@secureci/cli 0.1.1 → 0.2.0

package/README.md

@@ -7,7 +7,7 @@ Test and vet your GitHub Actions **before you push**.
 `@secureci/cli` (the `secureci` command) runs your workflows locally, validates
 them, and checks them against your organization's pipeline standards — without
 committing, pushing, or waiting on a CI runner. It is the free, open-source part
-of [SecureCI](https://www.secure-ci.dev).
+of [SecureCI](https://secure-ci.dev).
 
 > 📖 This README is the quick tour. Every flag, context and edge case lives in
 > the **[full reference → DOCS.md](DOCS.md)**.
@@ -38,8 +38,8 @@ npm install -g @secureci/cli
 npx @secureci/cli --help
 ```
 
-Node.js 20+ is required. (Until the package is published to npm, build from
-source: `npm install && npm run build`.)
+Node.js 20+ is required. To build from source instead:
+`npm install && npm run build`.
 
 ## First run
 
@@ -74,6 +74,11 @@ secureci inventory --check    # fail on drift (use in CI)
   check.
 - **Machine-readable output** — `--format json|sarif` drops straight into CI and
   GitHub code scanning.
+- **Audit evidence** — the contract, `secureci.lock` and reports are plain files
+  you can commit and keep. See
+  [using output as audit evidence](DOCS.md#using-output-as-audit-evidence) and
+  the [compliance mapping](https://secure-ci.dev/compliance) (PCI DSS, DORA,
+  NIS2, ISO 27001, SOC 2 and more).
 
 See the [reference](DOCS.md) for the complete command list and flags.
 

package/dist/cli.js

@@ -413,6 +413,7 @@ function runInit(options) {
         process.exit(1);
     }
     const content = (0, init_1.renderInitWorkflow)({
+        version: readVersion(),
         contract: options.contract,
         upload: options.upload
     });

package/dist/init.js

@@ -3,7 +3,8 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.renderInitWorkflow = renderInitWorkflow;
 /**
  * Render a ready-to-commit `.github/workflows/secureci.yml` that runs SecureCI
- * on every pull request via the published `secure-ci/cli` action.
+ * on every pull request via the published `secure-ci/cli` action, pinned to
+ * the release tag matching this CLI's version.
  *
  * The output is deterministic for a given set of options, so it can be
  * regenerated and diffed. With uploads on (the default) the workflow asks for
@@ -26,7 +27,7 @@ function renderInitWorkflow(options) {
     ];
     if (upload)
         lines.push('  security-events: write');
-    lines.push('', 'jobs:', '  secureci:', '    runs-on: ubuntu-latest', '    steps:', '      - uses: actions/checkout@v4', '      - uses: secure-ci/cli@v1');
+    lines.push('', 'jobs:', '  secureci:', '    runs-on: ubuntu-latest', '    steps:', '      - uses: actions/checkout@v4', `      - uses: secure-ci/cli@v${options.version}`);
     const withLines = [];
     if (contract)
         withLines.push(`          contract: ${yamlScalar(contract)}`);

package/dist/report.js

@@ -59,7 +59,7 @@ function formatReport(entries, format) {
                 tool: {
                     driver: {
                         name: 'secureci',
-                        informationUri: 'https://www.secure-ci.dev',
+                        informationUri: 'https://secure-ci.dev',
                         rules: Object.entries(RULES).map(([id, name]) => ({ id, name }))
                     }
                 },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@secureci/cli",
-  "version": "0.1.1",
+  "version": "0.2.0",
   "description": "SecureCI: validate, check against pipeline standards, and run GitHub Actions workflows locally",
   "main": "dist/index.js",
   "bin": {
@@ -42,7 +42,7 @@
     }
   ],
   "license": "MIT",
-  "homepage": "https://www.secure-ci.dev",
+  "homepage": "https://secure-ci.dev",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/secure-ci/cli.git"