@secureci/cli 0.0.0-stage → 0.1.0

package/dist/runner/steps.js

@@ -0,0 +1,250 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.executeStep = executeStep;
+exports.executeInJobContainer = executeInJobContainer;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const logger_1 = require("../utils/logger");
+const child_process_1 = require("child_process");
+const util_1 = require("util");
+const expression_1 = require("./expression");
+const container_runtime_1 = require("./container-runtime");
+const runner_env_1 = require("./runner-env");
+const shell_1 = require("./shell");
+const job_runtime_1 = require("./job-runtime");
+const actions_1 = require("./actions");
+const execAsync = (0, util_1.promisify)(child_process_1.exec);
+/**
+ * Execute a single step
+ */
+async function executeStep(step, options, runtime, ctx) {
+    const startTime = Date.now();
+    try {
+        const displayName = (0, job_runtime_1.stepDisplayName)(step, ctx);
+        // Don't echo a bare run: command before the step runs — it may contain
+        // a value the step is about to register with ::add-mask::. Named and
+        // uses steps have a safe label.
+        if (step.name || step.uses) {
+            logger_1.logger.info(`Running: ${displayName}`);
+        }
+        // Handle 'uses' actions - fetch and execute remote actions
+        if (step.uses) {
+            return await (0, actions_1.executeAction)(step, options, startTime, runtime, ctx);
+        }
+        // Handle 'run' commands
+        if (step.run) {
+            let command = step.run;
+            if (ctx) {
+                // Resolve all ${{ }} expressions (env/inputs/secrets/steps/
+                // github/matrix) against the full step context.
+                command = (0, expression_1.substituteExpressions)(command, ctx);
+            }
+            else {
+                // No context available (e.g. action steps run outside a job) -
+                // fall back to direct inputs/secrets substitution.
+                if (options.inputs) {
+                    for (const [key, value] of Object.entries(options.inputs)) {
+                        command = command.replace(new RegExp(`\\$\\{\\{\\s*inputs\\.${key}\\s*\\}\\}`, 'g'), value);
+                    }
+                }
+                if (options.secrets) {
+                    for (const [key, value] of Object.entries(options.secrets)) {
+                        command = command.replace(new RegExp(`\\$\\{\\{\\s*secrets\\.${key}\\s*\\}\\}`, 'g'), value);
+                    }
+                }
+            }
+            logger_1.logger.debug(`Executing: ${command}`);
+            // ctx.env already combines workflow, job and step `env:` plus
+            // `$GITHUB_ENV` additions (see executeWorkflow). Fall back to
+            // step.env alone when no context is available.
+            const mergedEnv = ctx
+                ? ctx.env
+                : { ...runtime.env, ...(0, expression_1.substituteRecord)(step.env, (0, expression_1.createContext)()) };
+            if (runtime.container) {
+                return await executeInJobContainer(runtime.container, runtime, step, options, command, startTime, mergedEnv, displayName);
+            }
+            const files = (0, runner_env_1.createStepFiles)();
+            const shell = (0, shell_1.resolveShell)(step.shell ?? runtime.defaults.shell, {
+                bashAvailable: (0, job_runtime_1.hostHasBash)()
+            });
+            const scriptPath = path.join(files.dir, `script${shell.extension}`);
+            fs.writeFileSync(scriptPath, command);
+            const workingDirectory = step['working-directory'] ?? runtime.defaults.workingDirectory;
+            const limit = (0, job_runtime_1.effectiveTimeout)(runtime);
+            try {
+                const { stdout, stderr } = await execAsync((0, shell_1.shellCommandLine)(shell.template, scriptPath), {
+                    timeout: limit.ms,
+                    killSignal: 'SIGKILL',
+                    cwd: workingDirectory
+                        ? path.resolve(process.cwd(), workingDirectory)
+                        : process.cwd(),
+                    env: {
+                        ...(0, runner_env_1.hostBaseEnv)(),
+                        ...runtime.runnerEnv,
+                        ...runtime.actionEnv,
+                        ...mergedEnv,
+                        PATH: (0, runner_env_1.prependPath)(runtime.path, mergedEnv.PATH ?? process.env.PATH),
+                        ...(0, job_runtime_1.fileCommandEnv)(files)
+                    }
+                });
+                const { outputs } = (0, job_runtime_1.finishStepOutput)(stdout, files, runtime);
+                if (stderr) {
+                    logger_1.logger.warn(stderr.trim());
+                }
+                logger_1.logger.success(`Step completed: ${displayName}`);
+                return {
+                    step,
+                    success: true,
+                    output: stdout,
+                    outputs,
+                    duration: Date.now() - startTime
+                };
+            }
+            catch (execError) {
+                const error = execError;
+                if (error.killed && limit.ms)
+                    error.message = limit.message;
+                logger_1.logger.error(`Step failed: ${error.message}`);
+                const { outputs } = (0, job_runtime_1.finishStepOutput)(error.stdout, files, runtime);
+                if (error.stderr) {
+                    logger_1.logger.error(error.stderr.trim());
+                }
+                return {
+                    step,
+                    success: false,
+                    error: error.message,
+                    output: error.stdout,
+                    outputs,
+                    duration: Date.now() - startTime
+                };
+            }
+            finally {
+                (0, runner_env_1.cleanupStepFiles)(files);
+            }
+        }
+        // No action to take
+        return {
+            step,
+            success: true,
+            output: 'No operation',
+            duration: Date.now() - startTime
+        };
+    }
+    catch (error) {
+        return {
+            step,
+            success: false,
+            error: error instanceof Error ? error.message : 'Unknown error',
+            duration: Date.now() - startTime
+        };
+    }
+}
+/**
+ * Execute a `run:` step's command inside the job's container, so files and
+ * tools from earlier steps in the job are still there. File commands are
+ * exchanged through a per-step directory in the mounted exchange dir.
+ */
+async function executeInJobContainer(container, runtime, step, options, command, startTime, mergedEnv, displayName = (0, job_runtime_1.stepDisplayName)(step)) {
+    const { files, containerDir } = (0, job_runtime_1.createContainerStepFiles)(container);
+    try {
+        const workingDirectory = step['working-directory'] ?? runtime.defaults.workingDirectory;
+        const workingDir = workingDirectory
+            ? path.posix.resolve(container_runtime_1.CONTAINER_WORKDIR, workingDirectory)
+            : container_runtime_1.CONTAINER_WORKDIR;
+        const shell = (0, shell_1.resolveShell)(step.shell ?? runtime.defaults.shell, {
+            bashAvailable: container.bash
+        });
+        const scriptName = `script${shell.extension}`;
+        fs.writeFileSync(path.join(files.dir, scriptName), command, {
+            mode: 0o644
+        });
+        const limit = (0, job_runtime_1.effectiveTimeout)(runtime, options.containerTimeoutMs);
+        const result = await container.runtime.exec(container.id, {
+            command: (0, job_runtime_1.containerPathPrefix)(runtime) +
+                (0, shell_1.shellCommandLine)(shell.template, `${containerDir}/${scriptName}`),
+            workingDir,
+            env: {
+                ...(0, job_runtime_1.containerRunnerEnv)(runtime),
+                ...runtime.actionEnv,
+                ...mergedEnv,
+                ...(0, job_runtime_1.fileCommandEnv)(files, containerDir),
+                SECURECI_STEP: path.basename(files.dir)
+            },
+            timeoutMs: limit.ms
+        });
+        if (result.timedOut) {
+            await (0, job_runtime_1.killStepProcesses)(container, path.basename(files.dir));
+        }
+        const { outputs } = (0, job_runtime_1.finishStepOutput)(result.stdout, files, runtime);
+        if (result.stderr) {
+            logger_1.logger[result.success ? 'warn' : 'error'](result.stderr.trim());
+        }
+        if (result.timedOut) {
+            logger_1.logger.error(`${limit.message} (container: ${container.runtime.name})`);
+            return {
+                step,
+                success: false,
+                error: limit.message,
+                output: result.stdout,
+                outputs,
+                duration: Date.now() - startTime
+            };
+        }
+        if (!result.success) {
+            logger_1.logger.error(`Step failed (container: ${container.runtime.name}, exit code: ${result.exitCode})`);
+            return {
+                step,
+                success: false,
+                error: `Command exited with code ${result.exitCode}`,
+                output: result.stdout,
+                outputs,
+                duration: Date.now() - startTime
+            };
+        }
+        logger_1.logger.success(`Step completed: ${displayName} (container: ${container.runtime.name})`);
+        return {
+            step,
+            success: true,
+            output: result.stdout,
+            outputs,
+            duration: Date.now() - startTime
+        };
+    }
+    finally {
+        (0, runner_env_1.cleanupStepFiles)(files);
+    }
+}
+//# sourceMappingURL=steps.js.map

package/dist/types/index.js

@@ -0,0 +1,10 @@
+"use strict";
+// TypeScript types for GitHub Actions and Workflows
+// Types are designed to align with the official GitHub Workflow schema:
+// https://json.schemastore.org/github-workflow.json
+// https://json.schemastore.org/github-action.json
+//
+// Note: These types focus on the subset of features needed for local execution.
+// Full schema compliance would include additional properties not relevant for SecureCI's use case.
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=index.js.map

package/dist/utils/key-value.js

@@ -0,0 +1,33 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.parseKeyValuePairs = parseKeyValuePairs;
+/**
+ * Parse repeatable `key=value` CLI arguments (`--input`, `--secret`) into a
+ * record. Splits on the first `=` only, so values may themselves contain `=`
+ * (e.g. base64-padded tokens). Empty values are allowed; a missing `=` (unless
+ * `fromEnv` is set) or an empty key is an error.
+ */
+function parseKeyValuePairs(pairs, flagName, options = {}) {
+    const result = {};
+    if (pairs === undefined) {
+        return result;
+    }
+    for (const pair of Array.isArray(pairs) ? pairs : [pairs]) {
+        const separator = pair.indexOf('=');
+        if (separator === -1 && options.fromEnv && pair !== '') {
+            const value = options.fromEnv[pair];
+            if (value === undefined) {
+                throw new Error(`${flagName} ${pair}: environment variable ${pair} is not set`);
+            }
+            result[pair] = value;
+            continue;
+        }
+        if (separator <= 0) {
+            const shown = options.redact ? '' : ` "${pair}"`;
+            throw new Error(`Invalid ${flagName} argument${shown}: expected key=value`);
+        }
+        result[pair.slice(0, separator)] = pair.slice(separator + 1);
+    }
+    return result;
+}
+//# sourceMappingURL=key-value.js.map

package/dist/utils/logger.js

@@ -0,0 +1,87 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.logger = exports.LogLevel = void 0;
+const chalk_1 = __importDefault(require("chalk"));
+var LogLevel;
+(function (LogLevel) {
+    LogLevel[LogLevel["DEBUG"] = 0] = "DEBUG";
+    LogLevel[LogLevel["INFO"] = 1] = "INFO";
+    LogLevel[LogLevel["WARN"] = 2] = "WARN";
+    LogLevel[LogLevel["ERROR"] = 3] = "ERROR";
+})(LogLevel || (exports.LogLevel = LogLevel = {}));
+class Logger {
+    constructor() {
+        this.level = LogLevel.INFO;
+        this.secrets = new Set();
+    }
+    setLevel(level) {
+        this.level = level;
+    }
+    /**
+     * Register secret values so they get masked (replaced with `***`) in any
+     * subsequent log output, mirroring GitHub Actions' own secret masking.
+     * Short/empty values are ignored to avoid masking incidental characters.
+     */
+    registerSecrets(values) {
+        if (!values)
+            return;
+        for (const value of Object.values(values)) {
+            if (value && value.length >= 3) {
+                this.secrets.add(value);
+            }
+        }
+    }
+    clearSecrets() {
+        this.secrets.clear();
+    }
+    mask(text) {
+        if (this.secrets.size === 0)
+            return text;
+        let masked = text;
+        for (const secret of this.secrets) {
+            masked = masked.split(secret).join('***');
+        }
+        return masked;
+    }
+    maskArg(arg) {
+        return typeof arg === 'string' ? this.mask(arg) : arg;
+    }
+    debug(message, ...args) {
+        if (this.level <= LogLevel.DEBUG) {
+            console.log(chalk_1.default.gray(`[DEBUG] ${this.mask(message)}`), ...args.map((a) => this.maskArg(a)));
+        }
+    }
+    info(message, ...args) {
+        if (this.level <= LogLevel.INFO) {
+            console.log(chalk_1.default.blue(`[INFO] ${this.mask(message)}`), ...args.map((a) => this.maskArg(a)));
+        }
+    }
+    success(message, ...args) {
+        if (this.level <= LogLevel.INFO) {
+            console.log(chalk_1.default.green(`✓ ${this.mask(message)}`), ...args.map((a) => this.maskArg(a)));
+        }
+    }
+    warn(message, ...args) {
+        if (this.level <= LogLevel.WARN) {
+            console.warn(chalk_1.default.yellow(`[WARN] ${this.mask(message)}`), ...args.map((a) => this.maskArg(a)));
+        }
+    }
+    error(message, ...args) {
+        if (this.level <= LogLevel.ERROR) {
+            console.error(chalk_1.default.red(`[ERROR] ${this.mask(message)}`), ...args.map((a) => this.maskArg(a)));
+        }
+    }
+    step(message) {
+        console.log(chalk_1.default.cyan(`\n→ ${this.mask(message)}`));
+    }
+    result(message, success) {
+        const icon = success ? '✓' : '✗';
+        const color = success ? chalk_1.default.green : chalk_1.default.red;
+        console.log(color(`${icon} ${this.mask(message)}`));
+    }
+}
+exports.logger = new Logger();
+//# sourceMappingURL=logger.js.map

package/dist/utils/repository.js

@@ -0,0 +1,51 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.repositoryRoot = repositoryRoot;
+const path = __importStar(require("path"));
+/**
+ * The repository root that `./` references in a workflow resolve against
+ * (as on GitHub, where they're relative to the repository, not the file):
+ * the directory holding `.github/workflows/<file>`, else the current
+ * directory.
+ */
+function repositoryRoot(workflowPath) {
+    const dir = path.dirname(path.resolve(workflowPath));
+    return path.basename(dir) === 'workflows' &&
+        path.basename(path.dirname(dir)) === '.github'
+        ? path.dirname(path.dirname(dir))
+        : process.cwd();
+}
+//# sourceMappingURL=repository.js.map

package/package.json

@@ -1,6 +1,79 @@
 {
   "name": "@secureci/cli",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "0.1.0",
+  "description": "SecureCI: validate, check against pipeline standards, and run GitHub Actions workflows locally",
+  "main": "dist/index.js",
+  "bin": {
+    "secureci": "./dist/cli.js"
+  },
+  "files": [
+    "dist/**/*.js",
+    "!dist/**/*.test.js",
+    "README.md",
+    "LICENSE"
+  ],
+  "scripts": {
+    "build": "tsc",
+    "test": "vitest run",
+    "test:watch": "vitest",
+    "test:coverage": "vitest run --coverage",
+    "dev": "tsc --watch",
+    "lint": "eslint src --ext .ts",
+    "format": "prettier --write .",
+    "prepare": "npm run build"
+  },
+  "keywords": [
+    "github-actions",
+    "workflow",
+    "ci",
+    "cli",
+    "security",
+    "policy-as-code",
+    "secureci"
+  ],
+  "author": {
+    "name": "SecureCI",
+    "email": "hello@secure-ci.dev"
+  },
+  "contributors": [
+    {
+      "name": "Jabran Rafique",
+      "email": "hello@jabran.me"
+    }
+  ],
+  "license": "MIT",
+  "homepage": "https://www.secure-ci.dev",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/secure-ci/cli.git"
+  },
+  "bugs": {
+    "url": "https://github.com/secure-ci/cli/issues"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "engines": {
+    "node": ">=20"
+  },
+  "prettier": "@jabraf/prettier",
+  "dependencies": {
+    "chalk": "^4.1.2",
+    "commander": "^11.1.0",
+    "yaml": "^2.3.4"
+  },
+  "devDependencies": {
+    "@jabraf/dev": "^0.1.4",
+    "@jabraf/prettier": "^3.0.1",
+    "@types/node": "^20.10.6",
+    "@typescript-eslint/eslint-plugin": "^8.71.1",
+    "@typescript-eslint/parser": "^8.71.1",
+    "@vitest/coverage-v8": "^4.1.11",
+    "eslint": "^8.56.0",
+    "typescript": "^5.3.3",
+    "vitest": "^4.1.11"
+  },
+  "volta": {
+    "node": "24.0.0"
+  }
+}