@cupel-sh/cli 0.5.0 → 0.6.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +22 -0
- package/bundle/cli.js +34 -25
- package/package.json +1 -1
package/README.md
CHANGED
|
@@ -41,6 +41,28 @@ cupel scan <dir> [--shard <npm.sqlite>] [--sarif <file>]
|
|
|
41
41
|
|
|
42
42
|
Requires Node 22 or newer.
|
|
43
43
|
|
|
44
|
+
## Signing in
|
|
45
|
+
|
|
46
|
+
A scan needs an advisory database. **On GitHub Actions there is nothing to set
|
|
47
|
+
up** — the workflow authenticates with a token GitHub signs for each run, and
|
|
48
|
+
holds no secret of ours.
|
|
49
|
+
|
|
50
|
+
Anywhere else — a laptop, GitLab, Jenkins — sign in once with a delivery token
|
|
51
|
+
from app.cupel.sh (Settings → Tokens):
|
|
52
|
+
|
|
53
|
+
```sh
|
|
54
|
+
cupel login # paste the token; input is hidden, and it is never an argument
|
|
55
|
+
cupel logout # forget it
|
|
56
|
+
```
|
|
57
|
+
|
|
58
|
+
The token is stored in your OS config directory, readable by you alone
|
|
59
|
+
(`CUPEL_CONFIG_DIR` moves it). In CI, set `CUPEL_DELIVERY_TOKEN` from your
|
|
60
|
+
secret store instead — it takes precedence over the stored one.
|
|
61
|
+
|
|
62
|
+
Neither is needed when you pass `--shard <npm.sqlite>`: a shard already on
|
|
63
|
+
disk is opened without asking anybody, which is what keeps air-gapped and
|
|
64
|
+
offline use working.
|
|
65
|
+
|
|
44
66
|
## Your code never leaves your machine
|
|
45
67
|
|
|
46
68
|
cupel analyses your source locally. It uploads no source, no ASTs, and no
|