@secureci/cli 1.0.1 → 1.2.0

package/README.md

@@ -73,10 +73,10 @@ less install.sh
 sh install.sh
 ```
 
-Set `SECURECI_VERSION=1.0.1` to install a specific release,
+Set `SECURECI_VERSION=1.2.0` to install a specific release,
 `SECURECI_INSTALL_DIR` to install somewhere else, and
 `SECURECI_REQUIRE_ATTESTATION=1` to fail unless `gh` verifies build provenance
-(e.g. `curl -fsSL https://secure-ci.dev/install.sh | SECURECI_VERSION=1.0.1 sh`).
+(e.g. `curl -fsSL https://secure-ci.dev/install.sh | SECURECI_VERSION=1.2.0 sh`).
 If the release's download link fails (GitHub has returned `504` for one while
 its API still served the files), the script fetches the same files through the
 GitHub API instead; the `SHA256SUMS` and provenance checks are unchanged.
@@ -154,6 +154,9 @@ secureci inventory --check    # fail on drift (use in CI)
 
 # Pin action tags to commit SHAs in place (keeps `# v4` for Dependabot/Renovate)
 secureci pin
+
+# Scan every repository in an organisation (JSON results, never source code)
+secureci org scan my-org
 ```
 
 ### Agent skill
@@ -254,18 +257,30 @@ things to know:
 
 - **Linux containers only.** `windows-*` / `macos-*` jobs run in a Linux image
   with a warning.
-- **Jobs running in parallel share your working copy.** Each job has its own
-  container, but every job mounts the same directory, so jobs that write the
-  same files (e.g. `node_modules`) can collide; use `--parallel 1` to run jobs
-  one after another.
+- **Jobs running in parallel share your working copy** by default. Each job has
+  its own container, but every job mounts the same directory, so jobs that
+  write the same files (e.g. `node_modules`) can collide; pass
+  `--isolate-workspace` to give each job its own copy, or `--parallel 1` to run
+  jobs one after another.
 - **`actions/checkout` of the current repo doesn't clone** — it uses your working
-  copy as-is (so uncommitted changes are visible); `ref:`/`fetch-depth:` are
-  ignored. Other repositories check out for real and need a token.
+  copy as-is (so uncommitted changes are visible). A `ref:` is checked out only
+  into a `path:`, from your local repository, or fetched from `origin` with
+  `--fetch-refs` (opt-in); `fetch-depth:` applies to that clone. Other
+  repositories check out for real and need a token.
 - **Artifacts and cache are local stand-ins**, stored under `~/.secureci/`;
   nothing is uploaded to or downloaded from GitHub.
-- **Contract checks** don't evaluate `if:` conditions and, without
-  `--contract-recurse all`, don't look inside _remote_ composite actions /
-  reusable workflows.
+- **`concurrency:`** groups of jobs run one at a time within a run;
+  `--concurrency github` also cancels as GitHub does. Workflow-level
+  `concurrency:` has no other runs to apply to.
+- **Container `credentials:`** are used only with `--registry-login`, through a
+  temporary login removed right after the pull; otherwise use `docker login`.
+- **Not emulated:** deployment `environment:` (protection rules and
+  environment-scoped secrets/vars: pass them with `--secret`/`--var`), and OIDC
+  tokens for `id-token: write`.
+- **Contract checks** decide `if:` conditions only from the workflow's triggers
+  (`github.event_name`, and `github.ref` / `inputs` where the triggers pin
+  them) and, without `--contract-recurse all`, don't look inside _remote_
+  composite actions / reusable workflows.
 
 The exact scope of each is documented in
 [DOCS.md](DOCS.md#contract-limitations-v1-scope).

package/dist/advisories.js

@@ -61,6 +61,17 @@ exports.VULNERABLE_ACTION_RULE = 'secureci/vulnerable-action';
 /** Cached advisories are re-fetched after this long. */
 exports.ADVISORY_TTL_MS = 24 * 60 * 60 * 1000;
 const ADVISORY_TIMEOUT_MS = 15000;
+/** Pages of advisories read per repository (100 each). */
+const MAX_ADVISORY_PAGES = 10;
+/** The `rel="next"` URL of a `Link` header, if any. */
+function nextPageUrl(link) {
+    for (const part of (link ?? '').split(',')) {
+        const match = part.match(/<([^>]+)>\s*;\s*rel="?next"?/);
+        if (match)
+            return match[1];
+    }
+    return undefined;
+}
 const VERSION = /^v?(\d+(?:\.\d+)*)(?:-([0-9A-Za-z.-]+))?(?:\+[0-9A-Za-z.-]+)?$/;
 /** `v1.2.3`, `1.2`, `v4`, `2.0.0-rc.1`; null for anything else. */
 function parseVersion(text) {
@@ -359,7 +370,7 @@ function describeError(error, authenticated) {
  * The advisories naming `owner/repo` in the actions ecosystem, cached per
  * repository for `ttlMs` (default 24h). Offline, the cache is used at any
  * age. If the API fails, a stale cache is used when there is one.
- * Only the first page (100 advisories) is read.
+ * Pages are followed (on the API's own host) up to 1,000 advisories.
  */
 async function fetchRepoAdvisories(owner, repo, options = {}) {
     if (!validName(owner) || !validName(repo))
@@ -378,15 +389,20 @@ async function fetchRepoAdvisories(owner, repo, options = {}) {
         cached = undefined;
     }
     const isStale = cached ? now - cached.fetchedAt >= ttl : false;
-    if (cached && !isStale)
-        return { advisories: cached.advisories };
+    const cachedTruncated = cached?.truncated ? { truncated: true } : {};
+    if (cached && !isStale) {
+        return { advisories: cached.advisories, ...cachedTruncated };
+    }
     if (options.offline) {
         return cached
-            ? { advisories: cached.advisories, stale: true }
+            ? { advisories: cached.advisories, stale: true, ...cachedTruncated }
             : { error: 'offline and not cached' };
     }
     const httpGet = options.httpGet ??
-        ((url, headers) => (0, action_fetcher_1.getText)(url, headers, ADVISORY_TIMEOUT_MS));
+        ((url, headers) => (0, action_fetcher_1.getResponse)(url, headers, ADVISORY_TIMEOUT_MS).then((r) => ({
+            body: r.body,
+            link: [r.headers.link].flat()[0]
+        })));
     const query = new URLSearchParams({
         ecosystem: 'actions',
         affects: `${owner}/${repo}`,
@@ -400,28 +416,58 @@ async function fetchRepoAdvisories(owner, repo, options = {}) {
         ...(token ? { Authorization: `Bearer ${token}` } : {})
     });
     let token = options.token === undefined ? (0, action_fetcher_1.githubToken)() : options.token;
-    let body;
+    const page = async (pageUrl) => {
+        const response = await httpGet(pageUrl, headers(token));
+        return typeof response === 'string' ? { body: response } : response;
+    };
     try {
+        let response;
         try {
-            body = await httpGet(url, headers(token));
+            response = await page(url);
         }
         catch (error) {
             // A rejected token shouldn't block public advisories.
             if (!token || error.status !== 401)
                 throw error;
             token = null;
-            body = await httpGet(url, headers(null));
+            response = await page(url);
+        }
+        const advisories = parseAdvisories(JSON.parse(response.body));
+        // Later pages only from the API's own origin, which the token is for.
+        const origin = new URL(url).origin;
+        const sameOriginNext = () => {
+            const next = nextPageUrl(response.link);
+            return next && new URL(next, url).origin === origin
+                ? new URL(next, url).toString()
+                : undefined;
+        };
+        for (let pages = 1; pages < MAX_ADVISORY_PAGES; pages++) {
+            const next = sameOriginNext();
+            if (!next)
+                break;
+            response = await page(next);
+            advisories.push(...parseAdvisories(JSON.parse(response.body)));
         }
-        const advisories = parseAdvisories(JSON.parse(body));
+        const truncated = sameOriginNext() !== undefined;
         fs.mkdirSync(path.dirname(file), { recursive: true });
-        const entry = { api, fetchedAt: now, advisories };
+        const entry = {
+            api,
+            fetchedAt: now,
+            advisories,
+            ...(truncated ? { truncated } : {})
+        };
         fs.writeFileSync(file, JSON.stringify(entry, null, 2));
-        return { advisories };
+        return { advisories, ...(truncated ? { truncated } : {}) };
     }
     catch (error) {
         const message = describeError(error, !!token);
         return cached
-            ? { advisories: cached.advisories, stale: true, error: message }
+            ? {
+                advisories: cached.advisories,
+                stale: true,
+                error: message,
+                ...cachedTruncated
+            }
             : { error: message };
     }
 }
@@ -480,6 +526,9 @@ class AdvisoryChecker {
                 else if (result.stale) {
                     report.stale.push(repoName);
                 }
+                if (result.truncated) {
+                    (report.truncated ?? (report.truncated = [])).push(repoName);
+                }
             }
             const advisories = relevant(target, result.advisories ?? []);
             if (advisories.length === 0)
@@ -562,6 +611,13 @@ function describeReport(report, failOn) {
             text: `Used cached security advisories older than 24h for ${report.stale.join(', ')} (they could not be refreshed).`
         });
     }
+    if (report.truncated?.length) {
+        lines.push({
+            level: 'warn',
+            kind: 'note',
+            text: `Only the first ${(MAX_ADVISORY_PAGES * 100).toLocaleString('en-US')} security advisories were read for ${report.truncated.join(', ')}; later ones were not checked.`
+        });
+    }
     return lines;
 }
 /**
@@ -597,6 +653,10 @@ function mergeReports(reports) {
             if (!merged.stale.includes(s))
                 merged.stale.push(s);
         }
+        for (const t of r.truncated ?? []) {
+            if (!merged.truncated?.includes(t))
+                (merged.truncated ?? (merged.truncated = [])).push(t);
+        }
     }
     return merged;
 }

package/dist/cli.js

@@ -56,6 +56,11 @@ const env_file_1 = require("./utils/env-file");
 const config_1 = require("./config");
 const scheduler_1 = require("./runner/scheduler");
 const version_1 = require("./version");
+const org_scan_1 = require("./org-scan");
+const org_scan_script_1 = require("./org-scan-script");
+const node_binary_1 = require("./runner/node-binary");
+const child_process_1 = require("child_process");
+const os = __importStar(require("os"));
 const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
 /** Committed at the repo root, like package-lock.json / yarn.lock. */
@@ -118,6 +123,8 @@ program
     .option('--matrix <key:value...>', 'Run only the matrix combinations whose key has this value (as shown in the job name). Repeat for more keys (all must match) or values (any matches)')
     .option('--offline', 'Use only cached remote actions and workflows; never download')
     .option('--no-local-checkout', 'Run the real actions/checkout for this repository instead of using the working copy')
+    .option('--fetch-refs', "Fetch an actions/checkout ref: the local repository doesn't have (e.g. refs/pull/N/merge) from origin into its path: copy. Uses your git credentials, or GITHUB_TOKEN for the server's own host. Off by default: a run doesn't touch the network for checkouts")
+    .option('--registry-login', 'Pull job and service container images that set credentials: with them: a temporary login, removed right after the pull, with the password on stdin and masked in logs. Off by default: credentials: are warned about and your own docker login is used')
     .addOption(new commander_1.Option('--container-runtime <name>', 'Container engine for jobs. "host" runs steps directly on this machine, without a container. Config: container-runtime')
     .choices(['auto', 'docker', 'podman', 'containerd', 'host'])
     .default(defaultContainerRuntime))
@@ -128,7 +135,10 @@ program
     .option('--container-memory <limit>', 'Limit job container memory, e.g. 512m. Config: container-memory', globalConfig['container-memory'])
     .option('--no-network', 'Turn off container network access (on by default)')
     .option('--allow-network', 'Turn on container network access, overriding allow-network: false in the config')
+    .option('--isolate-workspace', "Run each job in its own copy of the working copy, removed when the job ends, so parallel jobs can't overwrite each other's files. Config: isolate-workspace")
+    .option('--no-isolate-workspace', 'Share the working copy between jobs, overriding isolate-workspace: true in the config')
     .option('--parallel <n>', 'Run up to this many jobs (and matrix combinations) at once; 1 runs them one after another. Default: the number of CPUs. Config: parallel', String(defaultParallel))
+    .option('--concurrency <mode>', 'How jobs sharing a concurrency: group run: serialize (one at a time, all of them) or github (also cancel as GitHub does: one pending per group, newer pending replaces older, cancel-in-progress). Default: serialize. Config: concurrency')
     .action(async (file, options) => {
     if (configError) {
         logger_1.logger.error(configError);
@@ -184,6 +194,7 @@ program
             fromEnv: process.env
         });
         const parallel = (0, scheduler_1.parseParallel)(options.parallel);
+        const concurrency = (0, config_1.resolveConcurrency)(options.concurrency, globalConfig);
         const result = await (0, executor_1.executeWorkflow)(file, {
             dryRun: false,
             inputs,
@@ -195,6 +206,8 @@ program
             job: options.job,
             matrix,
             localCheckout: options.localCheckout,
+            fetchRefs: options.fetchRefs === true,
+            registryLogin: options.registryLogin === true,
             offline: options.offline,
             verbose: program.opts().verbose,
             containerRuntime: options.containerRuntime,
@@ -206,7 +219,9 @@ program
                 : undefined,
             containerMemoryLimit: options.containerMemory,
             networkDisabled: (0, config_1.resolveNetworkDisabled)({ network: options.network, allowNetwork: options.allowNetwork }, globalConfig),
-            parallel
+            parallel,
+            concurrency,
+            isolateWorkspace: (0, config_1.resolveIsolateWorkspace)(options.isolateWorkspace, globalConfig)
         });
         if (!result.success) {
             process.exit(1);
@@ -994,6 +1009,43 @@ configCmd
     (0, config_1.saveConfig)(config);
     logger_1.logger.success(`Unset ${key} in ${(0, config_1.getConfigFilePath)()}`);
 });
+const orgCmd = program
+    .command('org')
+    .description('Organisation-wide commands (for a SecureCI supply-chain assessment)');
+orgCmd
+    .command('scan')
+    .description('Scan the GitHub Actions workflows of every repository in an organisation and pack the JSON results for a SecureCI supply-chain assessment (runs org-scan.sh; source code is never downloaded)')
+    .argument('[org]', 'GitHub organisation (or user) to scan')
+    .option('--repos <file>', 'Scan only the repositories in this file (one "name" or "owner/name" per line)')
+    .option('--out <dir>', 'Output directory (default: ./secureci-org-scan-<org>)')
+    .option('-c, --contract <file>', 'Also check workflows against this pipeline contract (local file or owner/repo/path@ref)')
+    .option('--include-forks', 'Also scan forked repositories')
+    .option('--print-script', 'Print the script this command runs, to review it, and exit')
+    .action(async (org, options) => {
+    if (options.printScript) {
+        process.stdout.write(org_scan_script_1.ORG_SCAN_SCRIPT);
+        return;
+    }
+    if (!org) {
+        logger_1.logger.error('Missing <org>: secureci org scan <org>');
+        process.exit(2);
+    }
+    try {
+        const code = await (0, org_scan_1.runOrgScan)(org, options, {
+            spawn: (command, args, spawnOptions) => (0, child_process_1.spawn)(command, args, spawnOptions),
+            tmpdir: os.tmpdir,
+            sea: (0, node_binary_1.isSea)(),
+            execPath: process.execPath,
+            entry: process.argv[1],
+            env: process.env
+        });
+        process.exit(code);
+    }
+    catch (error) {
+        logger_1.logger.error(error instanceof Error ? error.message : String(error));
+        process.exit(1);
+    }
+});
 const cacheCmd = program
     .command('cache')
     .description('Manage the cache of downloaded remote actions');

package/dist/config.js

@@ -44,6 +44,8 @@ exports.getConfigValue = getConfigValue;
 exports.setConfigValue = setConfigValue;
 exports.unsetConfigValue = unsetConfigValue;
 exports.parseConfigValue = parseConfigValue;
+exports.resolveIsolateWorkspace = resolveIsolateWorkspace;
+exports.resolveConcurrency = resolveConcurrency;
 exports.resolveNetworkDisabled = resolveNetworkDisabled;
 const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
@@ -114,6 +116,8 @@ exports.CONFIG_KEYS = [
     'container-memory',
     'allow-network',
     'parallel',
+    'isolate-workspace',
+    'concurrency',
     'env-file',
     'secret-file',
     'input-file',
@@ -177,12 +181,15 @@ function parseConfigValue(key, rawValue) {
             return num;
         }
         case 'allow-network':
+        case 'isolate-workspace':
             if (rawValue !== 'true' && rawValue !== 'false') {
-                throw new Error(`Invalid value "${rawValue}" for allow-network. Must be "true" or "false".`);
+                throw new Error(`Invalid value "${rawValue}" for ${key}. Must be "true" or "false".`);
             }
             return rawValue === 'true';
         case 'parallel':
             return (0, scheduler_1.parseParallel)(rawValue);
+        case 'concurrency':
+            return (0, scheduler_1.parseConcurrencyMode)(rawValue);
         case 'container-image':
         case 'container-memory':
             return rawValue;
@@ -196,6 +203,22 @@ function parseConfigValue(key, rawValue) {
             return rawValue;
     }
 }
+/**
+ * Whether each job runs in its own copy of the working copy:
+ * `--isolate-workspace` / `--no-isolate-workspace`, else
+ * `isolate-workspace` in the config file, else no.
+ */
+function resolveIsolateWorkspace(flag, config = loadConfig()) {
+    return flag ?? config['isolate-workspace'] === true;
+}
+/**
+ * How job `concurrency:` groups apply: `--concurrency`, else
+ * `concurrency` in the config file, else serialize.
+ */
+function resolveConcurrency(flag, config = loadConfig()) {
+    const value = flag ?? config.concurrency;
+    return value === undefined ? 'serialize' : (0, scheduler_1.parseConcurrencyMode)(value);
+}
 /**
  * Whether container networking should be disabled. Networking is on by
  * default (matching GitHub-hosted runners); `--no-network` turns it off and

package/dist/org-scan-script.js

@@ -0,0 +1,6 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ORG_SCAN_SCRIPT = void 0;
+// Generated from org-scan.sh by scripts/gen-org-scan-script.mjs; don't edit.
+exports.ORG_SCAN_SCRIPT = "#!/usr/bin/env bash\n# Scan every GitHub Actions workflow in an organisation with the SecureCI CLI,\n# for a SecureCI supply-chain assessment.\n#\n#   bash org-scan.sh <org>\n#\n# Read it before you run it (it's short, on purpose):\n#\n#   curl -fsSL https://secure-ci.dev/org-scan.sh -o org-scan.sh\n#   less org-scan.sh\n#   GITHUB_TOKEN=... bash org-scan.sh my-org\n#\n# or, with the CLI installed: `secureci org scan my-org` runs this same script\n# (`secureci org scan --print-script` prints it).\n#\n# What it does, for each repository in the organisation (or in --repos):\n#\n#   1. Clones only the .github/ directory (a shallow, sparse clone: your\n#      application code is never downloaded) into a temporary directory.\n#   2. Runs `secureci validate --format json` on its workflows, and\n#      `secureci inventory --dry-run` on each workflow.\n#   3. Saves that JSON under the output directory and deletes the clone.\n#\n# Then it writes manifest.json (what was scanned, when, with which versions)\n# and packs everything into <output>.tar.gz. That archive is what you email to\n# hello@secure-ci.dev (if your policy doesn't allow email, tell us and we'll\n# agree another way).\n# It holds only the JSON results (repository and workflow names, the actions\n# they use, and the findings), never your source code. Look inside before you\n# send it: `tar -tzf <output>.tar.gz`.\n#\n# Archived repositories are skipped, and so are forks unless --include-forks.\n#\n# Your token stays on this machine: it is passed to curl on stdin and to git\n# through environment variables, never on a command line, and it is not\n# written to any output file.\n#\n# Requirements: bash, git 2.31+, curl, base64, tar, and the SecureCI CLI\n# (https://secure-ci.dev/install.sh or `npm install -g @secureci/cli`).\n#\n# Environment variables:\n#   GITHUB_TOKEN or GH_TOKEN  token that can read the organisation's\n#                             repositories (contents: read, metadata: read).\n#                             Needed for private repositories, and it raises\n#                             API rate limits. The CLI also uses it to resolve\n#                             action tags and look up security advisories.\n#   GITHUB_SERVER_URL         default https://github.com; set it for GitHub\n#                             Enterprise Server, e.g. https://github.example.com\n#   GITHUB_API_URL            default https://api.github.com, or\n#                             $GITHUB_SERVER_URL/api/v3 for Enterprise Server\n#   SECURECI                  the secureci executable (default: secureci on PATH)\n#\n# Exit status: 0 when the scan finished (some repositories may have failed:\n# see the summary and errors.log), 1 on an error, 2 on a usage error.\n\nset -euo pipefail\n\nSCAN_SCRIPT_VERSION=1\nINSTALL_URL=\"https://secure-ci.dev/install.sh\"\nNAME_RE='^[A-Za-z0-9._-]+/[A-Za-z0-9._-]+$'\n\nusage() {\n  cat <<'EOF'\nUsage: org-scan.sh [options] <org>\n\nScan every GitHub Actions workflow in <org> with the SecureCI CLI and pack the\nJSON results into <output>.tar.gz for a SecureCI supply-chain assessment.\n\nOptions:\n  --repos <file>     scan only these repositories: one per line, \"name\" or\n                     \"owner/name\"; blank lines and # comments are ignored\n  --out <dir>        output directory (default: ./secureci-org-scan-<org>)\n  --contract <file>  also check workflows against this pipeline contract\n                     (a local file, or owner/repo/path@ref)\n  --include-forks    also scan forked repositories\n  -h, --help         show this help\n\nEnvironment: GITHUB_TOKEN (or GH_TOKEN), GITHUB_SERVER_URL, GITHUB_API_URL,\nSECURECI. See the comments at the top of this script.\nEOF\n}\n\nsay() {\n  printf 'secureci-org-scan: %s\\n' \"$*\" >&2\n}\n\ndie() {\n  say \"error: $*\"\n  exit 1\n}\n\nusage_error() {\n  say \"$*\"\n  usage >&2\n  exit 2\n}\n\nhas() {\n  command -v \"$1\" >/dev/null 2>&1\n}\n\n# JSON string literal for $1.\njson_str() {\n  local s=$1\n  s=${s//\\\\/\\\\\\\\}\n  s=${s//\\\"/\\\\\\\"}\n  s=${s//$'\\t'/\\\\t}\n  s=${s//$'\\n'/\\\\n}\n  printf '\"%s\"' \"$s\"\n}\n\n# Run the secureci CLI (SECURECI_ENTRY is set when SECURECI is node itself).\nsecureci() {\n  if [ -n \"${SECURECI_ENTRY:-}\" ]; then\n    \"$SECURECI\" \"$SECURECI_ENTRY\" \"$@\"\n  else\n    \"$SECURECI\" \"$@\"\n  fi\n}\n\n# GET an API URL into a file; prints the HTTP status. The token goes to curl\n# on stdin (--config -), so it never shows up in the process list.\napi_get() {\n  local url=$1 out=$2\n  {\n    printf 'url = \"%s\"\\n' \"$url\"\n    printf 'header = \"Accept: application/vnd.github+json\"\\n'\n    printf 'header = \"X-GitHub-Api-Version: 2022-11-28\"\\n'\n    if [ -n \"$TOKEN\" ]; then\n      printf 'header = \"Authorization: Bearer %s\"\\n' \"$TOKEN\"\n    fi\n  } | curl --silent --show-error --location --config - \\\n    --output \"$out\" --write-out '%{http_code}' || echo 000\n}\n\n# Print owner/name for each repository in a page of the repos API, skipping\n# archived repositories and (unless --include-forks) forks. Splitting on\n# commas puts each top-level key on its own line; keys inside strings are\n# escaped (\\\"full_name\\\") and can't match the anchored patterns.\nparse_repos() {\n  tr ',' '\\n' <\"$1\" | awk -v forks=\"$INCLUDE_FORKS\" '\n    function flush() {\n      if (name != \"\" && archived != \"true\" && (forks == \"1\" || fork != \"true\"))\n        print name\n      name = \"\"; fork = \"\"; archived = \"\"\n    }\n    /^[[:space:]{[]*\"full_name\"[[:space:]]*:/ {\n      flush()\n      line = $0\n      sub(/^[^:]*:[[:space:]]*\"/, \"\", line)\n      sub(/\".*$/, \"\", line)\n      name = line\n      next\n    }\n    /^[[:space:]]*\"fork\"[[:space:]]*:/ {\n      fork = ($0 ~ /true/) ? \"true\" : \"false\"; next\n    }\n    /^[[:space:]]*\"archived\"[[:space:]]*:/ {\n      archived = ($0 ~ /true/) ? \"true\" : \"false\"; next\n    }\n    END { flush() }\n  '\n}\n\n# List the organisation's repositories over the API (or the user's, when\n# <org> is a user account), one owner/name per line.\nlist_repos() {\n  local base=\"$API_URL/orgs/$ORG/repos?per_page=100\" page=1 status\n  local body=\"$WORK/page.json\"\n  while :; do\n    status=$(api_get \"$base&page=$page\" \"$body\")\n    if [ \"$status\" = 404 ] && [ \"$page\" = 1 ] && [ \"${base#*/users/}\" = \"$base\" ]; then\n      base=\"$API_URL/users/$ORG/repos?per_page=100&type=owner\"\n      continue\n    fi\n    [ \"$status\" = 200 ] || die \"listing repositories for $ORG failed: HTTP $status from ${base%%\\?*} (check GITHUB_TOKEN and GITHUB_API_URL)\"\n    # An empty page ends the listing.\n    if ! grep -q '\"full_name\"' \"$body\"; then\n      break\n    fi\n    parse_repos \"$body\"\n    page=$((page + 1))\n  done\n}\n\n# Repositories from a --repos file, one owner/name per line.\nread_repo_file() {\n  local line\n  while IFS= read -r line || [ -n \"$line\" ]; do\n    line=${line%%#*}\n    line=$(printf '%s' \"$line\" | tr -d '[:space:]')\n    [ -n \"$line\" ] || continue\n    case \"$line\" in\n      */*) printf '%s\\n' \"$line\" ;;\n      *) printf '%s/%s\\n' \"$ORG\" \"$line\" ;;\n    esac\n  done <\"$1\"\n}\n\n# git with the token as an HTTP header scoped to the server, passed through\n# GIT_CONFIG_* environment variables rather than arguments or a URL.\ngit_auth() {\n  if [ -n \"$TOKEN\" ]; then\n    local basic\n    basic=$(printf 'x-access-token:%s' \"$TOKEN\" | base64 | tr -d '\\n')\n    GIT_CONFIG_COUNT=1 \\\n      GIT_CONFIG_KEY_0=\"http.$SERVER_URL/.extraheader\" \\\n      GIT_CONFIG_VALUE_0=\"AUTHORIZATION: basic $basic\" \\\n      GIT_TERMINAL_PROMPT=0 git \"$@\"\n  else\n    GIT_TERMINAL_PROMPT=0 git \"$@\"\n  fi\n}\n\n# Clone .github/ of one repository and scan it. Sets STATUS and WORKFLOWS.\nscan_repo() {\n  local full=$1 dir=\"$WORK/clone\" dest wf files=()\n  STATUS=clone-failed\n  WORKFLOWS=0\n  rm -rf \"$dir\"\n  if ! git_auth clone --quiet --depth 1 --filter=blob:none --sparse --no-tags \\\n    \"$SERVER_URL/$full.git\" \"$dir\" 2>>\"$OUT/errors.log\" ||\n    ! git -C \"$dir\" sparse-checkout set .github 2>>\"$OUT/errors.log\"; then\n    echo \"[$full] clone failed\" >>\"$OUT/errors.log\"\n    return\n  fi\n\n  for wf in \"$dir\"/.github/workflows/*.yml \"$dir\"/.github/workflows/*.yaml; do\n    [ -f \"$wf\" ] && files+=(\".github/workflows/${wf##*/}\")\n  done\n  WORKFLOWS=${#files[@]}\n  if [ \"$WORKFLOWS\" = 0 ]; then\n    STATUS=no-workflows\n    rm -rf \"$dir\"\n    return\n  fi\n\n  dest=\"$OUT/repos/${full%%/*}__${full#*/}\"\n  mkdir -p \"$dest/inventory\"\n  echo \"[$full] secureci output:\" >>\"$OUT/errors.log\"\n  # validate exits 1 when it finds errors; the JSON is still the result.\n  (cd \"$dir\" && secureci validate --format json ${CONTRACT_ARG:+--contract \"$CONTRACT_ARG\"} \"${files[@]}\") \\\n    >\"$dest/validate.json\" 2>>\"$OUT/errors.log\" || true\n  for wf in \"${files[@]}\"; do\n    (cd \"$dir\" && secureci inventory --dry-run \"$wf\") \\\n      >\"$dest/inventory/${wf##*/}.json\" 2>>\"$OUT/errors.log\" || true\n  done\n  STATUS=scanned\n  rm -rf \"$dir\"\n}\n\nmain() {\n  ORG=\"\"\n  OUT=\"\"\n  REPO_FILE=\"\"\n  CONTRACT=\"\"\n  INCLUDE_FORKS=0\n  while [ $# -gt 0 ]; do\n    case \"$1\" in\n      -h | --help) usage; exit 0 ;;\n      --repos) [ $# -ge 2 ] || usage_error \"--repos needs a file\"; REPO_FILE=$2; shift 2 ;;\n      --out) [ $# -ge 2 ] || usage_error \"--out needs a directory\"; OUT=$2; shift 2 ;;\n      --contract) [ $# -ge 2 ] || usage_error \"--contract needs a file\"; CONTRACT=$2; shift 2 ;;\n      --include-forks) INCLUDE_FORKS=1; shift ;;\n      -*) usage_error \"unknown option: $1\" ;;\n      *)\n        [ -z \"$ORG\" ] || usage_error \"unexpected argument: $1\"\n        ORG=$1; shift ;;\n    esac\n  done\n  [ -n \"$ORG\" ] || usage_error \"missing <org>\"\n  [[ $ORG =~ ^[A-Za-z0-9._-]+$ ]] || usage_error \"not an organisation name: $ORG\"\n\n  SECURECI=${SECURECI:-secureci}\n  for tool in git curl base64 tar; do\n    has \"$tool\" || die \"$tool is required\"\n  done\n  has \"$SECURECI\" || die \"the SecureCI CLI ($SECURECI) was not found. Install it: curl -fsSL $INSTALL_URL | sh (or npm install -g @secureci/cli)\"\n  SECURECI_VERSION=$(secureci --version 2>/dev/null) || die \"could not run $SECURECI --version\"\n\n  TOKEN=${GITHUB_TOKEN:-${GH_TOKEN:-}}\n  SERVER_URL=${GITHUB_SERVER_URL:-https://github.com}\n  SERVER_URL=${SERVER_URL%/}\n  if [ -z \"${GITHUB_API_URL:-}\" ]; then\n    if [ \"$SERVER_URL\" = https://github.com ]; then\n      API_URL=https://api.github.com\n    else\n      API_URL=\"$SERVER_URL/api/v3\"\n    fi\n  else\n    API_URL=${GITHUB_API_URL%/}\n  fi\n\n  # A local contract is resolved now, because secureci runs inside each clone.\n  CONTRACT_ARG=$CONTRACT\n  if [ -n \"$CONTRACT\" ] && [ -f \"$CONTRACT\" ]; then\n    CONTRACT_ARG=\"$(cd \"$(dirname \"$CONTRACT\")\" && pwd -P)/$(basename \"$CONTRACT\")\"\n  fi\n  if [ -n \"$REPO_FILE\" ] && [ ! -f \"$REPO_FILE\" ]; then\n    die \"--repos file not found: $REPO_FILE\"\n  fi\n\n  OUT=${OUT:-secureci-org-scan-$ORG}\n  OUT=${OUT%/}\n  [ ! -e \"$OUT\" ] || die \"$OUT already exists; remove it or pass --out <dir>\"\n  [ ! -e \"$OUT.tar.gz\" ] || die \"$OUT.tar.gz already exists; remove it or pass --out <dir>\"\n  WORK=$(mktemp -d \"${TMPDIR:-/tmp}/secureci-org-scan.XXXXXX\")\n  trap 'rm -rf \"$WORK\"' EXIT\n\n  local repos=() full\n  if [ -n \"$REPO_FILE\" ]; then\n    while IFS= read -r full; do repos+=(\"$full\"); done < <(read_repo_file \"$REPO_FILE\")\n  else\n    say \"listing repositories in $ORG ($API_URL)\"\n    list_repos >\"$WORK/repos.txt\"\n    while IFS= read -r full; do repos+=(\"$full\"); done <\"$WORK/repos.txt\"\n  fi\n\n  local valid=()\n  for full in ${repos[@]+\"${repos[@]}\"}; do\n    if [[ $full =~ $NAME_RE ]] && [[ $full != *..* ]]; then\n      valid+=(\"$full\")\n    else\n      say \"skipping unexpected repository name: $full\"\n    fi\n  done\n  [ ${#valid[@]} -gt 0 ] || die \"no repositories to scan\"\n\n  mkdir -p \"$OUT/repos\"\n  : >\"$OUT/errors.log\"\n  OUT=$(cd \"$OUT\" && pwd -P)\n\n  local total=${#valid[@]} i=0 scanned=0 empty=0 failed=0 entries=\"\"\n  for full in \"${valid[@]}\"; do\n    i=$((i + 1))\n    scan_repo \"$full\"\n    case \"$STATUS\" in\n      scanned) scanned=$((scanned + 1)) ;;\n      no-workflows) empty=$((empty + 1)) ;;\n      *) failed=$((failed + 1)) ;;\n    esac\n    say \"[$i/$total] $full: $STATUS ($WORKFLOWS workflows)\"\n    entries+=\"${entries:+,}\n    {\\\"name\\\": $(json_str \"$full\"), \\\"status\\\": \\\"$STATUS\\\", \\\"workflows\\\": $WORKFLOWS}\"\n  done\n\n  local contract_json=null\n  [ -z \"$CONTRACT\" ] || contract_json=$(json_str \"$CONTRACT\")\n  cat >\"$OUT/manifest.json\" <<EOF\n{\n  \"tool\": \"secureci-org-scan\",\n  \"scriptVersion\": $SCAN_SCRIPT_VERSION,\n  \"secureciVersion\": $(json_str \"$SECURECI_VERSION\"),\n  \"org\": $(json_str \"$ORG\"),\n  \"server\": $(json_str \"$SERVER_URL\"),\n  \"scannedAt\": \"$(date -u +%Y-%m-%dT%H:%M:%SZ)\",\n  \"contract\": $contract_json,\n  \"repos\": [$entries\n  ]\n}\nEOF\n\n  tar -czf \"$OUT.tar.gz\" -C \"$(dirname \"$OUT\")\" \"$(basename \"$OUT\")\"\n\n  cat <<EOF\n\nScanned $total repositories in $ORG: $scanned scanned, $empty without workflows, $failed failed.\n\nResults: $OUT/\nArchive: $OUT.tar.gz\n\nThe archive holds only JSON results (repository and workflow names, the\nactions they use and the findings) plus errors.log, never source code.\nCheck it before you send it:  tar -tzf $OUT.tar.gz\n\nEmail it to hello@secure-ci.dev. If your policy doesn't allow sending it by\nemail, write to us there and we'll agree another way.\nEOF\n}\n\nmain \"$@\"\n";
+//# sourceMappingURL=org-scan-script.js.map

package/dist/org-scan.js

@@ -0,0 +1,88 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.orgScanArgs = orgScanArgs;
+exports.orgScanEnv = orgScanEnv;
+exports.runOrgScan = runOrgScan;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const org_scan_script_1 = require("./org-scan-script");
+/** The script's arguments for `org` and the command's options. */
+function orgScanArgs(org, options) {
+    const args = [];
+    if (options.repos)
+        args.push('--repos', options.repos);
+    if (options.out)
+        args.push('--out', options.out);
+    if (options.contract)
+        args.push('--contract', options.contract);
+    if (options.includeForks)
+        args.push('--include-forks');
+    return [...args, org];
+}
+/**
+ * How the script should run this same CLI: the standalone binary directly,
+ * or node with the CLI's entry file when installed with npm.
+ */
+function orgScanEnv(self) {
+    if (self.sea || !self.entry)
+        return { SECURECI: self.execPath };
+    return { SECURECI: self.execPath, SECURECI_ENTRY: self.entry };
+}
+/** Run the scan; resolves with the script's exit status. */
+async function runOrgScan(org, options, deps) {
+    const dir = fs.mkdtempSync(path.join(deps.tmpdir(), 'secureci-org-scan-'));
+    const script = path.join(dir, 'org-scan.sh');
+    try {
+        fs.writeFileSync(script, org_scan_script_1.ORG_SCAN_SCRIPT, { mode: 0o700 });
+        const env = { ...deps.env, ...orgScanEnv(deps) };
+        return await new Promise((resolve, reject) => {
+            const child = deps.spawn('bash', [script, ...orgScanArgs(org, options)], {
+                stdio: 'inherit',
+                env
+            });
+            child.on('error', (error) => {
+                reject(error.code === 'ENOENT'
+                    ? new Error('`secureci org scan` needs bash. On Windows, run it from Git Bash or WSL.')
+                    : error);
+            });
+            child.on('close', (code) => resolve(code ?? 1));
+        });
+    }
+    finally {
+        fs.rmSync(dir, { recursive: true, force: true });
+    }
+}
+//# sourceMappingURL=org-scan.js.map