@secureci/cli 0.10.0 → 1.0.1

package/README.md

@@ -9,6 +9,12 @@ them, and checks them against your organization's pipeline standards — without
 committing, pushing, or waiting on a CI runner. It is the free, open-source part
 of [SecureCI](https://secure-ci.dev).
 
+<a href="https://secure-ci.dev/assets/video/secureci-walkthrough-16x9.mp4"><img src="https://secure-ci.dev/assets/readme-demo.svg" width="848" alt="Terminal demo of the secureci CLI on a demo repository: run executes a workflow locally and its tests pass; validate fails a deploy workflow against a pipeline contract (security scan below the minimum version, wrong step order, actions not pinned to a commit SHA); pin pins actions/checkout@v4 to its full commit SHA, keeping # v4 for Dependabot; inventory --check fails because the v4 tag now resolves to a different commit than the one locked."></a>
+
+<sub>Real output from the CLI on a demo repository.</sub>
+
+▶️ **[Watch the 60-second walkthrough](https://secure-ci.dev/assets/video/secureci-walkthrough-16x9.mp4)**
+
 > 📖 This README is the quick tour. Every flag, context and edge case lives in
 > the **[full reference → DOCS.md](DOCS.md)**.
 
@@ -67,10 +73,13 @@ less install.sh
 sh install.sh
 ```
 
-Set `SECURECI_VERSION=0.10.0` to install a specific release,
+Set `SECURECI_VERSION=1.0.1` to install a specific release,
 `SECURECI_INSTALL_DIR` to install somewhere else, and
 `SECURECI_REQUIRE_ATTESTATION=1` to fail unless `gh` verifies build provenance
-(e.g. `curl -fsSL https://secure-ci.dev/install.sh | SECURECI_VERSION=0.10.0 sh`).
+(e.g. `curl -fsSL https://secure-ci.dev/install.sh | SECURECI_VERSION=1.0.1 sh`).
+If the release's download link fails (GitHub has returned `504` for one while
+its API still served the files), the script fetches the same files through the
+GitHub API instead; the `SHA256SUMS` and provenance checks are unchanged.
 `secure-ci.dev/install.sh` redirects to [`install.sh`](install.sh) on this
 repository's `main` branch.
 
@@ -149,10 +158,13 @@ secureci pin
 
 ### Agent skill
 
-[`skills/secureci`](skills/secureci/SKILL.md) walks a coding agent (Claude Code,
-Codex, Cursor, …) through setting SecureCI up in a repo: pin actions, commit
-`secureci.lock`, and add the `secure-ci/cli` action as a step in an existing job
-(replacing `actionlint` if present).
+[`skills/secureci`](skills/secureci/SKILL.md) lets a coding agent (Claude Code,
+Codex, Cursor, …) check every workflow it creates or edits (`secureci validate`,
+`secureci pin --check`), run workflows locally (`secureci run`), and set
+SecureCI up in a repo: pin actions, commit `secureci.lock`, and add the
+`secure-ci/cli` action as a step in an existing job (replacing `actionlint` if
+present). It also picks up requests that name actionlint, zizmor, nektos/act,
+pinact and similar tools.
 
 ```bash
 npx skills add secure-ci/cli --skill secureci

package/dist/cli.js

@@ -292,6 +292,36 @@ function defaultWorkflowFiles() {
         .filter((f) => f.endsWith('.yml') || f.endsWith('.yaml'))
         .map((f) => path.join('.github', 'workflows', f));
 }
+/** The workflows in .github/workflows that aren't among `targets`. */
+function otherWorkflowFiles(targets) {
+    const given = new Set(targets.map((file) => path.resolve(file)));
+    return defaultWorkflowFiles().filter((file) => !given.has(path.resolve(file)));
+}
+/**
+ * The remote references these workflows use, read locally (no network), or
+ * undefined, with a warning, when one of them can't be read.
+ */
+async function workflowUses(files, lockName) {
+    const uses = new Set();
+    for (const file of files) {
+        try {
+            const parsed = (0, workflow_parser_1.parseFile)(file);
+            if (parsed.type !== 'workflow')
+                continue;
+            const inv = await (0, inventory_1.buildInventory)({
+                type: 'workflow',
+                path: file,
+                file: parsed.file
+            });
+            inv.actions.forEach((action) => uses.add(action.uses));
+        }
+        catch (error) {
+            logger_1.logger.warn(`Could not read ${file} (${error instanceof Error ? error.message : 'Unknown error'}), so every entry in ${lockName} is kept.`);
+            return undefined;
+        }
+    }
+    return uses;
+}
 async function runInventory(files, options) {
     const update = options.updateLock || options.updateLockfile;
     const check = options.check || options.compare;
@@ -479,9 +509,33 @@ async function runInventory(files, options) {
         if (online) {
             unresolved.forEach((a) => logger_1.logger.warn(`Not locked: could not resolve ${a.uses} (repository deleted, renamed or private, or the network is unavailable?)`));
         }
-        fs.writeFileSync(lockPath, (0, github_lockfile_1.serializeSecureciLockfile)(current));
-        const transitive = Object.values(current).filter((e) => e.via).length;
-        logger_1.logger.success(`Wrote ${Object.keys(current).length} action(s) to ${LOCKFILE_NAME}` +
+        // Given some of the workflows, lock what they use and keep the other
+        // workflows' entries as locked, instead of dropping them.
+        let entries = current;
+        const others = source ? otherWorkflowFiles(targets) : [];
+        if (source && others.length > 0) {
+            let previous;
+            try {
+                previous = (0, github_lockfile_1.readLockfile)(source);
+            }
+            catch (error) {
+                logger_1.logger.error(`Could not read ${lockName}: ${error instanceof Error ? error.message : 'Unknown error'}. Run without file arguments to rewrite it from every workflow.`);
+                process.exit(1);
+            }
+            // actions.lock records no `via`, so its transitive entries can't be
+            // told apart from unused ones: keep them all.
+            const otherUses = github
+                ? undefined
+                : await workflowUses(others, lockName);
+            const merged = (0, inventory_1.mergeLock)(previous.actions, current, otherUses);
+            entries = merged.actions;
+            if (merged.kept > 0) {
+                logger_1.logger.info(`Kept ${merged.kept} action(s) from ${lockName} for the other workflows.`);
+            }
+        }
+        fs.writeFileSync(lockPath, (0, github_lockfile_1.serializeSecureciLockfile)(entries));
+        const transitive = Object.values(entries).filter((e) => e.via).length;
+        logger_1.logger.success(`Wrote ${Object.keys(entries).length} action(s) to ${LOCKFILE_NAME}` +
             (transitive > 0 ? ` (${transitive} used by other actions)` : '') +
             '. Commit it to track supply-chain drift.');
         return;

package/dist/inventory.js

@@ -37,6 +37,7 @@ exports.collectReferences = collectReferences;
 exports.buildInventory = buildInventory;
 exports.addTransitive = addTransitive;
 exports.diffLock = diffLock;
+exports.mergeLock = mergeLock;
 const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
 const workflow_parser_1 = require("./parser/workflow-parser");
@@ -293,4 +294,55 @@ function diffLock(current, lock) {
         identity
     };
 }
+/**
+ * Merge entries resolved for some workflow files into the previous lock, so
+ * locking those files doesn't drop the other workflows' entries.
+ *
+ * `updated` wins. From `previous`, keep what the other workflows still use
+ * (`otherUses`, their direct references) and, following `via`, what those
+ * pull in; drop the rest. A reference used directly by another workflow has
+ * no `via`, and a dependency both sides pull in lists every reference that
+ * pulls it in. When `otherUses` is unknown (GitHub's actions.lock records no
+ * `via`, or a workflow couldn't be read), keep every previous entry.
+ */
+function mergeLock(previous, updated, otherUses) {
+    if (!otherUses) {
+        const kept = Object.keys(previous).filter((uses) => !(uses in updated));
+        return { actions: { ...previous, ...updated }, kept: kept.length };
+    }
+    // Previous entries the other workflows reach, taken as locked.
+    const kept = new Set([...otherUses].filter((uses) => uses in previous && !(uses in updated)));
+    for (let grew = true; grew;) {
+        grew = false;
+        for (const [uses, entry] of Object.entries(previous)) {
+            if (kept.has(uses) || uses in updated)
+                continue;
+            if (entry.via?.some((v) => kept.has(v))) {
+                kept.add(uses);
+                grew = true;
+            }
+        }
+    }
+    const withVia = (entry, via) => {
+        const out = { ...entry };
+        delete out.via;
+        if (via.length > 0)
+            out.via = [...new Set(via)].sort();
+        return out;
+    };
+    const stillLocked = (via) => (via ?? []).filter((v) => kept.has(v));
+    const actions = {};
+    for (const [uses, entry] of Object.entries(updated)) {
+        actions[uses] = otherUses.has(uses)
+            ? withVia(entry, [])
+            : entry.via
+                ? withVia(entry, [...entry.via, ...stillLocked(previous[uses]?.via)])
+                : entry;
+    }
+    for (const uses of kept) {
+        const entry = previous[uses];
+        actions[uses] = entry.via ? withVia(entry, stillLocked(entry.via)) : entry;
+    }
+    return { actions, kept: kept.size };
+}
 //# sourceMappingURL=inventory.js.map

package/dist/runner/builtin-actions.js

@@ -391,7 +391,7 @@ async function uploadArtifact(fsys, inputs, runId) {
         copyFile(file.host, path.join(target, ...rel.split('/')));
         digest.update(rel).update(fs.readFileSync(file.host));
     }
-    const id = String(parseInt(crypto.createHash('sha1').update(target).digest('hex').slice(0, 8), 16));
+    const id = String(parseInt(crypto.createHash('sha256').update(target).digest('hex').slice(0, 8), 16));
     return ok(`Uploaded ${files.length} file(s) as artifact "${name}" to ${target}`, {
         'artifact-id': id,
         'artifact-url': '',

package/dist/runner/docker-action.js

@@ -90,7 +90,7 @@ async function executeDockerAction(action, actionPath, step, actionInputs, calle
                 duration: Date.now() - startTime
             };
         }
-        const tag = `secureci-action-${crypto.createHash('sha1').update(actionDir).digest('hex').slice(0, 12)}`;
+        const tag = `secureci-action-${crypto.createHash('sha256').update(actionDir).digest('hex').slice(0, 12)}`;
         logger_1.logger.info(`Building Docker action image: ${action.name} (${tag})`);
         const buildResult = await containerRuntime.build(actionDir, tag, dockerfileRelative);
         if (!buildResult.success) {

package/dist/runner/job-runtime.js

@@ -285,7 +285,7 @@ function actionDirInContainer(container, actionDir) {
     let containerDir = container.actionDirs.get(actionDir);
     if (!containerDir) {
         const hash = crypto
-            .createHash('sha1')
+            .createHash('sha256')
             .update(actionDir)
             .digest('hex')
             .slice(0, 12);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@secureci/cli",
-  "version": "0.10.0",
+  "version": "1.0.1",
   "description": "SecureCI: validate, check against pipeline standards, and run GitHub Actions workflows locally",
   "main": "dist/index.js",
   "bin": {