@secureci/cli 1.0.1 → 1.1.0

package/README.md

@@ -73,10 +73,10 @@ less install.sh
 sh install.sh
 ```
 
-Set `SECURECI_VERSION=1.0.1` to install a specific release,
+Set `SECURECI_VERSION=1.1.0` to install a specific release,
 `SECURECI_INSTALL_DIR` to install somewhere else, and
 `SECURECI_REQUIRE_ATTESTATION=1` to fail unless `gh` verifies build provenance
-(e.g. `curl -fsSL https://secure-ci.dev/install.sh | SECURECI_VERSION=1.0.1 sh`).
+(e.g. `curl -fsSL https://secure-ci.dev/install.sh | SECURECI_VERSION=1.1.0 sh`).
 If the release's download link fails (GitHub has returned `504` for one while
 its API still served the files), the script fetches the same files through the
 GitHub API instead; the `SHA256SUMS` and provenance checks are unchanged.
@@ -154,6 +154,9 @@ secureci inventory --check    # fail on drift (use in CI)
 
 # Pin action tags to commit SHAs in place (keeps `# v4` for Dependabot/Renovate)
 secureci pin
+
+# Scan every repository in an organisation (JSON results, never source code)
+secureci org scan my-org
 ```
 
 ### Agent skill
@@ -254,18 +257,24 @@ things to know:
 
 - **Linux containers only.** `windows-*` / `macos-*` jobs run in a Linux image
   with a warning.
-- **Jobs running in parallel share your working copy.** Each job has its own
-  container, but every job mounts the same directory, so jobs that write the
-  same files (e.g. `node_modules`) can collide; use `--parallel 1` to run jobs
-  one after another.
+- **Jobs running in parallel share your working copy** by default. Each job has
+  its own container, but every job mounts the same directory, so jobs that
+  write the same files (e.g. `node_modules`) can collide; pass
+  `--isolate-workspace` to give each job its own copy, or `--parallel 1` to run
+  jobs one after another.
 - **`actions/checkout` of the current repo doesn't clone** — it uses your working
-  copy as-is (so uncommitted changes are visible); `ref:`/`fetch-depth:` are
-  ignored. Other repositories check out for real and need a token.
+  copy as-is (so uncommitted changes are visible). A `ref:` your local
+  repository has is checked out only into a `path:`; other refs and
+  `fetch-depth:` don't change what you get. Other repositories check out for
+  real and need a token.
 - **Artifacts and cache are local stand-ins**, stored under `~/.secureci/`;
   nothing is uploaded to or downloaded from GitHub.
-- **Contract checks** don't evaluate `if:` conditions and, without
-  `--contract-recurse all`, don't look inside _remote_ composite actions /
-  reusable workflows.
+- **Not emulated:** `concurrency:` (noted at run start), deployment
+  `environment:` (protection rules and environment-scoped secrets/vars: pass
+  them with `--secret`/`--var`), and OIDC tokens for `id-token: write`.
+- **Contract checks** decide `if:` conditions only from the workflow's triggers
+  (`github.event_name`) and, without `--contract-recurse all`, don't look inside
+  _remote_ composite actions / reusable workflows.
 
 The exact scope of each is documented in
 [DOCS.md](DOCS.md#contract-limitations-v1-scope).

package/dist/advisories.js

@@ -61,6 +61,17 @@ exports.VULNERABLE_ACTION_RULE = 'secureci/vulnerable-action';
 /** Cached advisories are re-fetched after this long. */
 exports.ADVISORY_TTL_MS = 24 * 60 * 60 * 1000;
 const ADVISORY_TIMEOUT_MS = 15000;
+/** Pages of advisories read per repository (100 each). */
+const MAX_ADVISORY_PAGES = 10;
+/** The `rel="next"` URL of a `Link` header, if any. */
+function nextPageUrl(link) {
+    for (const part of (link ?? '').split(',')) {
+        const match = part.match(/<([^>]+)>\s*;\s*rel="?next"?/);
+        if (match)
+            return match[1];
+    }
+    return undefined;
+}
 const VERSION = /^v?(\d+(?:\.\d+)*)(?:-([0-9A-Za-z.-]+))?(?:\+[0-9A-Za-z.-]+)?$/;
 /** `v1.2.3`, `1.2`, `v4`, `2.0.0-rc.1`; null for anything else. */
 function parseVersion(text) {
@@ -359,7 +370,7 @@ function describeError(error, authenticated) {
  * The advisories naming `owner/repo` in the actions ecosystem, cached per
  * repository for `ttlMs` (default 24h). Offline, the cache is used at any
  * age. If the API fails, a stale cache is used when there is one.
- * Only the first page (100 advisories) is read.
+ * Pages are followed (on the API's own host) up to 1,000 advisories.
  */
 async function fetchRepoAdvisories(owner, repo, options = {}) {
     if (!validName(owner) || !validName(repo))
@@ -386,7 +397,10 @@ async function fetchRepoAdvisories(owner, repo, options = {}) {
             : { error: 'offline and not cached' };
     }
     const httpGet = options.httpGet ??
-        ((url, headers) => (0, action_fetcher_1.getText)(url, headers, ADVISORY_TIMEOUT_MS));
+        ((url, headers) => (0, action_fetcher_1.getResponse)(url, headers, ADVISORY_TIMEOUT_MS).then((r) => ({
+            body: r.body,
+            link: [r.headers.link].flat()[0]
+        })));
     const query = new URLSearchParams({
         ecosystem: 'actions',
         affects: `${owner}/${repo}`,
@@ -400,19 +414,32 @@ async function fetchRepoAdvisories(owner, repo, options = {}) {
         ...(token ? { Authorization: `Bearer ${token}` } : {})
     });
     let token = options.token === undefined ? (0, action_fetcher_1.githubToken)() : options.token;
-    let body;
+    const page = async (pageUrl) => {
+        const response = await httpGet(pageUrl, headers(token));
+        return typeof response === 'string' ? { body: response } : response;
+    };
     try {
+        let response;
         try {
-            body = await httpGet(url, headers(token));
+            response = await page(url);
         }
         catch (error) {
             // A rejected token shouldn't block public advisories.
             if (!token || error.status !== 401)
                 throw error;
             token = null;
-            body = await httpGet(url, headers(null));
+            response = await page(url);
+        }
+        const advisories = parseAdvisories(JSON.parse(response.body));
+        // Later pages only from the API's own origin, which the token is for.
+        const origin = new URL(url).origin;
+        for (let pages = 1; pages < MAX_ADVISORY_PAGES; pages++) {
+            const next = nextPageUrl(response.link);
+            if (!next || new URL(next, url).origin !== origin)
+                break;
+            response = await page(new URL(next, url).toString());
+            advisories.push(...parseAdvisories(JSON.parse(response.body)));
         }
-        const advisories = parseAdvisories(JSON.parse(body));
         fs.mkdirSync(path.dirname(file), { recursive: true });
         const entry = { api, fetchedAt: now, advisories };
         fs.writeFileSync(file, JSON.stringify(entry, null, 2));

package/dist/cli.js

@@ -56,6 +56,11 @@ const env_file_1 = require("./utils/env-file");
 const config_1 = require("./config");
 const scheduler_1 = require("./runner/scheduler");
 const version_1 = require("./version");
+const org_scan_1 = require("./org-scan");
+const org_scan_script_1 = require("./org-scan-script");
+const node_binary_1 = require("./runner/node-binary");
+const child_process_1 = require("child_process");
+const os = __importStar(require("os"));
 const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
 /** Committed at the repo root, like package-lock.json / yarn.lock. */
@@ -128,6 +133,8 @@ program
     .option('--container-memory <limit>', 'Limit job container memory, e.g. 512m. Config: container-memory', globalConfig['container-memory'])
     .option('--no-network', 'Turn off container network access (on by default)')
     .option('--allow-network', 'Turn on container network access, overriding allow-network: false in the config')
+    .option('--isolate-workspace', "Run each job in its own copy of the working copy, removed when the job ends, so parallel jobs can't overwrite each other's files. Config: isolate-workspace")
+    .option('--no-isolate-workspace', 'Share the working copy between jobs, overriding isolate-workspace: true in the config')
     .option('--parallel <n>', 'Run up to this many jobs (and matrix combinations) at once; 1 runs them one after another. Default: the number of CPUs. Config: parallel', String(defaultParallel))
     .action(async (file, options) => {
     if (configError) {
@@ -206,7 +213,8 @@ program
                 : undefined,
             containerMemoryLimit: options.containerMemory,
             networkDisabled: (0, config_1.resolveNetworkDisabled)({ network: options.network, allowNetwork: options.allowNetwork }, globalConfig),
-            parallel
+            parallel,
+            isolateWorkspace: (0, config_1.resolveIsolateWorkspace)(options.isolateWorkspace, globalConfig)
         });
         if (!result.success) {
             process.exit(1);
@@ -994,6 +1002,43 @@ configCmd
     (0, config_1.saveConfig)(config);
     logger_1.logger.success(`Unset ${key} in ${(0, config_1.getConfigFilePath)()}`);
 });
+const orgCmd = program
+    .command('org')
+    .description('Organisation-wide commands (for a SecureCI supply-chain assessment)');
+orgCmd
+    .command('scan')
+    .description('Scan the GitHub Actions workflows of every repository in an organisation and pack the JSON results for a SecureCI supply-chain assessment (runs org-scan.sh; source code is never downloaded)')
+    .argument('[org]', 'GitHub organisation (or user) to scan')
+    .option('--repos <file>', 'Scan only the repositories in this file (one "name" or "owner/name" per line)')
+    .option('--out <dir>', 'Output directory (default: ./secureci-org-scan-<org>)')
+    .option('-c, --contract <file>', 'Also check workflows against this pipeline contract (local file or owner/repo/path@ref)')
+    .option('--include-forks', 'Also scan forked repositories')
+    .option('--print-script', 'Print the script this command runs, to review it, and exit')
+    .action(async (org, options) => {
+    if (options.printScript) {
+        process.stdout.write(org_scan_script_1.ORG_SCAN_SCRIPT);
+        return;
+    }
+    if (!org) {
+        logger_1.logger.error('Missing <org>: secureci org scan <org>');
+        process.exit(2);
+    }
+    try {
+        const code = await (0, org_scan_1.runOrgScan)(org, options, {
+            spawn: (command, args, spawnOptions) => (0, child_process_1.spawn)(command, args, spawnOptions),
+            tmpdir: os.tmpdir,
+            sea: (0, node_binary_1.isSea)(),
+            execPath: process.execPath,
+            entry: process.argv[1],
+            env: process.env
+        });
+        process.exit(code);
+    }
+    catch (error) {
+        logger_1.logger.error(error instanceof Error ? error.message : String(error));
+        process.exit(1);
+    }
+});
 const cacheCmd = program
     .command('cache')
     .description('Manage the cache of downloaded remote actions');

package/dist/config.js

@@ -44,6 +44,7 @@ exports.getConfigValue = getConfigValue;
 exports.setConfigValue = setConfigValue;
 exports.unsetConfigValue = unsetConfigValue;
 exports.parseConfigValue = parseConfigValue;
+exports.resolveIsolateWorkspace = resolveIsolateWorkspace;
 exports.resolveNetworkDisabled = resolveNetworkDisabled;
 const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
@@ -114,6 +115,7 @@ exports.CONFIG_KEYS = [
     'container-memory',
     'allow-network',
     'parallel',
+    'isolate-workspace',
     'env-file',
     'secret-file',
     'input-file',
@@ -177,8 +179,9 @@ function parseConfigValue(key, rawValue) {
             return num;
         }
         case 'allow-network':
+        case 'isolate-workspace':
             if (rawValue !== 'true' && rawValue !== 'false') {
-                throw new Error(`Invalid value "${rawValue}" for allow-network. Must be "true" or "false".`);
+                throw new Error(`Invalid value "${rawValue}" for ${key}. Must be "true" or "false".`);
             }
             return rawValue === 'true';
         case 'parallel':
@@ -196,6 +199,14 @@ function parseConfigValue(key, rawValue) {
             return rawValue;
     }
 }
+/**
+ * Whether each job runs in its own copy of the working copy:
+ * `--isolate-workspace` / `--no-isolate-workspace`, else
+ * `isolate-workspace` in the config file, else no.
+ */
+function resolveIsolateWorkspace(flag, config = loadConfig()) {
+    return flag ?? config['isolate-workspace'] === true;
+}
 /**
  * Whether container networking should be disabled. Networking is on by
  * default (matching GitHub-hosted runners); `--no-network` turns it off and

package/dist/org-scan-script.js

@@ -0,0 +1,6 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ORG_SCAN_SCRIPT = void 0;
+// Generated from org-scan.sh by scripts/gen-org-scan-script.mjs; don't edit.
+exports.ORG_SCAN_SCRIPT = "#!/usr/bin/env bash\n# Scan every GitHub Actions workflow in an organisation with the SecureCI CLI,\n# for a SecureCI supply-chain assessment.\n#\n#   bash org-scan.sh <org>\n#\n# Read it before you run it (it's short, on purpose):\n#\n#   curl -fsSL https://secure-ci.dev/org-scan.sh -o org-scan.sh\n#   less org-scan.sh\n#   GITHUB_TOKEN=... bash org-scan.sh my-org\n#\n# or, with the CLI installed: `secureci org scan my-org` runs this same script\n# (`secureci org scan --print-script` prints it).\n#\n# What it does, for each repository in the organisation (or in --repos):\n#\n#   1. Clones only the .github/ directory (a shallow, sparse clone: your\n#      application code is never downloaded) into a temporary directory.\n#   2. Runs `secureci validate --format json` on its workflows, and\n#      `secureci inventory --dry-run` on each workflow.\n#   3. Saves that JSON under the output directory and deletes the clone.\n#\n# Then it writes manifest.json (what was scanned, when, with which versions)\n# and packs everything into <output>.tar.gz. That archive is what you email to\n# hello@secure-ci.dev (if your policy doesn't allow email, tell us and we'll\n# agree another way).\n# It holds only the JSON results (repository and workflow names, the actions\n# they use, and the findings), never your source code. Look inside before you\n# send it: `tar -tzf <output>.tar.gz`.\n#\n# Archived repositories are skipped, and so are forks unless --include-forks.\n#\n# Your token stays on this machine: it is passed to curl on stdin and to git\n# through environment variables, never on a command line, and it is not\n# written to any output file.\n#\n# Requirements: bash, git 2.31+, curl, base64, tar, and the SecureCI CLI\n# (https://secure-ci.dev/install.sh or `npm install -g @secureci/cli`).\n#\n# Environment variables:\n#   GITHUB_TOKEN or GH_TOKEN  token that can read the organisation's\n#                             repositories (contents: read, metadata: read).\n#                             Needed for private repositories, and it raises\n#                             API rate limits. The CLI also uses it to resolve\n#                             action tags and look up security advisories.\n#   GITHUB_SERVER_URL         default https://github.com; set it for GitHub\n#                             Enterprise Server, e.g. https://github.example.com\n#   GITHUB_API_URL            default https://api.github.com, or\n#                             $GITHUB_SERVER_URL/api/v3 for Enterprise Server\n#   SECURECI                  the secureci executable (default: secureci on PATH)\n#\n# Exit status: 0 when the scan finished (some repositories may have failed:\n# see the summary and errors.log), 1 on an error, 2 on a usage error.\n\nset -euo pipefail\n\nSCAN_SCRIPT_VERSION=1\nINSTALL_URL=\"https://secure-ci.dev/install.sh\"\nNAME_RE='^[A-Za-z0-9._-]+/[A-Za-z0-9._-]+$'\n\nusage() {\n  cat <<'EOF'\nUsage: org-scan.sh [options] <org>\n\nScan every GitHub Actions workflow in <org> with the SecureCI CLI and pack the\nJSON results into <output>.tar.gz for a SecureCI supply-chain assessment.\n\nOptions:\n  --repos <file>     scan only these repositories: one per line, \"name\" or\n                     \"owner/name\"; blank lines and # comments are ignored\n  --out <dir>        output directory (default: ./secureci-org-scan-<org>)\n  --contract <file>  also check workflows against this pipeline contract\n                     (a local file, or owner/repo/path@ref)\n  --include-forks    also scan forked repositories\n  -h, --help         show this help\n\nEnvironment: GITHUB_TOKEN (or GH_TOKEN), GITHUB_SERVER_URL, GITHUB_API_URL,\nSECURECI. See the comments at the top of this script.\nEOF\n}\n\nsay() {\n  printf 'secureci-org-scan: %s\\n' \"$*\" >&2\n}\n\ndie() {\n  say \"error: $*\"\n  exit 1\n}\n\nusage_error() {\n  say \"$*\"\n  usage >&2\n  exit 2\n}\n\nhas() {\n  command -v \"$1\" >/dev/null 2>&1\n}\n\n# JSON string literal for $1.\njson_str() {\n  local s=$1\n  s=${s//\\\\/\\\\\\\\}\n  s=${s//\\\"/\\\\\\\"}\n  s=${s//$'\\t'/\\\\t}\n  s=${s//$'\\n'/\\\\n}\n  printf '\"%s\"' \"$s\"\n}\n\n# Run the secureci CLI (SECURECI_ENTRY is set when SECURECI is node itself).\nsecureci() {\n  if [ -n \"${SECURECI_ENTRY:-}\" ]; then\n    \"$SECURECI\" \"$SECURECI_ENTRY\" \"$@\"\n  else\n    \"$SECURECI\" \"$@\"\n  fi\n}\n\n# GET an API URL into a file; prints the HTTP status. The token goes to curl\n# on stdin (--config -), so it never shows up in the process list.\napi_get() {\n  local url=$1 out=$2\n  {\n    printf 'url = \"%s\"\\n' \"$url\"\n    printf 'header = \"Accept: application/vnd.github+json\"\\n'\n    printf 'header = \"X-GitHub-Api-Version: 2022-11-28\"\\n'\n    if [ -n \"$TOKEN\" ]; then\n      printf 'header = \"Authorization: Bearer %s\"\\n' \"$TOKEN\"\n    fi\n  } | curl --silent --show-error --location --config - \\\n    --output \"$out\" --write-out '%{http_code}' || echo 000\n}\n\n# Print owner/name for each repository in a page of the repos API, skipping\n# archived repositories and (unless --include-forks) forks. Splitting on\n# commas puts each top-level key on its own line; keys inside strings are\n# escaped (\\\"full_name\\\") and can't match the anchored patterns.\nparse_repos() {\n  tr ',' '\\n' <\"$1\" | awk -v forks=\"$INCLUDE_FORKS\" '\n    function flush() {\n      if (name != \"\" && archived != \"true\" && (forks == \"1\" || fork != \"true\"))\n        print name\n      name = \"\"; fork = \"\"; archived = \"\"\n    }\n    /^[[:space:]{[]*\"full_name\"[[:space:]]*:/ {\n      flush()\n      line = $0\n      sub(/^[^:]*:[[:space:]]*\"/, \"\", line)\n      sub(/\".*$/, \"\", line)\n      name = line\n      next\n    }\n    /^[[:space:]]*\"fork\"[[:space:]]*:/ {\n      fork = ($0 ~ /true/) ? \"true\" : \"false\"; next\n    }\n    /^[[:space:]]*\"archived\"[[:space:]]*:/ {\n      archived = ($0 ~ /true/) ? \"true\" : \"false\"; next\n    }\n    END { flush() }\n  '\n}\n\n# List the organisation's repositories over the API (or the user's, when\n# <org> is a user account), one owner/name per line.\nlist_repos() {\n  local base=\"$API_URL/orgs/$ORG/repos?per_page=100\" page=1 status\n  local body=\"$WORK/page.json\"\n  while :; do\n    status=$(api_get \"$base&page=$page\" \"$body\")\n    if [ \"$status\" = 404 ] && [ \"$page\" = 1 ] && [ \"${base#*/users/}\" = \"$base\" ]; then\n      base=\"$API_URL/users/$ORG/repos?per_page=100&type=owner\"\n      continue\n    fi\n    [ \"$status\" = 200 ] || die \"listing repositories for $ORG failed: HTTP $status from ${base%%\\?*} (check GITHUB_TOKEN and GITHUB_API_URL)\"\n    # An empty page ends the listing.\n    if ! grep -q '\"full_name\"' \"$body\"; then\n      break\n    fi\n    parse_repos \"$body\"\n    page=$((page + 1))\n  done\n}\n\n# Repositories from a --repos file, one owner/name per line.\nread_repo_file() {\n  local line\n  while IFS= read -r line || [ -n \"$line\" ]; do\n    line=${line%%#*}\n    line=$(printf '%s' \"$line\" | tr -d '[:space:]')\n    [ -n \"$line\" ] || continue\n    case \"$line\" in\n      */*) printf '%s\\n' \"$line\" ;;\n      *) printf '%s/%s\\n' \"$ORG\" \"$line\" ;;\n    esac\n  done <\"$1\"\n}\n\n# git with the token as an HTTP header scoped to the server, passed through\n# GIT_CONFIG_* environment variables rather than arguments or a URL.\ngit_auth() {\n  if [ -n \"$TOKEN\" ]; then\n    local basic\n    basic=$(printf 'x-access-token:%s' \"$TOKEN\" | base64 | tr -d '\\n')\n    GIT_CONFIG_COUNT=1 \\\n      GIT_CONFIG_KEY_0=\"http.$SERVER_URL/.extraheader\" \\\n      GIT_CONFIG_VALUE_0=\"AUTHORIZATION: basic $basic\" \\\n      GIT_TERMINAL_PROMPT=0 git \"$@\"\n  else\n    GIT_TERMINAL_PROMPT=0 git \"$@\"\n  fi\n}\n\n# Clone .github/ of one repository and scan it. Sets STATUS and WORKFLOWS.\nscan_repo() {\n  local full=$1 dir=\"$WORK/clone\" dest wf files=()\n  STATUS=clone-failed\n  WORKFLOWS=0\n  rm -rf \"$dir\"\n  if ! git_auth clone --quiet --depth 1 --filter=blob:none --sparse --no-tags \\\n    \"$SERVER_URL/$full.git\" \"$dir\" 2>>\"$OUT/errors.log\" ||\n    ! git -C \"$dir\" sparse-checkout set .github 2>>\"$OUT/errors.log\"; then\n    echo \"[$full] clone failed\" >>\"$OUT/errors.log\"\n    return\n  fi\n\n  for wf in \"$dir\"/.github/workflows/*.yml \"$dir\"/.github/workflows/*.yaml; do\n    [ -f \"$wf\" ] && files+=(\".github/workflows/${wf##*/}\")\n  done\n  WORKFLOWS=${#files[@]}\n  if [ \"$WORKFLOWS\" = 0 ]; then\n    STATUS=no-workflows\n    rm -rf \"$dir\"\n    return\n  fi\n\n  dest=\"$OUT/repos/${full%%/*}__${full#*/}\"\n  mkdir -p \"$dest/inventory\"\n  echo \"[$full] secureci output:\" >>\"$OUT/errors.log\"\n  # validate exits 1 when it finds errors; the JSON is still the result.\n  (cd \"$dir\" && secureci validate --format json ${CONTRACT_ARG:+--contract \"$CONTRACT_ARG\"} \"${files[@]}\") \\\n    >\"$dest/validate.json\" 2>>\"$OUT/errors.log\" || true\n  for wf in \"${files[@]}\"; do\n    (cd \"$dir\" && secureci inventory --dry-run \"$wf\") \\\n      >\"$dest/inventory/${wf##*/}.json\" 2>>\"$OUT/errors.log\" || true\n  done\n  STATUS=scanned\n  rm -rf \"$dir\"\n}\n\nmain() {\n  ORG=\"\"\n  OUT=\"\"\n  REPO_FILE=\"\"\n  CONTRACT=\"\"\n  INCLUDE_FORKS=0\n  while [ $# -gt 0 ]; do\n    case \"$1\" in\n      -h | --help) usage; exit 0 ;;\n      --repos) [ $# -ge 2 ] || usage_error \"--repos needs a file\"; REPO_FILE=$2; shift 2 ;;\n      --out) [ $# -ge 2 ] || usage_error \"--out needs a directory\"; OUT=$2; shift 2 ;;\n      --contract) [ $# -ge 2 ] || usage_error \"--contract needs a file\"; CONTRACT=$2; shift 2 ;;\n      --include-forks) INCLUDE_FORKS=1; shift ;;\n      -*) usage_error \"unknown option: $1\" ;;\n      *)\n        [ -z \"$ORG\" ] || usage_error \"unexpected argument: $1\"\n        ORG=$1; shift ;;\n    esac\n  done\n  [ -n \"$ORG\" ] || usage_error \"missing <org>\"\n  [[ $ORG =~ ^[A-Za-z0-9._-]+$ ]] || usage_error \"not an organisation name: $ORG\"\n\n  SECURECI=${SECURECI:-secureci}\n  for tool in git curl base64 tar; do\n    has \"$tool\" || die \"$tool is required\"\n  done\n  has \"$SECURECI\" || die \"the SecureCI CLI ($SECURECI) was not found. Install it: curl -fsSL $INSTALL_URL | sh (or npm install -g @secureci/cli)\"\n  SECURECI_VERSION=$(secureci --version 2>/dev/null) || die \"could not run $SECURECI --version\"\n\n  TOKEN=${GITHUB_TOKEN:-${GH_TOKEN:-}}\n  SERVER_URL=${GITHUB_SERVER_URL:-https://github.com}\n  SERVER_URL=${SERVER_URL%/}\n  if [ -z \"${GITHUB_API_URL:-}\" ]; then\n    if [ \"$SERVER_URL\" = https://github.com ]; then\n      API_URL=https://api.github.com\n    else\n      API_URL=\"$SERVER_URL/api/v3\"\n    fi\n  else\n    API_URL=${GITHUB_API_URL%/}\n  fi\n\n  # A local contract is resolved now, because secureci runs inside each clone.\n  CONTRACT_ARG=$CONTRACT\n  if [ -n \"$CONTRACT\" ] && [ -f \"$CONTRACT\" ]; then\n    CONTRACT_ARG=\"$(cd \"$(dirname \"$CONTRACT\")\" && pwd -P)/$(basename \"$CONTRACT\")\"\n  fi\n  if [ -n \"$REPO_FILE\" ] && [ ! -f \"$REPO_FILE\" ]; then\n    die \"--repos file not found: $REPO_FILE\"\n  fi\n\n  OUT=${OUT:-secureci-org-scan-$ORG}\n  OUT=${OUT%/}\n  [ ! -e \"$OUT\" ] || die \"$OUT already exists; remove it or pass --out <dir>\"\n  [ ! -e \"$OUT.tar.gz\" ] || die \"$OUT.tar.gz already exists; remove it or pass --out <dir>\"\n  WORK=$(mktemp -d \"${TMPDIR:-/tmp}/secureci-org-scan.XXXXXX\")\n  trap 'rm -rf \"$WORK\"' EXIT\n\n  local repos=() full\n  if [ -n \"$REPO_FILE\" ]; then\n    while IFS= read -r full; do repos+=(\"$full\"); done < <(read_repo_file \"$REPO_FILE\")\n  else\n    say \"listing repositories in $ORG ($API_URL)\"\n    list_repos >\"$WORK/repos.txt\"\n    while IFS= read -r full; do repos+=(\"$full\"); done <\"$WORK/repos.txt\"\n  fi\n\n  local valid=()\n  for full in ${repos[@]+\"${repos[@]}\"}; do\n    if [[ $full =~ $NAME_RE ]] && [[ $full != *..* ]]; then\n      valid+=(\"$full\")\n    else\n      say \"skipping unexpected repository name: $full\"\n    fi\n  done\n  [ ${#valid[@]} -gt 0 ] || die \"no repositories to scan\"\n\n  mkdir -p \"$OUT/repos\"\n  : >\"$OUT/errors.log\"\n  OUT=$(cd \"$OUT\" && pwd -P)\n\n  local total=${#valid[@]} i=0 scanned=0 empty=0 failed=0 entries=\"\"\n  for full in \"${valid[@]}\"; do\n    i=$((i + 1))\n    scan_repo \"$full\"\n    case \"$STATUS\" in\n      scanned) scanned=$((scanned + 1)) ;;\n      no-workflows) empty=$((empty + 1)) ;;\n      *) failed=$((failed + 1)) ;;\n    esac\n    say \"[$i/$total] $full: $STATUS ($WORKFLOWS workflows)\"\n    entries+=\"${entries:+,}\n    {\\\"name\\\": $(json_str \"$full\"), \\\"status\\\": \\\"$STATUS\\\", \\\"workflows\\\": $WORKFLOWS}\"\n  done\n\n  local contract_json=null\n  [ -z \"$CONTRACT\" ] || contract_json=$(json_str \"$CONTRACT\")\n  cat >\"$OUT/manifest.json\" <<EOF\n{\n  \"tool\": \"secureci-org-scan\",\n  \"scriptVersion\": $SCAN_SCRIPT_VERSION,\n  \"secureciVersion\": $(json_str \"$SECURECI_VERSION\"),\n  \"org\": $(json_str \"$ORG\"),\n  \"server\": $(json_str \"$SERVER_URL\"),\n  \"scannedAt\": \"$(date -u +%Y-%m-%dT%H:%M:%SZ)\",\n  \"contract\": $contract_json,\n  \"repos\": [$entries\n  ]\n}\nEOF\n\n  tar -czf \"$OUT.tar.gz\" -C \"$(dirname \"$OUT\")\" \"$(basename \"$OUT\")\"\n\n  cat <<EOF\n\nScanned $total repositories in $ORG: $scanned scanned, $empty without workflows, $failed failed.\n\nResults: $OUT/\nArchive: $OUT.tar.gz\n\nThe archive holds only JSON results (repository and workflow names, the\nactions they use and the findings) plus errors.log, never source code.\nCheck it before you send it:  tar -tzf $OUT.tar.gz\n\nEmail it to hello@secure-ci.dev. If your policy doesn't allow sending it by\nemail, write to us there and we'll agree another way.\nEOF\n}\n\nmain \"$@\"\n";
+//# sourceMappingURL=org-scan-script.js.map

package/dist/org-scan.js

@@ -0,0 +1,88 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.orgScanArgs = orgScanArgs;
+exports.orgScanEnv = orgScanEnv;
+exports.runOrgScan = runOrgScan;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const org_scan_script_1 = require("./org-scan-script");
+/** The script's arguments for `org` and the command's options. */
+function orgScanArgs(org, options) {
+    const args = [];
+    if (options.repos)
+        args.push('--repos', options.repos);
+    if (options.out)
+        args.push('--out', options.out);
+    if (options.contract)
+        args.push('--contract', options.contract);
+    if (options.includeForks)
+        args.push('--include-forks');
+    return [...args, org];
+}
+/**
+ * How the script should run this same CLI: the standalone binary directly,
+ * or node with the CLI's entry file when installed with npm.
+ */
+function orgScanEnv(self) {
+    if (self.sea || !self.entry)
+        return { SECURECI: self.execPath };
+    return { SECURECI: self.execPath, SECURECI_ENTRY: self.entry };
+}
+/** Run the scan; resolves with the script's exit status. */
+async function runOrgScan(org, options, deps) {
+    const dir = fs.mkdtempSync(path.join(deps.tmpdir(), 'secureci-org-scan-'));
+    const script = path.join(dir, 'org-scan.sh');
+    try {
+        fs.writeFileSync(script, org_scan_script_1.ORG_SCAN_SCRIPT, { mode: 0o700 });
+        const env = { ...deps.env, ...orgScanEnv(deps) };
+        return await new Promise((resolve, reject) => {
+            const child = deps.spawn('bash', [script, ...orgScanArgs(org, options)], {
+                stdio: 'inherit',
+                env
+            });
+            child.on('error', (error) => {
+                reject(error.code === 'ENOENT'
+                    ? new Error('`secureci org scan` needs bash. On Windows, run it from Git Bash or WSL.')
+                    : error);
+            });
+            child.on('close', (code) => resolve(code ?? 1));
+        });
+    }
+    finally {
+        fs.rmSync(dir, { recursive: true, force: true });
+    }
+}
+//# sourceMappingURL=org-scan.js.map

package/dist/parser/pipeline-contract-validator.js

@@ -43,6 +43,7 @@ const repository_1 = require("../utils/repository");
 const action_fetcher_1 = require("../runner/action-fetcher");
 const github_lockfile_1 = require("../github-lockfile");
 const permissions_1 = require("./permissions");
+const expression_1 = require("../runner/expression");
 /** Maximum nesting of composite actions / reusable workflows. */
 const MAX_DEPTH = 10;
 /**
@@ -81,8 +82,17 @@ async function validatePipelineContract(parsed, spec, options = {}) {
     (spec.required ?? []).forEach((entry, idx) => {
         const path = `required[${idx}]`;
         const name = normalizeActionName(entry.uses);
-        const candidates = sequence.filter((u) => u.name === name);
-        if (candidates.length > 0 && candidates.every((c) => c.conditional)) {
+        const found = sequence.filter((u) => u.name === name);
+        const candidates = found.filter((u) => u.runs !== 'never');
+        if (found.length > 0 && candidates.length === 0) {
+            errors.push({
+                path,
+                message: `Required action "${entry.uses}" never runs: its if: conditions (on its step or job) can't be true for this workflow's triggers (${(graph.events ?? []).join(', ')})`,
+                severity: 'error'
+            });
+            return;
+        }
+        if (candidates.length > 0 && candidates.every((c) => c.runs === 'maybe')) {
             errors.push({
                 path,
                 message: `Required action "${entry.uses}" only runs under an if: condition (on its step or job), so it may be skipped`,
@@ -275,6 +285,20 @@ function needsTransitively(nodes, from, to) {
 async function buildGraph(parsed, recurse, offline) {
     const graph = { sequence: [], nodes: new Map(), errors: [] };
     const root = (0, repository_1.repositoryRoot)(parsed.path);
+    // `if:` conditions are decided, where they can be, for each trigger of
+    // the workflow (called workflows run with their caller's event). With
+    // workflow_call, the event is the caller's, so it isn't known.
+    graph.events = triggerEvents(parsed.file.on);
+    const known = graph.events
+        ? graph.events.map((event) => ({ github: { event_name: event } }))
+        : [{}];
+    /** `runs`, narrowed by a job or step's own `if:`. */
+    const within = (runs, condition) => runs.map((outer, i) => {
+        const own = (0, expression_1.staticCondition)(condition, known[i]);
+        if (outer === false || own === false)
+            return false;
+        return outer === true && own === true ? true : undefined;
+    });
     const isLocal = (uses) => uses.startsWith('./') || uses.startsWith('../');
     /**
      * The file behind a composite action / reusable workflow reference, or
@@ -355,31 +379,35 @@ async function buildGraph(parsed, recurse, offline) {
         }
         return true;
     };
-    const addUsage = (node, index, at, uses, conditional) => {
+    const addUsage = (node, index, at, uses, runs) => {
         graph.sequence.push({
             node,
             index,
             path: at,
-            conditional,
+            runs: runs.every((r) => r === false)
+                ? 'never'
+                : runs.every((r) => r === true)
+                    ? 'always'
+                    : 'maybe',
             ...splitActionRef(uses)
         });
     };
     /** Flatten a job's steps (and composite action steps) into `node`. */
-    const addSteps = async (steps, node, at, counter, stack, workflowRoot, conditional) => {
+    const addSteps = async (steps, node, at, counter, stack, workflowRoot, runs) => {
         for (const [i, step] of steps.entries()) {
             const stepPath = `${at}steps[${i}]`;
             if (!step.uses) {
                 counter.next++;
                 continue;
             }
-            const stepConditional = conditional || hasCondition(step.if);
-            addUsage(node, counter.next++, stepPath, step.uses, stepConditional);
+            const stepRuns = within(runs, step.if);
+            addUsage(node, counter.next++, stepPath, step.uses, stepRuns);
             const file = await resolveRef(step.uses, 'action', workflowRoot, stepPath);
             if (!file || !canEnter(file, stack, stepPath))
                 continue;
             const action = parse(file, stepPath);
             if (action?.type === 'action' && action.file.runs.using === 'composite') {
-                await addSteps(action.file.runs.steps ?? [], node, `${stepPath} > ${step.uses} > `, counter, [...stack, file], workflowRoot, stepConditional);
+                await addSteps(action.file.runs.steps ?? [], node, `${stepPath} > ${step.uses} > `, counter, [...stack, file], workflowRoot, stepRuns);
             }
         }
     };
@@ -388,7 +416,7 @@ async function buildGraph(parsed, recurse, offline) {
      * reusable-workflow call itself needs, plus the call). Returns the ids
      * of the added jobs.
      */
-    const addWorkflow = async (workflow, workflowRoot, prefix, labelPrefix, at, after, stack, conditional) => {
+    const addWorkflow = async (workflow, workflowRoot, prefix, labelPrefix, at, after, stack, runs) => {
         const added = [];
         // A job id -> the graph nodes standing for it (a reusable-workflow call
         // stands for the call and all of its called jobs).
@@ -408,17 +436,17 @@ async function buildGraph(parsed, recurse, offline) {
             });
             added.push(node);
             const jobPath = `${at}jobs.${jobId}`;
-            const jobConditional = conditional || hasCondition(job.if);
+            const jobRuns = within(runs, job.if);
             if (job.uses) {
                 // The call itself is a one-step "job" its called jobs run after.
-                addUsage(node, 0, jobPath, job.uses, jobConditional);
+                addUsage(node, 0, jobPath, job.uses, jobRuns);
                 graph.nodes.get(node).length = 1;
                 const ids = [node];
                 const file = await resolveRef(job.uses, 'workflow', workflowRoot, jobPath);
                 if (file && canEnter(file, stack, jobPath)) {
                     const called = parse(file, jobPath);
                     if (called?.type === 'workflow') {
-                        ids.push(...(await addWorkflow(called.file, (0, repository_1.repositoryRoot)(file), `${node}>`, `${labelPrefix}${jobId} > ${job.uses} > `, `${jobPath} > ${job.uses} > `, [...needs, node], [...stack, file], jobConditional)));
+                        ids.push(...(await addWorkflow(called.file, (0, repository_1.repositoryRoot)(file), `${node}>`, `${labelPrefix}${jobId} > ${job.uses} > `, `${jobPath} > ${job.uses} > `, [...needs, node], [...stack, file], jobRuns)));
                     }
                 }
                 alias.set(jobId, ids);
@@ -427,27 +455,30 @@ async function buildGraph(parsed, recurse, offline) {
             }
             alias.set(jobId, [node]);
             const counter = { next: 0 };
-            await addSteps(job.steps ?? [], node, `${jobPath}.`, counter, stack, workflowRoot, jobConditional);
+            await addSteps(job.steps ?? [], node, `${jobPath}.`, counter, stack, workflowRoot, jobRuns);
             graph.nodes.get(node).length = counter.next;
         }
         return added;
     };
-    await addWorkflow(parsed.file, root, '', '', '', [], [path.resolve(parsed.path)], false);
+    await addWorkflow(parsed.file, root, '', '', '', [], [path.resolve(parsed.path)], known.map(() => true));
     return graph;
 }
 /**
- * Whether an `if:` can skip the step/job: anything but a missing value,
- * `true`, `success()` (the default) or `always()`.
+ * The events that trigger a workflow (`on:` as a string, list or map), or
+ * undefined when the event isn't known: none are listed, or the workflow
+ * is reusable (it runs with its caller's event).
  */
-function hasCondition(condition) {
-    if (condition === undefined || condition === null || condition === true) {
-        return false;
-    }
-    const text = String(condition)
-        .trim()
-        .replace(/^\$\{\{([\s\S]*)\}\}$/, '$1')
-        .trim();
-    return !['', 'true', 'success()', 'always()'].includes(text);
+function triggerEvents(on) {
+    const events = typeof on === 'string'
+        ? [on]
+        : Array.isArray(on)
+            ? on.map(String)
+            : on && typeof on === 'object'
+                ? Object.keys(on)
+                : [];
+    return events.length === 0 || events.includes('workflow_call')
+        ? undefined
+        : events;
 }
 function splitActionRef(uses) {
     const atIndex = uses.lastIndexOf('@');

package/dist/runner/action-fetcher.js

@@ -43,6 +43,7 @@ exports.lsRemoteSha = lsRemoteSha;
 exports.parseLsRemoteTags = parseLsRemoteTags;
 exports.lsRemoteTags = lsRemoteTags;
 exports.getText = getText;
+exports.getResponse = getResponse;
 exports.followRedirect = followRedirect;
 exports.fetchAction = fetchAction;
 exports.fetchRepoFile = fetchRepoFile;
@@ -222,6 +223,10 @@ async function lsRemoteTags(url) {
  * with an error carrying `status`.
  */
 function getText(url, headers, timeoutMs) {
+    return getResponse(url, headers, timeoutMs).then((r) => r.body);
+}
+/** getText, with the response headers (e.g. `link` for pagination). */
+function getResponse(url, headers, timeoutMs) {
     return new Promise((resolve, reject) => {
         const client = url.startsWith('http://') ? http : https;
         const request = client.get(url, { headers }, (response) => {
@@ -237,7 +242,7 @@ function getText(url, headers, timeoutMs) {
                 body += chunk;
             });
             response.on('end', () => response.statusCode === 200
-                ? resolve(body)
+                ? resolve({ body, headers: response.headers })
                 : reject(Object.assign(new Error(`HTTP ${response.statusCode}`), {
                     status: response.statusCode
                 })));

package/dist/runner/actions.js

@@ -93,7 +93,7 @@ function warnUnsandboxedActions(steps, ctx, options) {
 async function stepFileSystem(runtime) {
     const container = runtime.container;
     if (!container)
-        return (0, builtin_actions_1.hostFileSystem)(process.cwd());
+        return (0, builtin_actions_1.hostFileSystem)(runtime.workspace);
     if (container.home === undefined) {
         const probe = await container.runtime.exec(container.id, {
             command: 'printf %s "$HOME"'
@@ -102,7 +102,7 @@ async function stepFileSystem(runtime) {
     }
     return (0, builtin_actions_1.containerFileSystem)({
         workspace: container_runtime_1.CONTAINER_WORKDIR,
-        hostWorkspace: process.cwd(),
+        hostWorkspace: runtime.workspace,
         home: container.home,
         copyFrom: (from, to) => container.runtime.copyFrom(container.id, from, to),
         copyTo: (from, to) => container.runtime.copyTo(container.id, from, to),
@@ -259,8 +259,8 @@ function isLocalActionRef(uses) {
  * Resolve a local action (`uses: ./path/to/action`) relative to the
  * workspace, like the runner does, to its action.yml / action.yaml.
  */
-function resolveLocalAction(uses) {
-    const dir = path.resolve(process.cwd(), uses);
+function resolveLocalAction(uses, workspace = process.cwd()) {
+    const dir = path.resolve(workspace, uses);
     for (const name of ['action.yml', 'action.yaml']) {
         const candidate = path.join(dir, name);
         if (fs.existsSync(candidate))
@@ -297,7 +297,7 @@ async function executeAction(step, options, startTime, runtime, ctx) {
                     args: withValues.args ? (0, shell_1.splitArgs)(withValues.args) : []
                 }
             };
-            return await (0, docker_action_1.executeDockerAction)(dockerAction, path.join(process.cwd(), 'action.yml'), step, {}, callerCtx.env, options, runtime, startTime);
+            return await (0, docker_action_1.executeDockerAction)(dockerAction, path.join(runtime.workspace, 'action.yml'), step, {}, callerCtx.env, options, runtime, startTime);
         }
         if (options.localCheckout !== false &&
             (0, checkout_1.isLocalCheckout)(step.uses, step.with, callerCtx)) {
@@ -308,11 +308,11 @@ async function executeAction(step, options, startTime, runtime, ctx) {
             return await runBuiltinAction(builtin, step, callerCtx, options, runtime, startTime);
         }
         const actionPath = isLocalActionRef(step.uses)
-            ? resolveLocalAction(step.uses)
+            ? resolveLocalAction(step.uses, runtime.workspace)
             : await fetchActionOnce(step.uses, options, runtime);
         if (!actionPath) {
             const error = `Could not resolve action "${step.uses}"${isLocalActionRef(step.uses)
-                ? ` (no action.yml or action.yaml in ${path.resolve(process.cwd(), step.uses)})`
+                ? ` (no action.yml or action.yaml in ${path.resolve(runtime.workspace, step.uses)})`
                 : ''}`;
             logger_1.logger.error(error);
             return {