@secureci/cli 0.10.0 → 1.0.0

package/README.md

@@ -67,10 +67,10 @@ less install.sh
 sh install.sh
 ```
 
-Set `SECURECI_VERSION=0.10.0` to install a specific release,
+Set `SECURECI_VERSION=1.0.0` to install a specific release,
 `SECURECI_INSTALL_DIR` to install somewhere else, and
 `SECURECI_REQUIRE_ATTESTATION=1` to fail unless `gh` verifies build provenance
-(e.g. `curl -fsSL https://secure-ci.dev/install.sh | SECURECI_VERSION=0.10.0 sh`).
+(e.g. `curl -fsSL https://secure-ci.dev/install.sh | SECURECI_VERSION=1.0.0 sh`).
 `secure-ci.dev/install.sh` redirects to [`install.sh`](install.sh) on this
 repository's `main` branch.
 

package/dist/runner/builtin-actions.js

@@ -391,7 +391,7 @@ async function uploadArtifact(fsys, inputs, runId) {
         copyFile(file.host, path.join(target, ...rel.split('/')));
         digest.update(rel).update(fs.readFileSync(file.host));
     }
-    const id = String(parseInt(crypto.createHash('sha1').update(target).digest('hex').slice(0, 8), 16));
+    const id = String(parseInt(crypto.createHash('sha256').update(target).digest('hex').slice(0, 8), 16));
     return ok(`Uploaded ${files.length} file(s) as artifact "${name}" to ${target}`, {
         'artifact-id': id,
         'artifact-url': '',

package/dist/runner/docker-action.js

@@ -90,7 +90,7 @@ async function executeDockerAction(action, actionPath, step, actionInputs, calle
                 duration: Date.now() - startTime
             };
         }
-        const tag = `secureci-action-${crypto.createHash('sha1').update(actionDir).digest('hex').slice(0, 12)}`;
+        const tag = `secureci-action-${crypto.createHash('sha256').update(actionDir).digest('hex').slice(0, 12)}`;
         logger_1.logger.info(`Building Docker action image: ${action.name} (${tag})`);
         const buildResult = await containerRuntime.build(actionDir, tag, dockerfileRelative);
         if (!buildResult.success) {

package/dist/runner/job-runtime.js

@@ -285,7 +285,7 @@ function actionDirInContainer(container, actionDir) {
     let containerDir = container.actionDirs.get(actionDir);
     if (!containerDir) {
         const hash = crypto
-            .createHash('sha1')
+            .createHash('sha256')
             .update(actionDir)
             .digest('hex')
             .slice(0, 12);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@secureci/cli",
-  "version": "0.10.0",
+  "version": "1.0.0",
   "description": "SecureCI: validate, check against pipeline standards, and run GitHub Actions workflows locally",
   "main": "dist/index.js",
   "bin": {