@secureci/cli 0.5.1 → 0.6.0

package/dist/cli.js

@@ -36,6 +36,7 @@ var __importStar = (this && this.__importStar) || (function () {
 Object.defineProperty(exports, "__esModule", { value: true });
 const commander_1 = require("commander");
 const dry_run_1 = require("./runner/dry-run");
+const job_plan_1 = require("./runner/job-plan");
 const executor_1 = require("./runner/executor");
 const action_fetcher_1 = require("./runner/action-fetcher");
 const progress_1 = require("./utils/progress");
@@ -46,24 +47,19 @@ const pipeline_contract_parser_1 = require("./parser/pipeline-contract-parser");
 const pipeline_contract_validator_1 = require("./parser/pipeline-contract-validator");
 const report_1 = require("./report");
 const init_1 = require("./init");
+const pin_1 = require("./pin");
+const advisories_1 = require("./advisories");
 const inventory_1 = require("./inventory");
 const github_lockfile_1 = require("./github-lockfile");
 const logger_1 = require("./utils/logger");
-const key_value_1 = require("./utils/key-value");
+const env_file_1 = require("./utils/env-file");
 const config_1 = require("./config");
+const scheduler_1 = require("./runner/scheduler");
+const version_1 = require("./version");
 const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
 /** Committed at the repo root, like package-lock.json / yarn.lock. */
 const LOCKFILE_NAME = 'secureci.lock';
-function readVersion() {
-    try {
-        const pkg = JSON.parse(fs.readFileSync(path.join(__dirname, '..', 'package.json'), 'utf-8'));
-        return String(pkg.version);
-    }
-    catch {
-        return '0.0.0';
-    }
-}
 const program = new commander_1.Command();
 const globalConfig = (0, config_1.loadConfig)();
 // An invalid container-runtime in the config file only stops `run`, so
@@ -77,10 +73,17 @@ catch (error) {
     configError = error instanceof Error ? error.message : String(error);
     defaultContainerRuntime = 'docker';
 }
+let defaultParallel = 1;
+try {
+    defaultParallel = (0, config_1.getDefaultParallel)(globalConfig);
+}
+catch (error) {
+    configError ?? (configError = error instanceof Error ? error.message : String(error));
+}
 program
     .name('secureci')
     .description('SecureCI: validate, check and run GitHub Actions workflows locally')
-    .version(readVersion(), '-V, --version', 'Print the version')
+    .version((0, version_1.readVersion)(), '-V, --version', 'Print the version')
     .helpOption('-h, --help', 'Show help')
     .addHelpCommand('help [command]', 'Show help for a command')
     .option('--verbose', 'Log debug output')
@@ -105,9 +108,14 @@ program
     .option('-s, --secret <key=value|NAME...>', 'Set a secret for the secrets context. A bare NAME reads $NAME from your shell, keeping the value off the command line. Repeatable')
     .option('--env <key=value|NAME...>', 'Set an env var for every step, below workflow/job/step env:. A bare NAME passes $NAME from your shell (steps get nothing else from it). Repeatable')
     .option('--var <key=value...>', 'Set a configuration variable for the vars context. Repeatable')
+    .option('--env-file <file...>', 'Read --env values from a .env-style file. Repeatable; later files win, --env wins over files. Config: env-file')
+    .option('--secret-file <file...>', 'Read --secret values from a .env-style file; every value is masked. Repeatable; later files win, --secret wins over files. Config: secret-file')
+    .option('--input-file <file...>', 'Read --input values from a .env-style file. Repeatable; later files win, --input wins over files. Config: input-file')
+    .option('--var-file <file...>', 'Read --var values from a .env-style file. Repeatable; later files win, --var wins over files. Config: var-file')
     .option('--event-path <file>', 'Read the event payload (github.event, $GITHUB_EVENT_PATH) from a JSON file')
     .option('--event-name <name>', 'Set github.event_name. Default: $GITHUB_EVENT_NAME, else workflow_dispatch if declared, else the first trigger')
     .option('-j, --job <name>', 'Run only this job')
+    .option('--matrix <key:value...>', 'Run only the matrix combinations whose key has this value (as shown in the job name). Repeat for more keys (all must match) or values (any matches)')
     .option('--offline', 'Use only cached remote actions and workflows; never download')
     .option('--no-local-checkout', 'Run the real actions/checkout for this repository instead of using the working copy')
     .addOption(new commander_1.Option('--container-runtime <name>', 'Container engine for jobs. "host" runs steps directly on this machine, without a container. Config: container-runtime')
@@ -120,14 +128,23 @@ program
     .option('--container-memory <limit>', 'Limit job container memory, e.g. 512m. Config: container-memory', globalConfig['container-memory'])
     .option('--no-network', 'Turn off container network access (on by default)')
     .option('--allow-network', 'Turn on container network access, overriding allow-network: false in the config')
+    .option('--parallel <n>', 'Run up to this many jobs (and matrix combinations) at once; 1 runs them one after another. Default: the number of CPUs. Config: parallel', String(defaultParallel))
     .action(async (file, options) => {
     if (configError) {
         logger_1.logger.error(configError);
         process.exit(1);
     }
     requireFile(file);
+    let matrix;
+    try {
+        matrix = (0, job_plan_1.parseMatrixFilter)(options.matrix);
+    }
+    catch (error) {
+        logger_1.logger.error(error instanceof Error ? error.message : String(error));
+        process.exit(1);
+    }
     if (options.dryRun) {
-        const result = (0, dry_run_1.dryRun)(file);
+        const result = (0, dry_run_1.dryRun)(file, { job: options.job, matrix });
         if (!result.success) {
             process.exit(1);
         }
@@ -135,15 +152,38 @@ program
     }
     logger_1.logger.info("Running the workflow for real (not a dry run). Use --dry-run to simulate without executing, or 'secureci validate' to only check for errors.");
     try {
-        const inputs = (0, key_value_1.parseKeyValuePairs)(options.input, '--input');
-        const secrets = (0, key_value_1.parseKeyValuePairs)(options.secret, '--secret', {
-            redact: true,
+        const inputs = (0, env_file_1.loadKeyValues)({
+            flagName: '--input',
+            fileFlagName: '--input-file',
+            pairs: options.input,
+            files: options.inputFile,
+            configFiles: globalConfig['input-file']
+        });
+        const secrets = (0, env_file_1.loadKeyValues)({
+            flagName: '--secret',
+            fileFlagName: '--secret-file',
+            pairs: options.secret,
+            files: options.secretFile,
+            configFiles: globalConfig['secret-file'],
+            secret: true,
             fromEnv: process.env
         });
-        const vars = (0, key_value_1.parseKeyValuePairs)(options.var, '--var');
-        const env = (0, key_value_1.parseKeyValuePairs)(options.env, '--env', {
+        const vars = (0, env_file_1.loadKeyValues)({
+            flagName: '--var',
+            fileFlagName: '--var-file',
+            pairs: options.var,
+            files: options.varFile,
+            configFiles: globalConfig['var-file']
+        });
+        const env = (0, env_file_1.loadKeyValues)({
+            flagName: '--env',
+            fileFlagName: '--env-file',
+            pairs: options.env,
+            files: options.envFile,
+            configFiles: globalConfig['env-file'],
             fromEnv: process.env
         });
+        const parallel = (0, scheduler_1.parseParallel)(options.parallel);
         const result = await (0, executor_1.executeWorkflow)(file, {
             dryRun: false,
             inputs,
@@ -153,6 +193,7 @@ program
             eventPath: options.eventPath,
             eventName: options.eventName,
             job: options.job,
+            matrix,
             localCheckout: options.localCheckout,
             offline: options.offline,
             verbose: program.opts().verbose,
@@ -164,7 +205,8 @@ program
                 ? Number(options.containerTimeout)
                 : undefined,
             containerMemoryLimit: options.containerMemory,
-            networkDisabled: (0, config_1.resolveNetworkDisabled)({ network: options.network, allowNetwork: options.allowNetwork }, globalConfig)
+            networkDisabled: (0, config_1.resolveNetworkDisabled)({ network: options.network, allowNetwork: options.allowNetwork }, globalConfig),
+            parallel
         });
         if (!result.success) {
             process.exit(1);
@@ -186,15 +228,16 @@ program
     .addOption(new commander_1.Option('--format <format>', 'Output format: text (default), or json / sarif for machine-readable results (sarif uploads to GitHub code scanning)')
     .choices(['text', 'json', 'sarif'])
     .default('text'))
+    .option('--offline', 'Do not use the network: skip the security advisory lookup (cached advisories are still used), and read remote contracts and actions only from the cache')
     .action(async (files, options) => {
     files.forEach(requireFile);
-    await validateFiles(files, options.contract, options.contractRecurse, options.format);
+    await validateFiles(files, options.contract, options.contractRecurse, options.format, options.offline ?? false);
 });
 program
     .command('inventory')
     .description('List the actions and reusable workflows a workflow uses (including the actions those actions use), with their commit SHAs; track supply-chain drift with a committed secureci.lock')
     .argument('[file...]', 'Workflow files (default: every file in .github/workflows)')
-    .option('--offline', 'Do not resolve tags to commit SHAs over the network (already-pinned refs still resolve)')
+    .option('--offline', 'Do not resolve tags to commit SHAs or query security advisories over the network (already-pinned refs still resolve; cached advisories are used)')
     .option('--dry-run', `Print the resolved inventory as JSON without writing or checking ${LOCKFILE_NAME}`)
     .option('--update-lock', `Write/update ./${LOCKFILE_NAME} with the current commit SHAs (commit it to your repo)`)
     .option('--update-lockfile', `Alias of --update-lock`)
@@ -203,6 +246,17 @@ program
     .action(async (files, options) => {
     await runInventory(files, options);
 });
+program
+    .command('pin')
+    .description('Pin action and reusable-workflow tags to commit SHAs in place (`owner/repo@<sha> # v4`), keeping formatting and comments')
+    .argument('[file...]', 'Workflow or action files (default: every file in .github/workflows, plus the local actions and reusable workflows they use)')
+    .option('--check', 'Change nothing; exit non-zero if any reference would be pinned or cannot be resolved (for CI)')
+    .option('-c, --contract <file>', "Leave the owners/actions in this pipeline contract's pins.allow on their tags")
+    .option('--offline', 'Do not use the network: only refs already in the action cache resolve; others are reported, not changed')
+    .option('--update-lock', `Afterwards, write ./${LOCKFILE_NAME} from the pinned workflows (as \`inventory --update-lock\`)`)
+    .action(async (files, options) => {
+    await runPin(files, options);
+});
 program
     .command('list')
     .description('List workflows in .github/workflows/')
@@ -376,6 +430,17 @@ async function runInventory(files, options) {
         if (identity && action.resolvedSha)
             Object.assign(action, identity);
     }
+    // 4. Known security advisories for every action, direct and transitive.
+    const repoCount = new Set(actions.map((a) => `${a.owner}/${a.repo}`.toLowerCase())).size;
+    const advising = new progress_1.Progress('Checking security advisories', online ? repoCount : 0);
+    const advisoryReport = await new advisories_1.AdvisoryChecker({
+        offline: !online,
+        onLookup: (repo) => {
+            if (online)
+                advising.tick(repo);
+        }
+    }).check((0, advisories_1.targetsFromInventory)(actions));
+    advising.done(`Checked security advisories for ${repoCount} repositor${repoCount === 1 ? 'y' : 'ies'}`);
     logger_1.logger.setLevel(level);
     const current = {};
     for (const action of actions) {
@@ -391,9 +456,22 @@ async function runInventory(files, options) {
     // --dry-run: print the resolved inventory as JSON, touching nothing.
     if (options.dryRun) {
         // eslint-disable-next-line no-console
-        console.log(JSON.stringify({ actions }, null, 2));
+        console.log(JSON.stringify({
+            actions,
+            advisories: advisoryReport.findings,
+            advisoryUnknownVersions: advisoryReport.unknownVersions
+        }, null, 2));
+        // The findings are in the JSON; say on stderr what wasn't checked.
+        (0, advisories_1.describeReport)(advisoryReport)
+            .filter((line) => line.kind === 'note' && line.level === 'warn')
+            .forEach((line) => logger_1.logger.warn(line.text));
         return;
     }
+    // Advisories are reported, but don't change the exit code here: gate on
+    // them with `secureci validate` (rule secureci/vulnerable-action).
+    for (const line of (0, advisories_1.describeReport)(advisoryReport)) {
+        logger_1.logger[line.level](line.text);
+    }
     // Used references that couldn't be resolved to a commit now.
     const unresolved = actions.filter((a) => !a.resolvedSha);
     if (writing) {
@@ -463,7 +541,130 @@ async function runInventory(files, options) {
     }
     logger_1.logger.success(`No action drift against ${lockName}.`);
 }
-async function validateOneFile(filePath, contractFile, recurse, say) {
+async function runPin(files, options) {
+    if (options.check && options.updateLock) {
+        logger_1.logger.error('Use either --update-lock or --check, not both.');
+        process.exit(1);
+    }
+    const given = files.length > 0 ? files : defaultWorkflowFiles();
+    if (given.length === 0) {
+        logger_1.logger.error('No workflow files given and none found in .github/workflows');
+        process.exit(1);
+    }
+    given.forEach(requireFile);
+    // Explicit files are pinned as given; the default run covers the whole
+    // repository, including local actions the workflows use.
+    const targets = files.length > 0 ? given : (0, pin_1.localPinTargets)(given);
+    let allow = [];
+    if (options.contract) {
+        try {
+            const source = await (0, contract_source_1.resolveContractSource)(options.contract, {
+                fetchFile: (uses) => (0, action_fetcher_1.fetchRepoFile)(uses, { offline: options.offline }),
+                resolveSha: (uses) => options.offline
+                    ? Promise.resolve((0, action_fetcher_1.cachedActionSha)(uses))
+                    : (0, action_fetcher_1.resolveActionSha)(uses),
+                warn: (message) => logger_1.logger.warn(message)
+            });
+            allow = (0, pipeline_contract_parser_1.parsePipelineContract)(source.file).pins?.allow ?? [];
+        }
+        catch (error) {
+            logger_1.logger.error(`Could not read contract ${options.contract}: ${error instanceof Error ? error.message : 'Unknown error'}`);
+            process.exit(1);
+        }
+    }
+    // Each distinct reference is resolved once, across all files.
+    const resolving = new progress_1.Progress('Resolving tags', 0);
+    const resolved = new Map();
+    const resolve = (uses) => {
+        let sha = resolved.get(uses);
+        if (!sha) {
+            if (options.offline) {
+                sha = Promise.resolve((0, action_fetcher_1.cachedActionSha)(uses));
+            }
+            else {
+                resolving.grow();
+                resolving.tick(uses);
+                sha = (0, action_fetcher_1.resolveActionSha)(uses);
+            }
+            resolved.set(uses, sha);
+        }
+        return sha;
+    };
+    const display = (file) => path.relative(process.cwd(), path.resolve(file)) || file;
+    let changes = 0;
+    let changedFiles = 0;
+    let unresolved = 0;
+    let unreadable = false;
+    const report = options.check
+        ? (m) => logger_1.logger.error(m)
+        : (m) => logger_1.logger.warn(m);
+    for (const file of targets) {
+        const name = display(file);
+        let result;
+        try {
+            result = await (0, pin_1.pinContent)(fs.readFileSync(file, 'utf-8'), resolve, {
+                allow
+            });
+        }
+        catch (error) {
+            logger_1.logger.error(`Could not read ${name}: ${error instanceof Error ? error.message : 'Unknown error'}`);
+            unreadable = true;
+            continue;
+        }
+        for (const a of result.allowed) {
+            logger_1.logger.info(`${name}:${a.line} ${a.uses} left on its tag (pins.allow)`);
+        }
+        for (const c of result.changes) {
+            logger_1.logger.info(`${name}:${c.line} ${c.uses} -> ${c.sha.slice(0, 12)} (${c.ref})`);
+        }
+        for (const u of result.unresolved) {
+            report(`${name}:${u.line} ${u.uses} ${u.reason}` +
+                (options.offline && u.reason.startsWith('could not')
+                    ? ' (offline: only refs in the action cache resolve)'
+                    : '') +
+                '; left unchanged');
+        }
+        changes += result.changes.length;
+        unresolved += result.unresolved.length;
+        if (result.changes.length > 0) {
+            changedFiles++;
+            if (!options.check)
+                fs.writeFileSync(file, result.content);
+        }
+    }
+    resolving.done(`Resolved ${resolved.size} reference(s)`);
+    const fileCount = `${changedFiles} file(s)`;
+    const unresolvedHint = options.offline
+        ? ''
+        : ` (check that each repository and ref exists${(0, action_fetcher_1.githubToken)() ? '' : '; set GITHUB_TOKEN for private repositories'})`;
+    if (options.check) {
+        if (changes > 0) {
+            logger_1.logger.error(`${changes} reference(s) would be pinned in ${fileCount}. Run \`secureci pin\` to pin them.`);
+        }
+        if (unresolved > 0) {
+            logger_1.logger.error(`${unresolved} reference(s) could not be resolved${unresolvedHint}.`);
+        }
+        if (changes > 0 || unresolved > 0 || unreadable)
+            process.exit(1);
+        logger_1.logger.success('Nothing to pin: every remote reference is pinned.');
+        return;
+    }
+    if (changes > 0) {
+        logger_1.logger.success(`Pinned ${changes} reference(s) in ${fileCount}.`);
+    }
+    else if (unresolved === 0) {
+        logger_1.logger.success('Nothing to pin: every remote reference is pinned.');
+    }
+    if (unresolved > 0) {
+        logger_1.logger.warn(`${unresolved} reference(s) could not be resolved and were left unchanged${unresolvedHint}.`);
+    }
+    if (unreadable)
+        process.exit(1);
+    if (options.updateLock) {
+        await runInventory(files, { offline: options.offline, updateLock: true });
+    }
+}
+async function validateOneFile(filePath, contractFile, recurse, say, advisories, offline) {
     const parsed = (0, workflow_parser_1.parseFile)(filePath);
     let result;
     if (parsed.type === 'workflow') {
@@ -474,6 +675,7 @@ async function validateOneFile(filePath, contractFile, recurse, say) {
         result = (0, validator_1.validateAction)(filePath);
         say(() => logger_1.logger.info(`Validating action: ${filePath}`));
     }
+    let failOn;
     if (contractFile) {
         say(() => logger_1.logger.info(`Validating against pipeline contract: ${contractFile}`));
         if (parsed.type !== 'workflow') {
@@ -491,18 +693,23 @@ async function validateOneFile(filePath, contractFile, recurse, say) {
         }
         else {
             const spec = (0, pipeline_contract_parser_1.parsePipelineContract)(contractFile);
+            failOn = spec.advisories?.failOn;
             const contractResult = await (0, pipeline_contract_validator_1.validatePipelineContract)(parsed, spec, {
-                recurse
+                recurse,
+                offline
             });
-            result = {
-                valid: result.valid && contractResult.valid,
-                errors: [...result.errors, ...contractResult.errors]
-            };
+            result = (0, validator_1.mergeValidationResults)(result, contractResult);
         }
     }
-    return result;
+    // Known security advisories for the file's own uses: references.
+    const { errors, report } = await (0, advisories_1.checkFileAdvisories)(parsed, advisories.checker, failOn);
+    advisories.reports.push(report);
+    return {
+        valid: result.valid && errors.every((e) => e.severity !== 'error'),
+        errors: [...result.errors, ...errors]
+    };
 }
-async function validateFiles(files, contractFile, recurse = 'local', format = 'text') {
+async function validateFiles(files, contractFile, recurse, format, offline) {
     // Only text mode narrates; json/sarif write nothing but the report to
     // stdout, so the output is pipeable.
     const quiet = format !== 'text';
@@ -518,8 +725,8 @@ async function validateFiles(files, contractFile, recurse = 'local', format = 't
     if (contractFile) {
         try {
             const source = await (0, contract_source_1.resolveContractSource)(contractFile, {
-                fetchFile: (uses) => (0, action_fetcher_1.fetchRepoFile)(uses),
-                resolveSha: (uses) => (0, action_fetcher_1.resolveActionSha)(uses),
+                fetchFile: (uses) => (0, action_fetcher_1.fetchRepoFile)(uses, { offline }),
+                resolveSha: async (uses) => offline ? undefined : (0, action_fetcher_1.resolveActionSha)(uses),
                 warn: (message) => logger_1.logger.warn(message)
             });
             contractPath = source.file;
@@ -540,12 +747,17 @@ async function validateFiles(files, contractFile, recurse = 'local', format = 't
             contractError = error instanceof Error ? error.message : 'Unknown error';
         }
     }
+    // One lookup per repository across all files (and a 24h disk cache).
+    const advisories = {
+        checker: new advisories_1.AdvisoryChecker({ offline }),
+        reports: []
+    };
     const entries = [];
     for (const filePath of files) {
         try {
             if (contractError)
                 throw new Error(contractError);
-            const result = await validateOneFile(filePath, contractPath, recurse, say);
+            const result = await validateOneFile(filePath, contractPath, recurse, say, advisories, offline);
             entries.push({ file: filePath, result });
         }
         catch (error) {
@@ -565,6 +777,16 @@ async function validateFiles(files, contractFile, recurse = 'local', format = 't
         }
     }
     const allValid = entries.every((e) => e.result.valid);
+    // What couldn't be checked, once for all files: warnings on stderr, and
+    // (text mode only) unknown versions as info. Findings are in the results.
+    for (const line of (0, advisories_1.describeReport)((0, advisories_1.mergeReports)(advisories.reports))) {
+        if (line.kind !== 'note')
+            continue;
+        if (line.level === 'warn')
+            logger_1.logger.warn(line.text);
+        else
+            say(() => logger_1.logger.info(line.text));
+    }
     if (quiet) {
         // eslint-disable-next-line no-console
         console.log((0, report_1.formatReport)(entries, format, { contract }));
@@ -592,7 +814,7 @@ function runInit(options) {
         process.exit(1);
     }
     const content = (0, init_1.renderInitWorkflow)({
-        version: readVersion(),
+        version: (0, version_1.readVersion)(),
         contract: options.contract,
         upload: options.upload
     });

package/dist/config.js

@@ -38,6 +38,7 @@ exports.getConfigFilePath = getConfigFilePath;
 exports.loadConfig = loadConfig;
 exports.saveConfig = saveConfig;
 exports.getDefaultContainerRuntime = getDefaultContainerRuntime;
+exports.getDefaultParallel = getDefaultParallel;
 exports.isValidConfigKey = isValidConfigKey;
 exports.getConfigValue = getConfigValue;
 exports.setConfigValue = setConfigValue;
@@ -47,6 +48,7 @@ exports.resolveNetworkDisabled = resolveNetworkDisabled;
 const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
 const YAML = __importStar(require("yaml"));
+const scheduler_1 = require("./runner/scheduler");
 /** Built-in defaults, used when a key is absent from the config file. */
 exports.DEFAULT_CONFIG = {
     'container-runtime': 'docker'
@@ -100,12 +102,22 @@ function getDefaultContainerRuntime(config = loadConfig()) {
     }
     return value;
 }
+/** Resolve the effective `parallel`: config, else the CPU count. */
+function getDefaultParallel(config = loadConfig()) {
+    const value = config.parallel;
+    return value === undefined ? (0, scheduler_1.defaultParallelism)() : (0, scheduler_1.parseParallel)(value);
+}
 exports.CONFIG_KEYS = [
     'container-runtime',
     'container-image',
     'container-timeout',
     'container-memory',
-    'allow-network'
+    'allow-network',
+    'parallel',
+    'env-file',
+    'secret-file',
+    'input-file',
+    'var-file'
 ];
 /** `runner-images.<label>`: one entry of the runs-on -> image mapping. */
 const RUNNER_IMAGE_KEY = /^runner-images\.(.+)$/;
@@ -169,9 +181,19 @@ function parseConfigValue(key, rawValue) {
                 throw new Error(`Invalid value "${rawValue}" for allow-network. Must be "true" or "false".`);
             }
             return rawValue === 'true';
+        case 'parallel':
+            return (0, scheduler_1.parseParallel)(rawValue);
         case 'container-image':
         case 'container-memory':
             return rawValue;
+        case 'env-file':
+        case 'secret-file':
+        case 'input-file':
+        case 'var-file':
+            if (rawValue === '') {
+                throw new Error(`Invalid value "" for ${key}. Must be a file path.`);
+            }
+            return rawValue;
     }
 }
 /**

package/dist/init.js

@@ -7,7 +7,7 @@ exports.renderInitWorkflow = renderInitWorkflow;
  * the release tag matching this CLI's version.
  *
  * The output is deterministic for a given set of options, so it can be
- * regenerated and diffed. With uploads on (the default) the workflow asks for
+ * regenerated and diffed. With uploads on (the default) the job asks for
  * `security-events: write` and lets the action upload SARIF; with uploads off
  * it keeps `contents: read` only and passes `upload-sarif: false`.
  */
@@ -23,11 +23,18 @@ function renderInitWorkflow(options) {
         '  - pull_request',
         '',
         'permissions:',
-        '  contents: read'
+        '  contents: read',
+        '',
+        'jobs:',
+        '  secureci:',
+        '    runs-on: ubuntu-latest'
     ];
-    if (upload)
-        lines.push('  security-events: write');
-    lines.push('', 'jobs:', '  secureci:', '    runs-on: ubuntu-latest', '    steps:', '      - uses: actions/checkout@v4', `      - uses: secure-ci/cli@v${options.version}`);
+    // Write scopes belong on the job, not the workflow. Job-level permissions
+    // replace the top-level ones, so contents: read is repeated for checkout.
+    if (upload) {
+        lines.push('    permissions:', '      contents: read', '      security-events: write');
+    }
+    lines.push('    steps:', '      - uses: actions/checkout@v4', `      - uses: secure-ci/cli@v${options.version}`);
     const withLines = [];
     if (contract)
         withLines.push(`          contract: ${yamlScalar(contract)}`);