@secureci/cli 1.0.0 → 1.1.0

package/README.md

@@ -9,6 +9,12 @@ them, and checks them against your organization's pipeline standards — without
 committing, pushing, or waiting on a CI runner. It is the free, open-source part
 of [SecureCI](https://secure-ci.dev).
 
+<a href="https://secure-ci.dev/assets/video/secureci-walkthrough-16x9.mp4"><img src="https://secure-ci.dev/assets/readme-demo.svg" width="848" alt="Terminal demo of the secureci CLI on a demo repository: run executes a workflow locally and its tests pass; validate fails a deploy workflow against a pipeline contract (security scan below the minimum version, wrong step order, actions not pinned to a commit SHA); pin pins actions/checkout@v4 to its full commit SHA, keeping # v4 for Dependabot; inventory --check fails because the v4 tag now resolves to a different commit than the one locked."></a>
+
+<sub>Real output from the CLI on a demo repository.</sub>
+
+▶️ **[Watch the 60-second walkthrough](https://secure-ci.dev/assets/video/secureci-walkthrough-16x9.mp4)**
+
 > 📖 This README is the quick tour. Every flag, context and edge case lives in
 > the **[full reference → DOCS.md](DOCS.md)**.
 
@@ -67,10 +73,13 @@ less install.sh
 sh install.sh
 ```
 
-Set `SECURECI_VERSION=1.0.0` to install a specific release,
+Set `SECURECI_VERSION=1.1.0` to install a specific release,
 `SECURECI_INSTALL_DIR` to install somewhere else, and
 `SECURECI_REQUIRE_ATTESTATION=1` to fail unless `gh` verifies build provenance
-(e.g. `curl -fsSL https://secure-ci.dev/install.sh | SECURECI_VERSION=1.0.0 sh`).
+(e.g. `curl -fsSL https://secure-ci.dev/install.sh | SECURECI_VERSION=1.1.0 sh`).
+If the release's download link fails (GitHub has returned `504` for one while
+its API still served the files), the script fetches the same files through the
+GitHub API instead; the `SHA256SUMS` and provenance checks are unchanged.
 `secure-ci.dev/install.sh` redirects to [`install.sh`](install.sh) on this
 repository's `main` branch.
 
@@ -145,14 +154,20 @@ secureci inventory --check    # fail on drift (use in CI)
 
 # Pin action tags to commit SHAs in place (keeps `# v4` for Dependabot/Renovate)
 secureci pin
+
+# Scan every repository in an organisation (JSON results, never source code)
+secureci org scan my-org
 ```
 
 ### Agent skill
 
-[`skills/secureci`](skills/secureci/SKILL.md) walks a coding agent (Claude Code,
-Codex, Cursor, …) through setting SecureCI up in a repo: pin actions, commit
-`secureci.lock`, and add the `secure-ci/cli` action as a step in an existing job
-(replacing `actionlint` if present).
+[`skills/secureci`](skills/secureci/SKILL.md) lets a coding agent (Claude Code,
+Codex, Cursor, …) check every workflow it creates or edits (`secureci validate`,
+`secureci pin --check`), run workflows locally (`secureci run`), and set
+SecureCI up in a repo: pin actions, commit `secureci.lock`, and add the
+`secure-ci/cli` action as a step in an existing job (replacing `actionlint` if
+present). It also picks up requests that name actionlint, zizmor, nektos/act,
+pinact and similar tools.
 
 ```bash
 npx skills add secure-ci/cli --skill secureci
@@ -242,18 +257,24 @@ things to know:
 
 - **Linux containers only.** `windows-*` / `macos-*` jobs run in a Linux image
   with a warning.
-- **Jobs running in parallel share your working copy.** Each job has its own
-  container, but every job mounts the same directory, so jobs that write the
-  same files (e.g. `node_modules`) can collide; use `--parallel 1` to run jobs
-  one after another.
+- **Jobs running in parallel share your working copy** by default. Each job has
+  its own container, but every job mounts the same directory, so jobs that
+  write the same files (e.g. `node_modules`) can collide; pass
+  `--isolate-workspace` to give each job its own copy, or `--parallel 1` to run
+  jobs one after another.
 - **`actions/checkout` of the current repo doesn't clone** — it uses your working
-  copy as-is (so uncommitted changes are visible); `ref:`/`fetch-depth:` are
-  ignored. Other repositories check out for real and need a token.
+  copy as-is (so uncommitted changes are visible). A `ref:` your local
+  repository has is checked out only into a `path:`; other refs and
+  `fetch-depth:` don't change what you get. Other repositories check out for
+  real and need a token.
 - **Artifacts and cache are local stand-ins**, stored under `~/.secureci/`;
   nothing is uploaded to or downloaded from GitHub.
-- **Contract checks** don't evaluate `if:` conditions and, without
-  `--contract-recurse all`, don't look inside _remote_ composite actions /
-  reusable workflows.
+- **Not emulated:** `concurrency:` (noted at run start), deployment
+  `environment:` (protection rules and environment-scoped secrets/vars: pass
+  them with `--secret`/`--var`), and OIDC tokens for `id-token: write`.
+- **Contract checks** decide `if:` conditions only from the workflow's triggers
+  (`github.event_name`) and, without `--contract-recurse all`, don't look inside
+  _remote_ composite actions / reusable workflows.
 
 The exact scope of each is documented in
 [DOCS.md](DOCS.md#contract-limitations-v1-scope).

package/dist/advisories.js

@@ -61,6 +61,17 @@ exports.VULNERABLE_ACTION_RULE = 'secureci/vulnerable-action';
 /** Cached advisories are re-fetched after this long. */
 exports.ADVISORY_TTL_MS = 24 * 60 * 60 * 1000;
 const ADVISORY_TIMEOUT_MS = 15000;
+/** Pages of advisories read per repository (100 each). */
+const MAX_ADVISORY_PAGES = 10;
+/** The `rel="next"` URL of a `Link` header, if any. */
+function nextPageUrl(link) {
+    for (const part of (link ?? '').split(',')) {
+        const match = part.match(/<([^>]+)>\s*;\s*rel="?next"?/);
+        if (match)
+            return match[1];
+    }
+    return undefined;
+}
 const VERSION = /^v?(\d+(?:\.\d+)*)(?:-([0-9A-Za-z.-]+))?(?:\+[0-9A-Za-z.-]+)?$/;
 /** `v1.2.3`, `1.2`, `v4`, `2.0.0-rc.1`; null for anything else. */
 function parseVersion(text) {
@@ -359,7 +370,7 @@ function describeError(error, authenticated) {
  * The advisories naming `owner/repo` in the actions ecosystem, cached per
  * repository for `ttlMs` (default 24h). Offline, the cache is used at any
  * age. If the API fails, a stale cache is used when there is one.
- * Only the first page (100 advisories) is read.
+ * Pages are followed (on the API's own host) up to 1,000 advisories.
  */
 async function fetchRepoAdvisories(owner, repo, options = {}) {
     if (!validName(owner) || !validName(repo))
@@ -386,7 +397,10 @@ async function fetchRepoAdvisories(owner, repo, options = {}) {
             : { error: 'offline and not cached' };
     }
     const httpGet = options.httpGet ??
-        ((url, headers) => (0, action_fetcher_1.getText)(url, headers, ADVISORY_TIMEOUT_MS));
+        ((url, headers) => (0, action_fetcher_1.getResponse)(url, headers, ADVISORY_TIMEOUT_MS).then((r) => ({
+            body: r.body,
+            link: [r.headers.link].flat()[0]
+        })));
     const query = new URLSearchParams({
         ecosystem: 'actions',
         affects: `${owner}/${repo}`,
@@ -400,19 +414,32 @@ async function fetchRepoAdvisories(owner, repo, options = {}) {
         ...(token ? { Authorization: `Bearer ${token}` } : {})
     });
     let token = options.token === undefined ? (0, action_fetcher_1.githubToken)() : options.token;
-    let body;
+    const page = async (pageUrl) => {
+        const response = await httpGet(pageUrl, headers(token));
+        return typeof response === 'string' ? { body: response } : response;
+    };
     try {
+        let response;
         try {
-            body = await httpGet(url, headers(token));
+            response = await page(url);
         }
         catch (error) {
             // A rejected token shouldn't block public advisories.
             if (!token || error.status !== 401)
                 throw error;
             token = null;
-            body = await httpGet(url, headers(null));
+            response = await page(url);
+        }
+        const advisories = parseAdvisories(JSON.parse(response.body));
+        // Later pages only from the API's own origin, which the token is for.
+        const origin = new URL(url).origin;
+        for (let pages = 1; pages < MAX_ADVISORY_PAGES; pages++) {
+            const next = nextPageUrl(response.link);
+            if (!next || new URL(next, url).origin !== origin)
+                break;
+            response = await page(new URL(next, url).toString());
+            advisories.push(...parseAdvisories(JSON.parse(response.body)));
         }
-        const advisories = parseAdvisories(JSON.parse(body));
         fs.mkdirSync(path.dirname(file), { recursive: true });
         const entry = { api, fetchedAt: now, advisories };
         fs.writeFileSync(file, JSON.stringify(entry, null, 2));

package/dist/cli.js

@@ -56,6 +56,11 @@ const env_file_1 = require("./utils/env-file");
 const config_1 = require("./config");
 const scheduler_1 = require("./runner/scheduler");
 const version_1 = require("./version");
+const org_scan_1 = require("./org-scan");
+const org_scan_script_1 = require("./org-scan-script");
+const node_binary_1 = require("./runner/node-binary");
+const child_process_1 = require("child_process");
+const os = __importStar(require("os"));
 const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
 /** Committed at the repo root, like package-lock.json / yarn.lock. */
@@ -128,6 +133,8 @@ program
     .option('--container-memory <limit>', 'Limit job container memory, e.g. 512m. Config: container-memory', globalConfig['container-memory'])
     .option('--no-network', 'Turn off container network access (on by default)')
     .option('--allow-network', 'Turn on container network access, overriding allow-network: false in the config')
+    .option('--isolate-workspace', "Run each job in its own copy of the working copy, removed when the job ends, so parallel jobs can't overwrite each other's files. Config: isolate-workspace")
+    .option('--no-isolate-workspace', 'Share the working copy between jobs, overriding isolate-workspace: true in the config')
     .option('--parallel <n>', 'Run up to this many jobs (and matrix combinations) at once; 1 runs them one after another. Default: the number of CPUs. Config: parallel', String(defaultParallel))
     .action(async (file, options) => {
     if (configError) {
@@ -206,7 +213,8 @@ program
                 : undefined,
             containerMemoryLimit: options.containerMemory,
             networkDisabled: (0, config_1.resolveNetworkDisabled)({ network: options.network, allowNetwork: options.allowNetwork }, globalConfig),
-            parallel
+            parallel,
+            isolateWorkspace: (0, config_1.resolveIsolateWorkspace)(options.isolateWorkspace, globalConfig)
         });
         if (!result.success) {
             process.exit(1);
@@ -292,6 +300,36 @@ function defaultWorkflowFiles() {
         .filter((f) => f.endsWith('.yml') || f.endsWith('.yaml'))
         .map((f) => path.join('.github', 'workflows', f));
 }
+/** The workflows in .github/workflows that aren't among `targets`. */
+function otherWorkflowFiles(targets) {
+    const given = new Set(targets.map((file) => path.resolve(file)));
+    return defaultWorkflowFiles().filter((file) => !given.has(path.resolve(file)));
+}
+/**
+ * The remote references these workflows use, read locally (no network), or
+ * undefined, with a warning, when one of them can't be read.
+ */
+async function workflowUses(files, lockName) {
+    const uses = new Set();
+    for (const file of files) {
+        try {
+            const parsed = (0, workflow_parser_1.parseFile)(file);
+            if (parsed.type !== 'workflow')
+                continue;
+            const inv = await (0, inventory_1.buildInventory)({
+                type: 'workflow',
+                path: file,
+                file: parsed.file
+            });
+            inv.actions.forEach((action) => uses.add(action.uses));
+        }
+        catch (error) {
+            logger_1.logger.warn(`Could not read ${file} (${error instanceof Error ? error.message : 'Unknown error'}), so every entry in ${lockName} is kept.`);
+            return undefined;
+        }
+    }
+    return uses;
+}
 async function runInventory(files, options) {
     const update = options.updateLock || options.updateLockfile;
     const check = options.check || options.compare;
@@ -479,9 +517,33 @@ async function runInventory(files, options) {
         if (online) {
             unresolved.forEach((a) => logger_1.logger.warn(`Not locked: could not resolve ${a.uses} (repository deleted, renamed or private, or the network is unavailable?)`));
         }
-        fs.writeFileSync(lockPath, (0, github_lockfile_1.serializeSecureciLockfile)(current));
-        const transitive = Object.values(current).filter((e) => e.via).length;
-        logger_1.logger.success(`Wrote ${Object.keys(current).length} action(s) to ${LOCKFILE_NAME}` +
+        // Given some of the workflows, lock what they use and keep the other
+        // workflows' entries as locked, instead of dropping them.
+        let entries = current;
+        const others = source ? otherWorkflowFiles(targets) : [];
+        if (source && others.length > 0) {
+            let previous;
+            try {
+                previous = (0, github_lockfile_1.readLockfile)(source);
+            }
+            catch (error) {
+                logger_1.logger.error(`Could not read ${lockName}: ${error instanceof Error ? error.message : 'Unknown error'}. Run without file arguments to rewrite it from every workflow.`);
+                process.exit(1);
+            }
+            // actions.lock records no `via`, so its transitive entries can't be
+            // told apart from unused ones: keep them all.
+            const otherUses = github
+                ? undefined
+                : await workflowUses(others, lockName);
+            const merged = (0, inventory_1.mergeLock)(previous.actions, current, otherUses);
+            entries = merged.actions;
+            if (merged.kept > 0) {
+                logger_1.logger.info(`Kept ${merged.kept} action(s) from ${lockName} for the other workflows.`);
+            }
+        }
+        fs.writeFileSync(lockPath, (0, github_lockfile_1.serializeSecureciLockfile)(entries));
+        const transitive = Object.values(entries).filter((e) => e.via).length;
+        logger_1.logger.success(`Wrote ${Object.keys(entries).length} action(s) to ${LOCKFILE_NAME}` +
             (transitive > 0 ? ` (${transitive} used by other actions)` : '') +
             '. Commit it to track supply-chain drift.');
         return;
@@ -940,6 +1002,43 @@ configCmd
     (0, config_1.saveConfig)(config);
     logger_1.logger.success(`Unset ${key} in ${(0, config_1.getConfigFilePath)()}`);
 });
+const orgCmd = program
+    .command('org')
+    .description('Organisation-wide commands (for a SecureCI supply-chain assessment)');
+orgCmd
+    .command('scan')
+    .description('Scan the GitHub Actions workflows of every repository in an organisation and pack the JSON results for a SecureCI supply-chain assessment (runs org-scan.sh; source code is never downloaded)')
+    .argument('[org]', 'GitHub organisation (or user) to scan')
+    .option('--repos <file>', 'Scan only the repositories in this file (one "name" or "owner/name" per line)')
+    .option('--out <dir>', 'Output directory (default: ./secureci-org-scan-<org>)')
+    .option('-c, --contract <file>', 'Also check workflows against this pipeline contract (local file or owner/repo/path@ref)')
+    .option('--include-forks', 'Also scan forked repositories')
+    .option('--print-script', 'Print the script this command runs, to review it, and exit')
+    .action(async (org, options) => {
+    if (options.printScript) {
+        process.stdout.write(org_scan_script_1.ORG_SCAN_SCRIPT);
+        return;
+    }
+    if (!org) {
+        logger_1.logger.error('Missing <org>: secureci org scan <org>');
+        process.exit(2);
+    }
+    try {
+        const code = await (0, org_scan_1.runOrgScan)(org, options, {
+            spawn: (command, args, spawnOptions) => (0, child_process_1.spawn)(command, args, spawnOptions),
+            tmpdir: os.tmpdir,
+            sea: (0, node_binary_1.isSea)(),
+            execPath: process.execPath,
+            entry: process.argv[1],
+            env: process.env
+        });
+        process.exit(code);
+    }
+    catch (error) {
+        logger_1.logger.error(error instanceof Error ? error.message : String(error));
+        process.exit(1);
+    }
+});
 const cacheCmd = program
     .command('cache')
     .description('Manage the cache of downloaded remote actions');

package/dist/config.js

@@ -44,6 +44,7 @@ exports.getConfigValue = getConfigValue;
 exports.setConfigValue = setConfigValue;
 exports.unsetConfigValue = unsetConfigValue;
 exports.parseConfigValue = parseConfigValue;
+exports.resolveIsolateWorkspace = resolveIsolateWorkspace;
 exports.resolveNetworkDisabled = resolveNetworkDisabled;
 const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
@@ -114,6 +115,7 @@ exports.CONFIG_KEYS = [
     'container-memory',
     'allow-network',
     'parallel',
+    'isolate-workspace',
     'env-file',
     'secret-file',
     'input-file',
@@ -177,8 +179,9 @@ function parseConfigValue(key, rawValue) {
             return num;
         }
         case 'allow-network':
+        case 'isolate-workspace':
             if (rawValue !== 'true' && rawValue !== 'false') {
-                throw new Error(`Invalid value "${rawValue}" for allow-network. Must be "true" or "false".`);
+                throw new Error(`Invalid value "${rawValue}" for ${key}. Must be "true" or "false".`);
             }
             return rawValue === 'true';
         case 'parallel':
@@ -196,6 +199,14 @@ function parseConfigValue(key, rawValue) {
             return rawValue;
     }
 }
+/**
+ * Whether each job runs in its own copy of the working copy:
+ * `--isolate-workspace` / `--no-isolate-workspace`, else
+ * `isolate-workspace` in the config file, else no.
+ */
+function resolveIsolateWorkspace(flag, config = loadConfig()) {
+    return flag ?? config['isolate-workspace'] === true;
+}
 /**
  * Whether container networking should be disabled. Networking is on by
  * default (matching GitHub-hosted runners); `--no-network` turns it off and

package/dist/inventory.js

@@ -37,6 +37,7 @@ exports.collectReferences = collectReferences;
 exports.buildInventory = buildInventory;
 exports.addTransitive = addTransitive;
 exports.diffLock = diffLock;
+exports.mergeLock = mergeLock;
 const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
 const workflow_parser_1 = require("./parser/workflow-parser");
@@ -293,4 +294,55 @@ function diffLock(current, lock) {
         identity
     };
 }
+/**
+ * Merge entries resolved for some workflow files into the previous lock, so
+ * locking those files doesn't drop the other workflows' entries.
+ *
+ * `updated` wins. From `previous`, keep what the other workflows still use
+ * (`otherUses`, their direct references) and, following `via`, what those
+ * pull in; drop the rest. A reference used directly by another workflow has
+ * no `via`, and a dependency both sides pull in lists every reference that
+ * pulls it in. When `otherUses` is unknown (GitHub's actions.lock records no
+ * `via`, or a workflow couldn't be read), keep every previous entry.
+ */
+function mergeLock(previous, updated, otherUses) {
+    if (!otherUses) {
+        const kept = Object.keys(previous).filter((uses) => !(uses in updated));
+        return { actions: { ...previous, ...updated }, kept: kept.length };
+    }
+    // Previous entries the other workflows reach, taken as locked.
+    const kept = new Set([...otherUses].filter((uses) => uses in previous && !(uses in updated)));
+    for (let grew = true; grew;) {
+        grew = false;
+        for (const [uses, entry] of Object.entries(previous)) {
+            if (kept.has(uses) || uses in updated)
+                continue;
+            if (entry.via?.some((v) => kept.has(v))) {
+                kept.add(uses);
+                grew = true;
+            }
+        }
+    }
+    const withVia = (entry, via) => {
+        const out = { ...entry };
+        delete out.via;
+        if (via.length > 0)
+            out.via = [...new Set(via)].sort();
+        return out;
+    };
+    const stillLocked = (via) => (via ?? []).filter((v) => kept.has(v));
+    const actions = {};
+    for (const [uses, entry] of Object.entries(updated)) {
+        actions[uses] = otherUses.has(uses)
+            ? withVia(entry, [])
+            : entry.via
+                ? withVia(entry, [...entry.via, ...stillLocked(previous[uses]?.via)])
+                : entry;
+    }
+    for (const uses of kept) {
+        const entry = previous[uses];
+        actions[uses] = entry.via ? withVia(entry, stillLocked(entry.via)) : entry;
+    }
+    return { actions, kept: kept.size };
+}
 //# sourceMappingURL=inventory.js.map

package/dist/org-scan-script.js

@@ -0,0 +1,6 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ORG_SCAN_SCRIPT = void 0;
+// Generated from org-scan.sh by scripts/gen-org-scan-script.mjs; don't edit.
+exports.ORG_SCAN_SCRIPT = "#!/usr/bin/env bash\n# Scan every GitHub Actions workflow in an organisation with the SecureCI CLI,\n# for a SecureCI supply-chain assessment.\n#\n#   bash org-scan.sh <org>\n#\n# Read it before you run it (it's short, on purpose):\n#\n#   curl -fsSL https://secure-ci.dev/org-scan.sh -o org-scan.sh\n#   less org-scan.sh\n#   GITHUB_TOKEN=... bash org-scan.sh my-org\n#\n# or, with the CLI installed: `secureci org scan my-org` runs this same script\n# (`secureci org scan --print-script` prints it).\n#\n# What it does, for each repository in the organisation (or in --repos):\n#\n#   1. Clones only the .github/ directory (a shallow, sparse clone: your\n#      application code is never downloaded) into a temporary directory.\n#   2. Runs `secureci validate --format json` on its workflows, and\n#      `secureci inventory --dry-run` on each workflow.\n#   3. Saves that JSON under the output directory and deletes the clone.\n#\n# Then it writes manifest.json (what was scanned, when, with which versions)\n# and packs everything into <output>.tar.gz. That archive is what you email to\n# hello@secure-ci.dev (if your policy doesn't allow email, tell us and we'll\n# agree another way).\n# It holds only the JSON results (repository and workflow names, the actions\n# they use, and the findings), never your source code. Look inside before you\n# send it: `tar -tzf <output>.tar.gz`.\n#\n# Archived repositories are skipped, and so are forks unless --include-forks.\n#\n# Your token stays on this machine: it is passed to curl on stdin and to git\n# through environment variables, never on a command line, and it is not\n# written to any output file.\n#\n# Requirements: bash, git 2.31+, curl, base64, tar, and the SecureCI CLI\n# (https://secure-ci.dev/install.sh or `npm install -g @secureci/cli`).\n#\n# Environment variables:\n#   GITHUB_TOKEN or GH_TOKEN  token that can read the organisation's\n#                             repositories (contents: read, metadata: read).\n#                             Needed for private repositories, and it raises\n#                             API rate limits. The CLI also uses it to resolve\n#                             action tags and look up security advisories.\n#   GITHUB_SERVER_URL         default https://github.com; set it for GitHub\n#                             Enterprise Server, e.g. https://github.example.com\n#   GITHUB_API_URL            default https://api.github.com, or\n#                             $GITHUB_SERVER_URL/api/v3 for Enterprise Server\n#   SECURECI                  the secureci executable (default: secureci on PATH)\n#\n# Exit status: 0 when the scan finished (some repositories may have failed:\n# see the summary and errors.log), 1 on an error, 2 on a usage error.\n\nset -euo pipefail\n\nSCAN_SCRIPT_VERSION=1\nINSTALL_URL=\"https://secure-ci.dev/install.sh\"\nNAME_RE='^[A-Za-z0-9._-]+/[A-Za-z0-9._-]+$'\n\nusage() {\n  cat <<'EOF'\nUsage: org-scan.sh [options] <org>\n\nScan every GitHub Actions workflow in <org> with the SecureCI CLI and pack the\nJSON results into <output>.tar.gz for a SecureCI supply-chain assessment.\n\nOptions:\n  --repos <file>     scan only these repositories: one per line, \"name\" or\n                     \"owner/name\"; blank lines and # comments are ignored\n  --out <dir>        output directory (default: ./secureci-org-scan-<org>)\n  --contract <file>  also check workflows against this pipeline contract\n                     (a local file, or owner/repo/path@ref)\n  --include-forks    also scan forked repositories\n  -h, --help         show this help\n\nEnvironment: GITHUB_TOKEN (or GH_TOKEN), GITHUB_SERVER_URL, GITHUB_API_URL,\nSECURECI. See the comments at the top of this script.\nEOF\n}\n\nsay() {\n  printf 'secureci-org-scan: %s\\n' \"$*\" >&2\n}\n\ndie() {\n  say \"error: $*\"\n  exit 1\n}\n\nusage_error() {\n  say \"$*\"\n  usage >&2\n  exit 2\n}\n\nhas() {\n  command -v \"$1\" >/dev/null 2>&1\n}\n\n# JSON string literal for $1.\njson_str() {\n  local s=$1\n  s=${s//\\\\/\\\\\\\\}\n  s=${s//\\\"/\\\\\\\"}\n  s=${s//$'\\t'/\\\\t}\n  s=${s//$'\\n'/\\\\n}\n  printf '\"%s\"' \"$s\"\n}\n\n# Run the secureci CLI (SECURECI_ENTRY is set when SECURECI is node itself).\nsecureci() {\n  if [ -n \"${SECURECI_ENTRY:-}\" ]; then\n    \"$SECURECI\" \"$SECURECI_ENTRY\" \"$@\"\n  else\n    \"$SECURECI\" \"$@\"\n  fi\n}\n\n# GET an API URL into a file; prints the HTTP status. The token goes to curl\n# on stdin (--config -), so it never shows up in the process list.\napi_get() {\n  local url=$1 out=$2\n  {\n    printf 'url = \"%s\"\\n' \"$url\"\n    printf 'header = \"Accept: application/vnd.github+json\"\\n'\n    printf 'header = \"X-GitHub-Api-Version: 2022-11-28\"\\n'\n    if [ -n \"$TOKEN\" ]; then\n      printf 'header = \"Authorization: Bearer %s\"\\n' \"$TOKEN\"\n    fi\n  } | curl --silent --show-error --location --config - \\\n    --output \"$out\" --write-out '%{http_code}' || echo 000\n}\n\n# Print owner/name for each repository in a page of the repos API, skipping\n# archived repositories and (unless --include-forks) forks. Splitting on\n# commas puts each top-level key on its own line; keys inside strings are\n# escaped (\\\"full_name\\\") and can't match the anchored patterns.\nparse_repos() {\n  tr ',' '\\n' <\"$1\" | awk -v forks=\"$INCLUDE_FORKS\" '\n    function flush() {\n      if (name != \"\" && archived != \"true\" && (forks == \"1\" || fork != \"true\"))\n        print name\n      name = \"\"; fork = \"\"; archived = \"\"\n    }\n    /^[[:space:]{[]*\"full_name\"[[:space:]]*:/ {\n      flush()\n      line = $0\n      sub(/^[^:]*:[[:space:]]*\"/, \"\", line)\n      sub(/\".*$/, \"\", line)\n      name = line\n      next\n    }\n    /^[[:space:]]*\"fork\"[[:space:]]*:/ {\n      fork = ($0 ~ /true/) ? \"true\" : \"false\"; next\n    }\n    /^[[:space:]]*\"archived\"[[:space:]]*:/ {\n      archived = ($0 ~ /true/) ? \"true\" : \"false\"; next\n    }\n    END { flush() }\n  '\n}\n\n# List the organisation's repositories over the API (or the user's, when\n# <org> is a user account), one owner/name per line.\nlist_repos() {\n  local base=\"$API_URL/orgs/$ORG/repos?per_page=100\" page=1 status\n  local body=\"$WORK/page.json\"\n  while :; do\n    status=$(api_get \"$base&page=$page\" \"$body\")\n    if [ \"$status\" = 404 ] && [ \"$page\" = 1 ] && [ \"${base#*/users/}\" = \"$base\" ]; then\n      base=\"$API_URL/users/$ORG/repos?per_page=100&type=owner\"\n      continue\n    fi\n    [ \"$status\" = 200 ] || die \"listing repositories for $ORG failed: HTTP $status from ${base%%\\?*} (check GITHUB_TOKEN and GITHUB_API_URL)\"\n    # An empty page ends the listing.\n    if ! grep -q '\"full_name\"' \"$body\"; then\n      break\n    fi\n    parse_repos \"$body\"\n    page=$((page + 1))\n  done\n}\n\n# Repositories from a --repos file, one owner/name per line.\nread_repo_file() {\n  local line\n  while IFS= read -r line || [ -n \"$line\" ]; do\n    line=${line%%#*}\n    line=$(printf '%s' \"$line\" | tr -d '[:space:]')\n    [ -n \"$line\" ] || continue\n    case \"$line\" in\n      */*) printf '%s\\n' \"$line\" ;;\n      *) printf '%s/%s\\n' \"$ORG\" \"$line\" ;;\n    esac\n  done <\"$1\"\n}\n\n# git with the token as an HTTP header scoped to the server, passed through\n# GIT_CONFIG_* environment variables rather than arguments or a URL.\ngit_auth() {\n  if [ -n \"$TOKEN\" ]; then\n    local basic\n    basic=$(printf 'x-access-token:%s' \"$TOKEN\" | base64 | tr -d '\\n')\n    GIT_CONFIG_COUNT=1 \\\n      GIT_CONFIG_KEY_0=\"http.$SERVER_URL/.extraheader\" \\\n      GIT_CONFIG_VALUE_0=\"AUTHORIZATION: basic $basic\" \\\n      GIT_TERMINAL_PROMPT=0 git \"$@\"\n  else\n    GIT_TERMINAL_PROMPT=0 git \"$@\"\n  fi\n}\n\n# Clone .github/ of one repository and scan it. Sets STATUS and WORKFLOWS.\nscan_repo() {\n  local full=$1 dir=\"$WORK/clone\" dest wf files=()\n  STATUS=clone-failed\n  WORKFLOWS=0\n  rm -rf \"$dir\"\n  if ! git_auth clone --quiet --depth 1 --filter=blob:none --sparse --no-tags \\\n    \"$SERVER_URL/$full.git\" \"$dir\" 2>>\"$OUT/errors.log\" ||\n    ! git -C \"$dir\" sparse-checkout set .github 2>>\"$OUT/errors.log\"; then\n    echo \"[$full] clone failed\" >>\"$OUT/errors.log\"\n    return\n  fi\n\n  for wf in \"$dir\"/.github/workflows/*.yml \"$dir\"/.github/workflows/*.yaml; do\n    [ -f \"$wf\" ] && files+=(\".github/workflows/${wf##*/}\")\n  done\n  WORKFLOWS=${#files[@]}\n  if [ \"$WORKFLOWS\" = 0 ]; then\n    STATUS=no-workflows\n    rm -rf \"$dir\"\n    return\n  fi\n\n  dest=\"$OUT/repos/${full%%/*}__${full#*/}\"\n  mkdir -p \"$dest/inventory\"\n  echo \"[$full] secureci output:\" >>\"$OUT/errors.log\"\n  # validate exits 1 when it finds errors; the JSON is still the result.\n  (cd \"$dir\" && secureci validate --format json ${CONTRACT_ARG:+--contract \"$CONTRACT_ARG\"} \"${files[@]}\") \\\n    >\"$dest/validate.json\" 2>>\"$OUT/errors.log\" || true\n  for wf in \"${files[@]}\"; do\n    (cd \"$dir\" && secureci inventory --dry-run \"$wf\") \\\n      >\"$dest/inventory/${wf##*/}.json\" 2>>\"$OUT/errors.log\" || true\n  done\n  STATUS=scanned\n  rm -rf \"$dir\"\n}\n\nmain() {\n  ORG=\"\"\n  OUT=\"\"\n  REPO_FILE=\"\"\n  CONTRACT=\"\"\n  INCLUDE_FORKS=0\n  while [ $# -gt 0 ]; do\n    case \"$1\" in\n      -h | --help) usage; exit 0 ;;\n      --repos) [ $# -ge 2 ] || usage_error \"--repos needs a file\"; REPO_FILE=$2; shift 2 ;;\n      --out) [ $# -ge 2 ] || usage_error \"--out needs a directory\"; OUT=$2; shift 2 ;;\n      --contract) [ $# -ge 2 ] || usage_error \"--contract needs a file\"; CONTRACT=$2; shift 2 ;;\n      --include-forks) INCLUDE_FORKS=1; shift ;;\n      -*) usage_error \"unknown option: $1\" ;;\n      *)\n        [ -z \"$ORG\" ] || usage_error \"unexpected argument: $1\"\n        ORG=$1; shift ;;\n    esac\n  done\n  [ -n \"$ORG\" ] || usage_error \"missing <org>\"\n  [[ $ORG =~ ^[A-Za-z0-9._-]+$ ]] || usage_error \"not an organisation name: $ORG\"\n\n  SECURECI=${SECURECI:-secureci}\n  for tool in git curl base64 tar; do\n    has \"$tool\" || die \"$tool is required\"\n  done\n  has \"$SECURECI\" || die \"the SecureCI CLI ($SECURECI) was not found. Install it: curl -fsSL $INSTALL_URL | sh (or npm install -g @secureci/cli)\"\n  SECURECI_VERSION=$(secureci --version 2>/dev/null) || die \"could not run $SECURECI --version\"\n\n  TOKEN=${GITHUB_TOKEN:-${GH_TOKEN:-}}\n  SERVER_URL=${GITHUB_SERVER_URL:-https://github.com}\n  SERVER_URL=${SERVER_URL%/}\n  if [ -z \"${GITHUB_API_URL:-}\" ]; then\n    if [ \"$SERVER_URL\" = https://github.com ]; then\n      API_URL=https://api.github.com\n    else\n      API_URL=\"$SERVER_URL/api/v3\"\n    fi\n  else\n    API_URL=${GITHUB_API_URL%/}\n  fi\n\n  # A local contract is resolved now, because secureci runs inside each clone.\n  CONTRACT_ARG=$CONTRACT\n  if [ -n \"$CONTRACT\" ] && [ -f \"$CONTRACT\" ]; then\n    CONTRACT_ARG=\"$(cd \"$(dirname \"$CONTRACT\")\" && pwd -P)/$(basename \"$CONTRACT\")\"\n  fi\n  if [ -n \"$REPO_FILE\" ] && [ ! -f \"$REPO_FILE\" ]; then\n    die \"--repos file not found: $REPO_FILE\"\n  fi\n\n  OUT=${OUT:-secureci-org-scan-$ORG}\n  OUT=${OUT%/}\n  [ ! -e \"$OUT\" ] || die \"$OUT already exists; remove it or pass --out <dir>\"\n  [ ! -e \"$OUT.tar.gz\" ] || die \"$OUT.tar.gz already exists; remove it or pass --out <dir>\"\n  WORK=$(mktemp -d \"${TMPDIR:-/tmp}/secureci-org-scan.XXXXXX\")\n  trap 'rm -rf \"$WORK\"' EXIT\n\n  local repos=() full\n  if [ -n \"$REPO_FILE\" ]; then\n    while IFS= read -r full; do repos+=(\"$full\"); done < <(read_repo_file \"$REPO_FILE\")\n  else\n    say \"listing repositories in $ORG ($API_URL)\"\n    list_repos >\"$WORK/repos.txt\"\n    while IFS= read -r full; do repos+=(\"$full\"); done <\"$WORK/repos.txt\"\n  fi\n\n  local valid=()\n  for full in ${repos[@]+\"${repos[@]}\"}; do\n    if [[ $full =~ $NAME_RE ]] && [[ $full != *..* ]]; then\n      valid+=(\"$full\")\n    else\n      say \"skipping unexpected repository name: $full\"\n    fi\n  done\n  [ ${#valid[@]} -gt 0 ] || die \"no repositories to scan\"\n\n  mkdir -p \"$OUT/repos\"\n  : >\"$OUT/errors.log\"\n  OUT=$(cd \"$OUT\" && pwd -P)\n\n  local total=${#valid[@]} i=0 scanned=0 empty=0 failed=0 entries=\"\"\n  for full in \"${valid[@]}\"; do\n    i=$((i + 1))\n    scan_repo \"$full\"\n    case \"$STATUS\" in\n      scanned) scanned=$((scanned + 1)) ;;\n      no-workflows) empty=$((empty + 1)) ;;\n      *) failed=$((failed + 1)) ;;\n    esac\n    say \"[$i/$total] $full: $STATUS ($WORKFLOWS workflows)\"\n    entries+=\"${entries:+,}\n    {\\\"name\\\": $(json_str \"$full\"), \\\"status\\\": \\\"$STATUS\\\", \\\"workflows\\\": $WORKFLOWS}\"\n  done\n\n  local contract_json=null\n  [ -z \"$CONTRACT\" ] || contract_json=$(json_str \"$CONTRACT\")\n  cat >\"$OUT/manifest.json\" <<EOF\n{\n  \"tool\": \"secureci-org-scan\",\n  \"scriptVersion\": $SCAN_SCRIPT_VERSION,\n  \"secureciVersion\": $(json_str \"$SECURECI_VERSION\"),\n  \"org\": $(json_str \"$ORG\"),\n  \"server\": $(json_str \"$SERVER_URL\"),\n  \"scannedAt\": \"$(date -u +%Y-%m-%dT%H:%M:%SZ)\",\n  \"contract\": $contract_json,\n  \"repos\": [$entries\n  ]\n}\nEOF\n\n  tar -czf \"$OUT.tar.gz\" -C \"$(dirname \"$OUT\")\" \"$(basename \"$OUT\")\"\n\n  cat <<EOF\n\nScanned $total repositories in $ORG: $scanned scanned, $empty without workflows, $failed failed.\n\nResults: $OUT/\nArchive: $OUT.tar.gz\n\nThe archive holds only JSON results (repository and workflow names, the\nactions they use and the findings) plus errors.log, never source code.\nCheck it before you send it:  tar -tzf $OUT.tar.gz\n\nEmail it to hello@secure-ci.dev. If your policy doesn't allow sending it by\nemail, write to us there and we'll agree another way.\nEOF\n}\n\nmain \"$@\"\n";
+//# sourceMappingURL=org-scan-script.js.map

package/dist/org-scan.js

@@ -0,0 +1,88 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.orgScanArgs = orgScanArgs;
+exports.orgScanEnv = orgScanEnv;
+exports.runOrgScan = runOrgScan;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const org_scan_script_1 = require("./org-scan-script");
+/** The script's arguments for `org` and the command's options. */
+function orgScanArgs(org, options) {
+    const args = [];
+    if (options.repos)
+        args.push('--repos', options.repos);
+    if (options.out)
+        args.push('--out', options.out);
+    if (options.contract)
+        args.push('--contract', options.contract);
+    if (options.includeForks)
+        args.push('--include-forks');
+    return [...args, org];
+}
+/**
+ * How the script should run this same CLI: the standalone binary directly,
+ * or node with the CLI's entry file when installed with npm.
+ */
+function orgScanEnv(self) {
+    if (self.sea || !self.entry)
+        return { SECURECI: self.execPath };
+    return { SECURECI: self.execPath, SECURECI_ENTRY: self.entry };
+}
+/** Run the scan; resolves with the script's exit status. */
+async function runOrgScan(org, options, deps) {
+    const dir = fs.mkdtempSync(path.join(deps.tmpdir(), 'secureci-org-scan-'));
+    const script = path.join(dir, 'org-scan.sh');
+    try {
+        fs.writeFileSync(script, org_scan_script_1.ORG_SCAN_SCRIPT, { mode: 0o700 });
+        const env = { ...deps.env, ...orgScanEnv(deps) };
+        return await new Promise((resolve, reject) => {
+            const child = deps.spawn('bash', [script, ...orgScanArgs(org, options)], {
+                stdio: 'inherit',
+                env
+            });
+            child.on('error', (error) => {
+                reject(error.code === 'ENOENT'
+                    ? new Error('`secureci org scan` needs bash. On Windows, run it from Git Bash or WSL.')
+                    : error);
+            });
+            child.on('close', (code) => resolve(code ?? 1));
+        });
+    }
+    finally {
+        fs.rmSync(dir, { recursive: true, force: true });
+    }
+}
+//# sourceMappingURL=org-scan.js.map