@secureci/cli 0.1.0 → 0.2.0

package/README.md

@@ -7,7 +7,7 @@ Test and vet your GitHub Actions **before you push**.
 `@secureci/cli` (the `secureci` command) runs your workflows locally, validates
 them, and checks them against your organization's pipeline standards — without
 committing, pushing, or waiting on a CI runner. It is the free, open-source part
-of [SecureCI](https://www.secure-ci.dev).
+of [SecureCI](https://secure-ci.dev).
 
 > 📖 This README is the quick tour. Every flag, context and edge case lives in
 > the **[full reference → DOCS.md](DOCS.md)**.
@@ -38,8 +38,8 @@ npm install -g @secureci/cli
 npx @secureci/cli --help
 ```
 
-Node.js 20+ is required. (Until the package is published to npm, build from
-source: `npm install && npm run build`.)
+Node.js 20+ is required. To build from source instead:
+`npm install && npm run build`.
 
 ## First run
 
@@ -74,6 +74,11 @@ secureci inventory --check    # fail on drift (use in CI)
   check.
 - **Machine-readable output** — `--format json|sarif` drops straight into CI and
   GitHub code scanning.
+- **Audit evidence** — the contract, `secureci.lock` and reports are plain files
+  you can commit and keep. See
+  [using output as audit evidence](DOCS.md#using-output-as-audit-evidence) and
+  the [compliance mapping](https://secure-ci.dev/compliance) (PCI DSS, DORA,
+  NIS2, ISO 27001, SOC 2 and more).
 
 See the [reference](DOCS.md) for the complete command list and flags.
 
@@ -162,8 +167,26 @@ The exact scope of each is documented in
   redacted in all output, and in container mode never appear on the client
   command line (passed via a `0600` env file). Prefer `--secret NAME` so the
   value stays out of your shell history too.
-- **Tokens are handled carefully** — only sent to GitHub, never passed to
-  actions, masked in logs.
+- **Tokens are handled carefully** — sent only to the GitHub host in
+  `GITHUB_SERVER_URL` / `GITHUB_API_URL` (github.com by default), never passed
+  to actions, and masked in logs.
+
+### What the package accesses, and why
+
+Installing and running `secureci` involves these capabilities. Each is needed for
+the feature named, and none runs at install time.
+
+| Capability               | Where                                                                  | Why                                                                                                                                                                                       |
+| ------------------------ | ---------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| Shell / process spawning | `run:` steps, JavaScript actions, `docker`/`podman`/`nerdctl`          | Runs workflow steps in a container (or on your host with `--container-runtime host`). `commander` also loads `child_process`, used only for executable subcommands this CLI does not use. |
+| Network                  | `github.com`, `api.github.com` (or the GHES host you set)              | Downloads actions and workflows, and resolves tags to commit SHAs.                                                                                                                        |
+| Environment variables    | `HOME`, `PATH`, `GITHUB_*`, `GITHUB_TOKEN`, `GH_TOKEN`                 | Builds the runner environment and authenticates GitHub downloads.                                                                                                                         |
+| Filesystem               | `~/.secureci/`, the working directory, temp dirs                       | Caches actions, stores artifacts and config, and reads your workflow files.                                                                                                               |
+| Hard-coded URLs          | GitHub documentation and JSON Schema URLs in messages and editor hints | Informational only; the CLI does not fetch them.                                                                                                                                          |
+
+No install scripts run for consumers. The published tarball contains only
+`dist/`, `README.md`, and `LICENSE`. See [SECURITY.md](SECURITY.md) for how to
+report a vulnerability.
 
 Full details: [DOCS.md → Security: what runs where](DOCS.md#security-what-runs-where)
 and [Secret masking](DOCS.md#secret-masking).
@@ -199,4 +222,15 @@ humans and agents live in [AGENTS.md](AGENTS.md) and
 
 ## License
 
-MIT
+The code is licensed under the [MIT License](LICENSE).
+
+## Name and trademark
+
+The **code** is open source under MIT; the **SecureCI name and logo** are not.
+"SecureCI", the `secureci` command branding, and the `@secureci` npm scope are
+trademarks of SecureCI. You may use the name to describe your use of this
+software (for example, "works with SecureCI"), but you may not use it to name or
+brand a fork, a derivative product or service, or a hosted offering, and you may
+not imply endorsement by SecureCI. Forks must use a different name and must not
+publish under the `@secureci` scope. These rights are reserved and are not granted by the
+MIT License.

package/dist/cli.js

@@ -413,6 +413,7 @@ function runInit(options) {
         process.exit(1);
     }
     const content = (0, init_1.renderInitWorkflow)({
+        version: readVersion(),
         contract: options.contract,
         upload: options.upload
     });

package/dist/init.js

@@ -3,7 +3,8 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.renderInitWorkflow = renderInitWorkflow;
 /**
  * Render a ready-to-commit `.github/workflows/secureci.yml` that runs SecureCI
- * on every pull request via the published `secure-ci/cli` action.
+ * on every pull request via the published `secure-ci/cli` action, pinned to
+ * the release tag matching this CLI's version.
  *
  * The output is deterministic for a given set of options, so it can be
  * regenerated and diffed. With uploads on (the default) the workflow asks for
@@ -26,7 +27,7 @@ function renderInitWorkflow(options) {
     ];
     if (upload)
         lines.push('  security-events: write');
-    lines.push('', 'jobs:', '  secureci:', '    runs-on: ubuntu-latest', '    steps:', '      - uses: actions/checkout@v4', '      - uses: secure-ci/cli@v1');
+    lines.push('', 'jobs:', '  secureci:', '    runs-on: ubuntu-latest', '    steps:', '      - uses: actions/checkout@v4', `      - uses: secure-ci/cli@v${options.version}`);
     const withLines = [];
     if (contract)
         withLines.push(`          contract: ${yamlScalar(contract)}`);

package/dist/report.js

@@ -59,7 +59,7 @@ function formatReport(entries, format) {
                 tool: {
                     driver: {
                         name: 'secureci',
-                        informationUri: 'https://www.secure-ci.dev',
+                        informationUri: 'https://secure-ci.dev',
                         rules: Object.entries(RULES).map(([id, name]) => ({ id, name }))
                     }
                 },

package/dist/utils/ansi.js

@@ -0,0 +1,47 @@
+"use strict";
+/**
+ * Minimal terminal colouring for log output. Replaces `chalk`, whose
+ * transitive dependencies (supports-color, has-flag, ansi-styles, ...) pull in
+ * an unmaintained package and add supply-chain surface for a few log colours.
+ *
+ * Colour is used only on a terminal, and is turned off by NO_COLOR or
+ * TERM=dumb, or turned on by FORCE_COLOR, following the same conventions chalk
+ * followed.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.colors = void 0;
+exports.createColors = createColors;
+// [open, close] SGR codes.
+const CODES = {
+    gray: [90, 39],
+    red: [31, 39],
+    green: [32, 39],
+    yellow: [33, 39],
+    blue: [34, 39],
+    cyan: [36, 39]
+};
+function colorEnabled(env, isTTY) {
+    if (env.NO_COLOR !== undefined && env.NO_COLOR !== '')
+        return false;
+    if (env.TERM === 'dumb')
+        return false;
+    if (env.FORCE_COLOR !== undefined && env.FORCE_COLOR !== '0')
+        return true;
+    return isTTY;
+}
+/** Build the colour functions for a given environment and output stream. */
+function createColors(env, isTTY) {
+    const enabled = colorEnabled(env, isTTY);
+    const paint = ([open, close]) => (text) => enabled ? `\u001b[${open}m${text}\u001b[${close}m` : text;
+    return {
+        gray: paint(CODES.gray),
+        red: paint(CODES.red),
+        green: paint(CODES.green),
+        yellow: paint(CODES.yellow),
+        blue: paint(CODES.blue),
+        cyan: paint(CODES.cyan)
+    };
+}
+/** Colours for the process's stdout. */
+exports.colors = createColors(process.env, Boolean(process.stdout.isTTY));
+//# sourceMappingURL=ansi.js.map

package/dist/utils/logger.js

@@ -1,10 +1,7 @@
 "use strict";
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.logger = exports.LogLevel = void 0;
-const chalk_1 = __importDefault(require("chalk"));
+const ansi_1 = require("./ansi");
 var LogLevel;
 (function (LogLevel) {
     LogLevel[LogLevel["DEBUG"] = 0] = "DEBUG";
@@ -51,35 +48,35 @@ class Logger {
     }
     debug(message, ...args) {
         if (this.level <= LogLevel.DEBUG) {
-            console.log(chalk_1.default.gray(`[DEBUG] ${this.mask(message)}`), ...args.map((a) => this.maskArg(a)));
+            console.log(ansi_1.colors.gray(`[DEBUG] ${this.mask(message)}`), ...args.map((a) => this.maskArg(a)));
         }
     }
     info(message, ...args) {
         if (this.level <= LogLevel.INFO) {
-            console.log(chalk_1.default.blue(`[INFO] ${this.mask(message)}`), ...args.map((a) => this.maskArg(a)));
+            console.log(ansi_1.colors.blue(`[INFO] ${this.mask(message)}`), ...args.map((a) => this.maskArg(a)));
         }
     }
     success(message, ...args) {
         if (this.level <= LogLevel.INFO) {
-            console.log(chalk_1.default.green(`✓ ${this.mask(message)}`), ...args.map((a) => this.maskArg(a)));
+            console.log(ansi_1.colors.green(`✓ ${this.mask(message)}`), ...args.map((a) => this.maskArg(a)));
         }
     }
     warn(message, ...args) {
         if (this.level <= LogLevel.WARN) {
-            console.warn(chalk_1.default.yellow(`[WARN] ${this.mask(message)}`), ...args.map((a) => this.maskArg(a)));
+            console.warn(ansi_1.colors.yellow(`[WARN] ${this.mask(message)}`), ...args.map((a) => this.maskArg(a)));
         }
     }
     error(message, ...args) {
         if (this.level <= LogLevel.ERROR) {
-            console.error(chalk_1.default.red(`[ERROR] ${this.mask(message)}`), ...args.map((a) => this.maskArg(a)));
+            console.error(ansi_1.colors.red(`[ERROR] ${this.mask(message)}`), ...args.map((a) => this.maskArg(a)));
         }
     }
     step(message) {
-        console.log(chalk_1.default.cyan(`\n→ ${this.mask(message)}`));
+        console.log(ansi_1.colors.cyan(`\n→ ${this.mask(message)}`));
     }
     result(message, success) {
         const icon = success ? '✓' : '✗';
-        const color = success ? chalk_1.default.green : chalk_1.default.red;
+        const color = success ? ansi_1.colors.green : ansi_1.colors.red;
         console.log(color(`${icon} ${this.mask(message)}`));
     }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@secureci/cli",
-  "version": "0.1.0",
+  "version": "0.2.0",
   "description": "SecureCI: validate, check against pipeline standards, and run GitHub Actions workflows locally",
   "main": "dist/index.js",
   "bin": {
@@ -42,7 +42,7 @@
     }
   ],
   "license": "MIT",
-  "homepage": "https://www.secure-ci.dev",
+  "homepage": "https://secure-ci.dev",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/secure-ci/cli.git"
@@ -58,7 +58,6 @@
   },
   "prettier": "@jabraf/prettier",
   "dependencies": {
-    "chalk": "^4.1.2",
     "commander": "^11.1.0",
     "yaml": "^2.3.4"
   },