feat(shadictl): track nested git repos in snapshots

Signed-off-by: Luca Muscariello <muscariello@ieee.org>

Author: muscariello

Justfile

@@ -32,12 +32,19 @@ coverage:
   LLVM_SYSROOT="$(rustc --print sysroot)" \
   LLVM_HOST="$(rustc -Vv | awk '/host/ {print $2}')" \
   LLVM_BREW="$(brew --prefix llvm 2>/dev/null || true)" \
+  LLVM_BREW_VERSIONED="$(brew --prefix llvm@21 2>/dev/null || true)" \
   LLVM_COV="$(command -v llvm-cov || true)" \
-  LLVM_PROFDATA="$(command -v llvm-profdata || true)" \
-  LLVM_COV="${LLVM_COV:-$LLVM_BREW/bin/llvm-cov}" \
-  LLVM_PROFDATA="${LLVM_PROFDATA:-$LLVM_BREW/bin/llvm-profdata}" \
-  LLVM_COV="${LLVM_COV:-$LLVM_SYSROOT/lib/rustlib/$LLVM_HOST/bin/llvm-cov}" \
-  LLVM_PROFDATA="${LLVM_PROFDATA:-$LLVM_SYSROOT/lib/rustlib/$LLVM_HOST/bin/llvm-profdata}" \
+  LLVM_PROFDATA="$(command -v llvm-profdata || true)"; \
+  if [ -z "$LLVM_COV" ]; then \
+    if [ -x "$LLVM_BREW/bin/llvm-cov" ]; then LLVM_COV="$LLVM_BREW/bin/llvm-cov"; \
+    elif [ -x "$LLVM_BREW_VERSIONED/bin/llvm-cov" ]; then LLVM_COV="$LLVM_BREW_VERSIONED/bin/llvm-cov"; \
+    else LLVM_COV="$LLVM_SYSROOT/lib/rustlib/$LLVM_HOST/bin/llvm-cov"; fi; \
+  fi; \
+  if [ -z "$LLVM_PROFDATA" ]; then \
+    if [ -x "$LLVM_BREW/bin/llvm-profdata" ]; then LLVM_PROFDATA="$LLVM_BREW/bin/llvm-profdata"; \
+    elif [ -x "$LLVM_BREW_VERSIONED/bin/llvm-profdata" ]; then LLVM_PROFDATA="$LLVM_BREW_VERSIONED/bin/llvm-profdata"; \
+    else LLVM_PROFDATA="$LLVM_SYSROOT/lib/rustlib/$LLVM_HOST/bin/llvm-profdata"; fi; \
+  fi; \
   SHADI_KEYCHAIN_TESTS=1 \
   PYO3_PYTHON="{{python312}}" RUSTFLAGS="-C link-arg=-L{{python_prefix}}/Frameworks/Python.framework/Versions/3.12/lib/python3.12/config-3.12-darwin -C link-arg=-lpython3.12 -C link-arg=-framework -C link-arg=CoreFoundation" \
   LLVM_COV="$LLVM_COV" LLVM_PROFDATA="$LLVM_PROFDATA" \
@@ -48,12 +55,19 @@ coverage-html:
   LLVM_SYSROOT="$(rustc --print sysroot)" \
   LLVM_HOST="$(rustc -Vv | awk '/host/ {print $2}')" \
   LLVM_BREW="$(brew --prefix llvm 2>/dev/null || true)" \
+  LLVM_BREW_VERSIONED="$(brew --prefix llvm@21 2>/dev/null || true)" \
   LLVM_COV="$(command -v llvm-cov || true)" \
-  LLVM_PROFDATA="$(command -v llvm-profdata || true)" \
-  LLVM_COV="${LLVM_COV:-$LLVM_BREW/bin/llvm-cov}" \
-  LLVM_PROFDATA="${LLVM_PROFDATA:-$LLVM_BREW/bin/llvm-profdata}" \
-  LLVM_COV="${LLVM_COV:-$LLVM_SYSROOT/lib/rustlib/$LLVM_HOST/bin/llvm-cov}" \
-  LLVM_PROFDATA="${LLVM_PROFDATA:-$LLVM_SYSROOT/lib/rustlib/$LLVM_HOST/bin/llvm-profdata}" \
+  LLVM_PROFDATA="$(command -v llvm-profdata || true)"; \
+  if [ -z "$LLVM_COV" ]; then \
+    if [ -x "$LLVM_BREW/bin/llvm-cov" ]; then LLVM_COV="$LLVM_BREW/bin/llvm-cov"; \
+    elif [ -x "$LLVM_BREW_VERSIONED/bin/llvm-cov" ]; then LLVM_COV="$LLVM_BREW_VERSIONED/bin/llvm-cov"; \
+    else LLVM_COV="$LLVM_SYSROOT/lib/rustlib/$LLVM_HOST/bin/llvm-cov"; fi; \
+  fi; \
+  if [ -z "$LLVM_PROFDATA" ]; then \
+    if [ -x "$LLVM_BREW/bin/llvm-profdata" ]; then LLVM_PROFDATA="$LLVM_BREW/bin/llvm-profdata"; \
+    elif [ -x "$LLVM_BREW_VERSIONED/bin/llvm-profdata" ]; then LLVM_PROFDATA="$LLVM_BREW_VERSIONED/bin/llvm-profdata"; \
+    else LLVM_PROFDATA="$LLVM_SYSROOT/lib/rustlib/$LLVM_HOST/bin/llvm-profdata"; fi; \
+  fi; \
   SHADI_KEYCHAIN_TESTS=1 \
   PYO3_PYTHON="{{python312}}" RUSTFLAGS="-C link-arg=-L{{python_prefix}}/Frameworks/Python.framework/Versions/3.12/lib/python3.12/config-3.12-darwin -C link-arg=-lpython3.12 -C link-arg=-framework -C link-arg=CoreFoundation" \
   LLVM_COV="$LLVM_COV" LLVM_PROFDATA="$LLVM_PROFDATA" \

README.md

@@ -125,6 +125,13 @@ Each artifact includes resolved policy, timestamps, before/after Git state,
 SHA-256 hashes for captured Git payloads, and comparison fields such as
 `status_changed` and `overall_changed`.
 
+If the workspace contains nested Git repos, the artifact also includes a
+`git.repositories` array with per-repo before/after state and comparison
+metadata. This is important for agent workflows like SecOps remediation where
+the agent may clone or update another repo under the current working folder:
+the outer repo can stay unchanged while the nested repo entry still reports the
+change.
+
 ### 4) Derive agent identities from a human source
 
 ```bash