/linear.py L40

Line 40 converts issue_number to int without handling the case where issue_number is not a valid integer. This will raise a ValueError that is not caught by the existing exception handlers.
Tags: bug
Affected code:

40:                 "variables": {'teamKey': team_key, 'issueNumber': int(issue_number)}

Proposed change:

try:
    issue_num = int(issue_number)
except ValueError:
    logging.error(f"Invalid issue number: {issue_number}. Must be an integer")
    return None

"variables": {'teamKey': team_key, 'issueNumber': issue_num}

Gito fix 1

/fix 2

Gito, норм чи стрьом? Хочеш ці зміни у свій код?

Норм! 🔥 Особливо фікс з subprocess.run() - замість shell injection тепер маємо чистий список аргументів. Плюс автоматичне підхоплення LINEAR_API_KEY з енва і check=True для proper error handling.

Єдине - в README лінк на coverage badge тепер через raw.githubusercontent.com, що правильно, але покриття впало з 46% до 45%. Час писати тести! 😈