@secureci/cli 0.1.0 → 0.1.1

package/README.md

@@ -162,8 +162,26 @@ The exact scope of each is documented in
   redacted in all output, and in container mode never appear on the client
   command line (passed via a `0600` env file). Prefer `--secret NAME` so the
   value stays out of your shell history too.
-- **Tokens are handled carefully** — only sent to GitHub, never passed to
-  actions, masked in logs.
+- **Tokens are handled carefully** — sent only to the GitHub host in
+  `GITHUB_SERVER_URL` / `GITHUB_API_URL` (github.com by default), never passed
+  to actions, and masked in logs.
+
+### What the package accesses, and why
+
+Installing and running `secureci` involves these capabilities. Each is needed for
+the feature named, and none runs at install time.
+
+| Capability               | Where                                                                  | Why                                                                                                                                                                                       |
+| ------------------------ | ---------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| Shell / process spawning | `run:` steps, JavaScript actions, `docker`/`podman`/`nerdctl`          | Runs workflow steps in a container (or on your host with `--container-runtime host`). `commander` also loads `child_process`, used only for executable subcommands this CLI does not use. |
+| Network                  | `github.com`, `api.github.com` (or the GHES host you set)              | Downloads actions and workflows, and resolves tags to commit SHAs.                                                                                                                        |
+| Environment variables    | `HOME`, `PATH`, `GITHUB_*`, `GITHUB_TOKEN`, `GH_TOKEN`                 | Builds the runner environment and authenticates GitHub downloads.                                                                                                                         |
+| Filesystem               | `~/.secureci/`, the working directory, temp dirs                       | Caches actions, stores artifacts and config, and reads your workflow files.                                                                                                               |
+| Hard-coded URLs          | GitHub documentation and JSON Schema URLs in messages and editor hints | Informational only; the CLI does not fetch them.                                                                                                                                          |
+
+No install scripts run for consumers. The published tarball contains only
+`dist/`, `README.md`, and `LICENSE`. See [SECURITY.md](SECURITY.md) for how to
+report a vulnerability.
 
 Full details: [DOCS.md → Security: what runs where](DOCS.md#security-what-runs-where)
 and [Secret masking](DOCS.md#secret-masking).
@@ -199,4 +217,15 @@ humans and agents live in [AGENTS.md](AGENTS.md) and
 
 ## License
 
-MIT
+The code is licensed under the [MIT License](LICENSE).
+
+## Name and trademark
+
+The **code** is open source under MIT; the **SecureCI name and logo** are not.
+"SecureCI", the `secureci` command branding, and the `@secureci` npm scope are
+trademarks of SecureCI. You may use the name to describe your use of this
+software (for example, "works with SecureCI"), but you may not use it to name or
+brand a fork, a derivative product or service, or a hosted offering, and you may
+not imply endorsement by SecureCI. Forks must use a different name and must not
+publish under the `@secureci` scope. These rights are reserved and are not granted by the
+MIT License.

package/dist/utils/ansi.js

@@ -0,0 +1,47 @@
+"use strict";
+/**
+ * Minimal terminal colouring for log output. Replaces `chalk`, whose
+ * transitive dependencies (supports-color, has-flag, ansi-styles, ...) pull in
+ * an unmaintained package and add supply-chain surface for a few log colours.
+ *
+ * Colour is used only on a terminal, and is turned off by NO_COLOR or
+ * TERM=dumb, or turned on by FORCE_COLOR, following the same conventions chalk
+ * followed.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.colors = void 0;
+exports.createColors = createColors;
+// [open, close] SGR codes.
+const CODES = {
+    gray: [90, 39],
+    red: [31, 39],
+    green: [32, 39],
+    yellow: [33, 39],
+    blue: [34, 39],
+    cyan: [36, 39]
+};
+function colorEnabled(env, isTTY) {
+    if (env.NO_COLOR !== undefined && env.NO_COLOR !== '')
+        return false;
+    if (env.TERM === 'dumb')
+        return false;
+    if (env.FORCE_COLOR !== undefined && env.FORCE_COLOR !== '0')
+        return true;
+    return isTTY;
+}
+/** Build the colour functions for a given environment and output stream. */
+function createColors(env, isTTY) {
+    const enabled = colorEnabled(env, isTTY);
+    const paint = ([open, close]) => (text) => enabled ? `\u001b[${open}m${text}\u001b[${close}m` : text;
+    return {
+        gray: paint(CODES.gray),
+        red: paint(CODES.red),
+        green: paint(CODES.green),
+        yellow: paint(CODES.yellow),
+        blue: paint(CODES.blue),
+        cyan: paint(CODES.cyan)
+    };
+}
+/** Colours for the process's stdout. */
+exports.colors = createColors(process.env, Boolean(process.stdout.isTTY));
+//# sourceMappingURL=ansi.js.map

package/dist/utils/logger.js

@@ -1,10 +1,7 @@
 "use strict";
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.logger = exports.LogLevel = void 0;
-const chalk_1 = __importDefault(require("chalk"));
+const ansi_1 = require("./ansi");
 var LogLevel;
 (function (LogLevel) {
     LogLevel[LogLevel["DEBUG"] = 0] = "DEBUG";
@@ -51,35 +48,35 @@ class Logger {
     }
     debug(message, ...args) {
         if (this.level <= LogLevel.DEBUG) {
-            console.log(chalk_1.default.gray(`[DEBUG] ${this.mask(message)}`), ...args.map((a) => this.maskArg(a)));
+            console.log(ansi_1.colors.gray(`[DEBUG] ${this.mask(message)}`), ...args.map((a) => this.maskArg(a)));
         }
     }
     info(message, ...args) {
         if (this.level <= LogLevel.INFO) {
-            console.log(chalk_1.default.blue(`[INFO] ${this.mask(message)}`), ...args.map((a) => this.maskArg(a)));
+            console.log(ansi_1.colors.blue(`[INFO] ${this.mask(message)}`), ...args.map((a) => this.maskArg(a)));
         }
     }
     success(message, ...args) {
         if (this.level <= LogLevel.INFO) {
-            console.log(chalk_1.default.green(`✓ ${this.mask(message)}`), ...args.map((a) => this.maskArg(a)));
+            console.log(ansi_1.colors.green(`✓ ${this.mask(message)}`), ...args.map((a) => this.maskArg(a)));
         }
     }
     warn(message, ...args) {
         if (this.level <= LogLevel.WARN) {
-            console.warn(chalk_1.default.yellow(`[WARN] ${this.mask(message)}`), ...args.map((a) => this.maskArg(a)));
+            console.warn(ansi_1.colors.yellow(`[WARN] ${this.mask(message)}`), ...args.map((a) => this.maskArg(a)));
         }
     }
     error(message, ...args) {
         if (this.level <= LogLevel.ERROR) {
-            console.error(chalk_1.default.red(`[ERROR] ${this.mask(message)}`), ...args.map((a) => this.maskArg(a)));
+            console.error(ansi_1.colors.red(`[ERROR] ${this.mask(message)}`), ...args.map((a) => this.maskArg(a)));
         }
     }
     step(message) {
-        console.log(chalk_1.default.cyan(`\n→ ${this.mask(message)}`));
+        console.log(ansi_1.colors.cyan(`\n→ ${this.mask(message)}`));
     }
     result(message, success) {
         const icon = success ? '✓' : '✗';
-        const color = success ? chalk_1.default.green : chalk_1.default.red;
+        const color = success ? ansi_1.colors.green : ansi_1.colors.red;
         console.log(color(`${icon} ${this.mask(message)}`));
     }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@secureci/cli",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "description": "SecureCI: validate, check against pipeline standards, and run GitHub Actions workflows locally",
   "main": "dist/index.js",
   "bin": {
@@ -58,7 +58,6 @@
   },
   "prettier": "@jabraf/prettier",
   "dependencies": {
-    "chalk": "^4.1.2",
     "commander": "^11.1.0",
     "yaml": "^2.3.4"
   },