@secureci/cli 0.0.0-stage → 0.1.0

package/dist/cli.js

@@ -0,0 +1,545 @@
+#!/usr/bin/env node
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+const commander_1 = require("commander");
+const dry_run_1 = require("./runner/dry-run");
+const executor_1 = require("./runner/executor");
+const action_fetcher_1 = require("./runner/action-fetcher");
+const validator_1 = require("./parser/validator");
+const workflow_parser_1 = require("./parser/workflow-parser");
+const pipeline_contract_parser_1 = require("./parser/pipeline-contract-parser");
+const pipeline_contract_validator_1 = require("./parser/pipeline-contract-validator");
+const report_1 = require("./report");
+const init_1 = require("./init");
+const inventory_1 = require("./inventory");
+const logger_1 = require("./utils/logger");
+const key_value_1 = require("./utils/key-value");
+const config_1 = require("./config");
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+/** Committed at the repo root, like package-lock.json / yarn.lock. */
+const LOCKFILE_NAME = 'secureci.lock';
+function readVersion() {
+    try {
+        const pkg = JSON.parse(fs.readFileSync(path.join(__dirname, '..', 'package.json'), 'utf-8'));
+        return String(pkg.version);
+    }
+    catch {
+        return '0.0.0';
+    }
+}
+const program = new commander_1.Command();
+const globalConfig = (0, config_1.loadConfig)();
+// An invalid container-runtime in the config file only stops `run`, so
+// `secureci config set` can still fix it.
+let configError;
+let defaultContainerRuntime;
+try {
+    defaultContainerRuntime = (0, config_1.getDefaultContainerRuntime)(globalConfig);
+}
+catch (error) {
+    configError = error instanceof Error ? error.message : String(error);
+    defaultContainerRuntime = 'docker';
+}
+program
+    .name('secureci')
+    .description('SecureCI: validate, check and run GitHub Actions workflows locally')
+    .version(readVersion(), '-V, --version', 'Print the version')
+    .helpOption('-h, --help', 'Show help')
+    .addHelpCommand('help [command]', 'Show help for a command')
+    .option('--verbose', 'Log debug output')
+    .showHelpAfterError()
+    .hook('preAction', (thisCommand) => {
+    if (thisCommand.opts().verbose) {
+        logger_1.logger.setLevel(logger_1.LogLevel.DEBUG);
+    }
+});
+function requireFile(file) {
+    if (!fs.existsSync(file)) {
+        logger_1.logger.error(`File not found: ${file}`);
+        process.exit(1);
+    }
+}
+program
+    .command('run')
+    .description('Run a workflow (or composite action) on this machine, each job in a container')
+    .argument('<file>', 'Path to a workflow or action YAML file')
+    .option('-d, --dry-run', 'Show what would run, without executing anything')
+    .option('-i, --input <key=value...>', 'Set an input for the inputs context. Repeatable')
+    .option('-s, --secret <key=value|NAME...>', 'Set a secret for the secrets context. A bare NAME reads $NAME from your shell, keeping the value off the command line. Repeatable')
+    .option('--env <key=value|NAME...>', 'Set an env var for every step, below workflow/job/step env:. A bare NAME passes $NAME from your shell (steps get nothing else from it). Repeatable')
+    .option('--var <key=value...>', 'Set a configuration variable for the vars context. Repeatable')
+    .option('--event-path <file>', 'Read the event payload (github.event, $GITHUB_EVENT_PATH) from a JSON file')
+    .option('--event-name <name>', 'Set github.event_name. Default: $GITHUB_EVENT_NAME, else workflow_dispatch if declared, else the first trigger')
+    .option('-j, --job <name>', 'Run only this job')
+    .option('--offline', 'Use only cached remote actions and workflows; never download')
+    .option('--no-local-checkout', 'Run the real actions/checkout for this repository instead of using the working copy')
+    .addOption(new commander_1.Option('--container-runtime <name>', 'Container engine for jobs. "host" runs steps directly on this machine, without a container. Config: container-runtime')
+    .choices(['auto', 'docker', 'podman', 'containerd', 'host'])
+    .default(defaultContainerRuntime))
+    .option('--container-image <image>', 'Use this image for every job without jobs.<id>.container, instead of the image for its runs-on (config: runner-images, container-image)')
+    .option('--container-timeout <ms>', 'Fail a step that runs longer than this, in milliseconds (container mode). Config: container-timeout', globalConfig['container-timeout'] !== undefined
+    ? String(globalConfig['container-timeout'])
+    : undefined)
+    .option('--container-memory <limit>', 'Limit job container memory, e.g. 512m. Config: container-memory', globalConfig['container-memory'])
+    .option('--no-network', 'Turn off container network access (on by default)')
+    .option('--allow-network', 'Turn on container network access, overriding allow-network: false in the config')
+    .action(async (file, options) => {
+    if (configError) {
+        logger_1.logger.error(configError);
+        process.exit(1);
+    }
+    requireFile(file);
+    if (options.dryRun) {
+        const result = (0, dry_run_1.dryRun)(file);
+        if (!result.success) {
+            process.exit(1);
+        }
+        return;
+    }
+    logger_1.logger.info("Running the workflow for real (not a dry run). Use --dry-run to simulate without executing, or 'secureci validate' to only check for errors.");
+    try {
+        const inputs = (0, key_value_1.parseKeyValuePairs)(options.input, '--input');
+        const secrets = (0, key_value_1.parseKeyValuePairs)(options.secret, '--secret', {
+            redact: true,
+            fromEnv: process.env
+        });
+        const vars = (0, key_value_1.parseKeyValuePairs)(options.var, '--var');
+        const env = (0, key_value_1.parseKeyValuePairs)(options.env, '--env', {
+            fromEnv: process.env
+        });
+        const result = await (0, executor_1.executeWorkflow)(file, {
+            dryRun: false,
+            inputs,
+            secrets,
+            vars,
+            env,
+            eventPath: options.eventPath,
+            eventName: options.eventName,
+            job: options.job,
+            localCheckout: options.localCheckout,
+            offline: options.offline,
+            verbose: program.opts().verbose,
+            containerRuntime: options.containerRuntime,
+            containerImage: options.containerImage,
+            runnerImages: globalConfig['runner-images'],
+            defaultContainerImage: globalConfig['container-image'],
+            containerTimeoutMs: options.containerTimeout
+                ? Number(options.containerTimeout)
+                : undefined,
+            containerMemoryLimit: options.containerMemory,
+            networkDisabled: (0, config_1.resolveNetworkDisabled)({ network: options.network, allowNetwork: options.allowNetwork }, globalConfig)
+        });
+        if (!result.success) {
+            process.exit(1);
+        }
+    }
+    catch (error) {
+        logger_1.logger.error(`Failed to process file: ${error instanceof Error ? error.message : 'Unknown error'}`);
+        process.exit(1);
+    }
+});
+program
+    .command('validate')
+    .description('Validate one or more workflow or action files, optionally against a pipeline contract')
+    .argument('<file...>', 'Paths to workflow or action YAML files')
+    .option('-c, --contract <file>', 'Also check the workflow against a pipeline contract (required/forbidden actions, minimum versions, ordering)')
+    .addOption(new commander_1.Option('--contract-recurse <scope>', 'Composite actions / reusable workflows to look inside for --contract: none, local (./...) or all (also downloads remote ones)')
+    .choices(['none', 'local', 'all'])
+    .default('local'))
+    .addOption(new commander_1.Option('--format <format>', 'Output format: text (default), or json / sarif for machine-readable results (sarif uploads to GitHub code scanning)')
+    .choices(['text', 'json', 'sarif'])
+    .default('text'))
+    .action(async (files, options) => {
+    files.forEach(requireFile);
+    await validateFiles(files, options.contract, options.contractRecurse, options.format);
+});
+program
+    .command('inventory')
+    .description('List the actions and reusable workflows a workflow uses (resolved into called workflows/actions), with their commit SHAs; track supply-chain drift with a committed secureci.lock')
+    .argument('[file...]', 'Workflow files (default: every file in .github/workflows)')
+    .option('--offline', 'Do not resolve tags to commit SHAs over the network (already-pinned refs still resolve)')
+    .option('--dry-run', `Print the resolved inventory as JSON without writing or checking ${LOCKFILE_NAME}`)
+    .option('--update-lock', `Write/update ./${LOCKFILE_NAME} with the current commit SHAs (commit it to your repo)`)
+    .option('--update-lockfile', `Alias of --update-lock`)
+    .option('--check', `Compare the current commit SHAs against ./${LOCKFILE_NAME} and fail on drift`)
+    .option('--compare', `Alias of --check`)
+    .action(async (files, options) => {
+    await runInventory(files, options);
+});
+program
+    .command('list')
+    .description('List workflows in .github/workflows/')
+    .action(() => {
+    listWorkflows();
+});
+const initCommand = program
+    .command('init')
+    .description('Scaffold SecureCI files (run a subcommand, e.g. `init workflow`)')
+    .action(() => {
+    // Bare `secureci init` is ambiguous about what it creates, so show help
+    // (and its subcommands) instead of generating anything.
+    initCommand.help();
+});
+initCommand
+    .command('workflow')
+    .description('Generate a GitHub Actions workflow (.github/workflows/secureci.yml) that runs SecureCI on pull requests')
+    .option('-c, --contract <file>', 'Check workflows against this pipeline contract in the generated workflow')
+    .option('--no-upload', 'Do not upload SARIF to code scanning (keeps contents: read only)')
+    .option('-o, --output <path>', 'Where to write the workflow', '.github/workflows/secureci.yml')
+    .option('-f, --force', 'Overwrite the output file if it already exists')
+    .action((options) => {
+    runInit(options);
+});
+function defaultWorkflowFiles() {
+    const dir = path.join(process.cwd(), '.github', 'workflows');
+    if (!fs.existsSync(dir))
+        return [];
+    return fs
+        .readdirSync(dir)
+        .filter((f) => f.endsWith('.yml') || f.endsWith('.yaml'))
+        .map((f) => path.join('.github', 'workflows', f));
+}
+async function runInventory(files, options) {
+    const update = options.updateLock || options.updateLockfile;
+    const check = options.check || options.compare;
+    if (update && check) {
+        logger_1.logger.error('Use either --update-lock or --check, not both.');
+        process.exit(1);
+    }
+    const targets = files.length > 0 ? files : defaultWorkflowFiles();
+    if (targets.length === 0) {
+        logger_1.logger.error('No workflow files given and none found in .github/workflows');
+        process.exit(1);
+    }
+    targets.forEach(requireFile);
+    const resolver = options.offline
+        ? undefined
+        : (uses) => (0, action_fetcher_1.resolveActionSha)(uses);
+    // Merge every file's remote actions by `uses`.
+    const byUses = new Map();
+    for (const file of targets) {
+        try {
+            const parsed = (0, workflow_parser_1.parseFile)(file);
+            if (parsed.type !== 'workflow')
+                continue;
+            const inv = await (0, inventory_1.buildInventory)({ type: 'workflow', path: file, file: parsed.file }, resolver);
+            for (const action of inv.actions) {
+                const existing = byUses.get(action.uses);
+                if (existing)
+                    existing.paths.push(...action.paths);
+                else
+                    byUses.set(action.uses, { ...action });
+            }
+        }
+        catch (error) {
+            logger_1.logger.error(`Could not read ${file}: ${error instanceof Error ? error.message : 'Unknown error'}`);
+            process.exit(1);
+        }
+    }
+    const actions = [...byUses.values()].sort((a, b) => a.uses.localeCompare(b.uses));
+    const current = {};
+    for (const action of actions) {
+        if (action.resolvedSha)
+            current[action.uses] = action.resolvedSha;
+    }
+    // --dry-run: print the resolved inventory as JSON, touching nothing.
+    if (options.dryRun) {
+        // eslint-disable-next-line no-console
+        console.log(JSON.stringify({ actions }, null, 2));
+        return;
+    }
+    const lockPath = path.join(process.cwd(), LOCKFILE_NAME);
+    const lockExists = fs.existsSync(lockPath);
+    const writeLock = () => {
+        const updated = { version: 1, actions: current };
+        fs.writeFileSync(lockPath, JSON.stringify(updated, null, 2) + '\n');
+        logger_1.logger.success(`Wrote ${Object.keys(current).length} action(s) to ${LOCKFILE_NAME}. Commit it to track supply-chain drift.`);
+    };
+    // `--update-lock`, or bare `inventory` when no lockfile exists yet: write it.
+    if (update || (!check && !lockExists)) {
+        writeLock();
+        return;
+    }
+    // Otherwise compare (explicit `--check`, or bare `inventory` with a lockfile).
+    if (!lockExists) {
+        logger_1.logger.error(`No ${LOCKFILE_NAME} found. Create one with: secureci inventory --update-lock`);
+        process.exit(1);
+    }
+    const lock = JSON.parse(fs.readFileSync(lockPath, 'utf-8'));
+    const diff = (0, inventory_1.diffLock)(current, lock);
+    for (const d of diff.drifted) {
+        logger_1.logger.error(`Drift: ${d.uses} now resolves to ${d.to.slice(0, 12)} (was ${d.from.slice(0, 12)})`);
+    }
+    diff.added.forEach((u) => logger_1.logger.warn(`New action not in ${LOCKFILE_NAME}: ${u}`));
+    diff.removed.forEach((u) => logger_1.logger.info(`In ${LOCKFILE_NAME} but no longer used: ${u}`));
+    if (diff.drifted.length > 0) {
+        logger_1.logger.error(`Action commits drifted from ${LOCKFILE_NAME}. Review the change, then run with --update-lock to accept it.`);
+        process.exit(1);
+    }
+    if (diff.added.length > 0) {
+        logger_1.logger.warn(`New actions are not yet in ${LOCKFILE_NAME} (run --update-lock).`);
+        process.exit(1);
+    }
+    logger_1.logger.success(`No action drift against ${LOCKFILE_NAME}.`);
+}
+async function validateOneFile(filePath, contractFile, recurse, say) {
+    const parsed = (0, workflow_parser_1.parseFile)(filePath);
+    let result;
+    if (parsed.type === 'workflow') {
+        result = (0, validator_1.validateWorkflow)(filePath);
+        say(() => logger_1.logger.info(`Validating workflow: ${filePath}`));
+    }
+    else {
+        result = (0, validator_1.validateAction)(filePath);
+        say(() => logger_1.logger.info(`Validating action: ${filePath}`));
+    }
+    if (contractFile) {
+        say(() => logger_1.logger.info(`Validating against pipeline contract: ${contractFile}`));
+        if (parsed.type !== 'workflow') {
+            result = {
+                valid: false,
+                errors: [
+                    ...result.errors,
+                    {
+                        path: 'root',
+                        message: 'Pipeline contracts validate job/step sequences and only apply to workflow files, not actions',
+                        severity: 'error'
+                    }
+                ]
+            };
+        }
+        else {
+            const spec = (0, pipeline_contract_parser_1.parsePipelineContract)(contractFile);
+            const contractResult = await (0, pipeline_contract_validator_1.validatePipelineContract)(parsed, spec, {
+                recurse
+            });
+            result = {
+                valid: result.valid && contractResult.valid,
+                errors: [...result.errors, ...contractResult.errors]
+            };
+        }
+    }
+    return result;
+}
+async function validateFiles(files, contractFile, recurse = 'local', format = 'text') {
+    // Only text mode narrates; json/sarif write nothing but the report to
+    // stdout, so the output is pipeable.
+    const quiet = format !== 'text';
+    const say = (fn) => {
+        if (!quiet)
+            fn();
+    };
+    const entries = [];
+    for (const filePath of files) {
+        try {
+            const result = await validateOneFile(filePath, contractFile, recurse, say);
+            entries.push({ file: filePath, result });
+        }
+        catch (error) {
+            entries.push({
+                file: filePath,
+                result: {
+                    valid: false,
+                    errors: [
+                        {
+                            path: 'root',
+                            message: error instanceof Error ? error.message : 'Unknown error',
+                            severity: 'error'
+                        }
+                    ]
+                }
+            });
+        }
+    }
+    const allValid = entries.every((e) => e.result.valid);
+    if (quiet) {
+        // eslint-disable-next-line no-console
+        console.log((0, report_1.formatReport)(entries, format));
+        if (!allValid)
+            process.exit(1);
+        return;
+    }
+    for (const { file, result } of entries) {
+        if (result.valid) {
+            logger_1.logger.success(`Validation passed: ${file}`);
+            result.errors.forEach((error) => logger_1.logger.warn(`  [${error.severity.toUpperCase()}] ${error.path}: ${error.message}`));
+        }
+        else {
+            logger_1.logger.error(`Validation failed: ${file}`);
+            result.errors.forEach((error) => logger_1.logger.error(`  [${error.severity.toUpperCase()}] ${error.path}: ${error.message}`));
+        }
+    }
+    if (!allValid)
+        process.exit(1);
+}
+function runInit(options) {
+    const output = path.resolve(process.cwd(), options.output);
+    if (fs.existsSync(output) && !options.force) {
+        logger_1.logger.error(`${options.output} already exists; pass --force to overwrite it.`);
+        process.exit(1);
+    }
+    const content = (0, init_1.renderInitWorkflow)({
+        contract: options.contract,
+        upload: options.upload
+    });
+    fs.mkdirSync(path.dirname(output), { recursive: true });
+    fs.writeFileSync(output, content);
+    logger_1.logger.success(`Wrote ${options.output}`);
+    if (options.upload) {
+        logger_1.logger.info('The workflow uploads SARIF to code scanning (needs security-events: write).');
+    }
+    logger_1.logger.info('Commit it and open a pull request to see SecureCI run.');
+}
+function listWorkflows() {
+    const workflowsDir = path.join(process.cwd(), '.github', 'workflows');
+    if (!fs.existsSync(workflowsDir)) {
+        logger_1.logger.warn('No .github/workflows directory found in current directory');
+        return;
+    }
+    const files = fs
+        .readdirSync(workflowsDir)
+        .filter((f) => f.endsWith('.yml') || f.endsWith('.yaml'));
+    if (files.length === 0) {
+        logger_1.logger.info('No workflow files found');
+        return;
+    }
+    logger_1.logger.info('Available workflows:');
+    files.forEach((file) => {
+        const filePath = path.join(workflowsDir, file);
+        try {
+            const parsed = (0, workflow_parser_1.parseFile)(filePath);
+            if (parsed.type === 'workflow') {
+                logger_1.logger.info(`  - ${file}: ${parsed.file.name}`);
+            }
+        }
+        catch {
+            logger_1.logger.warn(`  - ${file}: (failed to parse)`);
+        }
+    });
+}
+const configCmd = program
+    .command('config')
+    .description('Manage global configuration (~/.secureci/config.yml)');
+configCmd
+    .command('path')
+    .description('Print the config file path')
+    .action(() => {
+    logger_1.logger.info((0, config_1.getConfigFilePath)());
+});
+configCmd
+    .command('list')
+    .description('List config values, including built-in defaults')
+    .action(() => {
+    const config = (0, config_1.loadConfig)();
+    for (const key of config_1.CONFIG_KEYS) {
+        const value = config[key];
+        const fallback = config_1.DEFAULT_CONFIG[key];
+        logger_1.logger.info(`${key}=${value !== undefined
+            ? value
+            : fallback !== undefined
+                ? `${fallback} (default)`
+                : '(unset)'}`);
+    }
+    for (const [label, image] of Object.entries(config['runner-images'] ?? {})) {
+        logger_1.logger.info(`runner-images.${label}=${image}`);
+    }
+});
+configCmd
+    .command('get <key>')
+    .description('Print a config value')
+    .action((key) => {
+    if (!(0, config_1.isValidConfigKey)(key)) {
+        logger_1.logger.error(`Unknown config key "${key}". Valid keys: ${config_1.CONFIG_KEYS.join(', ')}, runner-images.<label>`);
+        process.exit(1);
+    }
+    const value = (0, config_1.getConfigValue)((0, config_1.loadConfig)(), key);
+    logger_1.logger.info(value === undefined ? '(unset)' : String(value));
+});
+configCmd
+    .command('set <key> <value>')
+    .description('Set a config value')
+    .action((key, value) => {
+    if (!(0, config_1.isValidConfigKey)(key)) {
+        logger_1.logger.error(`Unknown config key "${key}". Valid keys: ${config_1.CONFIG_KEYS.join(', ')}, runner-images.<label>`);
+        process.exit(1);
+    }
+    try {
+        const config = (0, config_1.loadConfig)();
+        const parsedValue = (0, config_1.setConfigValue)(config, key, value);
+        (0, config_1.saveConfig)(config);
+        logger_1.logger.success(`Set ${key}=${parsedValue} in ${(0, config_1.getConfigFilePath)()}`);
+    }
+    catch (error) {
+        logger_1.logger.error(error instanceof Error ? error.message : 'Invalid value');
+        process.exit(1);
+    }
+});
+configCmd
+    .command('unset <key>')
+    .description('Remove a config value, reverting to the built-in default')
+    .action((key) => {
+    if (!(0, config_1.isValidConfigKey)(key)) {
+        logger_1.logger.error(`Unknown config key "${key}". Valid keys: ${config_1.CONFIG_KEYS.join(', ')}, runner-images.<label>`);
+        process.exit(1);
+    }
+    const config = (0, config_1.loadConfig)();
+    (0, config_1.unsetConfigValue)(config, key);
+    (0, config_1.saveConfig)(config);
+    logger_1.logger.success(`Unset ${key} in ${(0, config_1.getConfigFilePath)()}`);
+});
+const cacheCmd = program
+    .command('cache')
+    .description('Manage the cache of downloaded remote actions');
+cacheCmd
+    .command('path')
+    .description('Print the action cache directory')
+    .action(() => {
+    logger_1.logger.info((0, action_fetcher_1.getActionCacheDir)());
+});
+cacheCmd
+    .command('clear')
+    .description('Delete all cached remote actions')
+    .action(() => {
+    (0, action_fetcher_1.clearActionCache)();
+});
+// With no command, show help and fail, like other vendor CLIs.
+if (process.argv.length <= 2) {
+    program.outputHelp({ error: true });
+    process.exit(1);
+}
+program.parse();
+//# sourceMappingURL=cli.js.map