@secureci/cli 1.1.0 → 1.2.0

package/README.md

@@ -73,10 +73,10 @@ less install.sh
 sh install.sh
 ```
 
-Set `SECURECI_VERSION=1.1.0` to install a specific release,
+Set `SECURECI_VERSION=1.2.0` to install a specific release,
 `SECURECI_INSTALL_DIR` to install somewhere else, and
 `SECURECI_REQUIRE_ATTESTATION=1` to fail unless `gh` verifies build provenance
-(e.g. `curl -fsSL https://secure-ci.dev/install.sh | SECURECI_VERSION=1.1.0 sh`).
+(e.g. `curl -fsSL https://secure-ci.dev/install.sh | SECURECI_VERSION=1.2.0 sh`).
 If the release's download link fails (GitHub has returned `504` for one while
 its API still served the files), the script fetches the same files through the
 GitHub API instead; the `SHA256SUMS` and provenance checks are unchanged.
@@ -263,18 +263,24 @@ things to know:
   `--isolate-workspace` to give each job its own copy, or `--parallel 1` to run
   jobs one after another.
 - **`actions/checkout` of the current repo doesn't clone** — it uses your working
-  copy as-is (so uncommitted changes are visible). A `ref:` your local
-  repository has is checked out only into a `path:`; other refs and
-  `fetch-depth:` don't change what you get. Other repositories check out for
-  real and need a token.
+  copy as-is (so uncommitted changes are visible). A `ref:` is checked out only
+  into a `path:`, from your local repository, or fetched from `origin` with
+  `--fetch-refs` (opt-in); `fetch-depth:` applies to that clone. Other
+  repositories check out for real and need a token.
 - **Artifacts and cache are local stand-ins**, stored under `~/.secureci/`;
   nothing is uploaded to or downloaded from GitHub.
-- **Not emulated:** `concurrency:` (noted at run start), deployment
-  `environment:` (protection rules and environment-scoped secrets/vars: pass
-  them with `--secret`/`--var`), and OIDC tokens for `id-token: write`.
+- **`concurrency:`** groups of jobs run one at a time within a run;
+  `--concurrency github` also cancels as GitHub does. Workflow-level
+  `concurrency:` has no other runs to apply to.
+- **Container `credentials:`** are used only with `--registry-login`, through a
+  temporary login removed right after the pull; otherwise use `docker login`.
+- **Not emulated:** deployment `environment:` (protection rules and
+  environment-scoped secrets/vars: pass them with `--secret`/`--var`), and OIDC
+  tokens for `id-token: write`.
 - **Contract checks** decide `if:` conditions only from the workflow's triggers
-  (`github.event_name`) and, without `--contract-recurse all`, don't look inside
-  _remote_ composite actions / reusable workflows.
+  (`github.event_name`, and `github.ref` / `inputs` where the triggers pin
+  them) and, without `--contract-recurse all`, don't look inside _remote_
+  composite actions / reusable workflows.
 
 The exact scope of each is documented in
 [DOCS.md](DOCS.md#contract-limitations-v1-scope).

package/dist/advisories.js

@@ -389,11 +389,13 @@ async function fetchRepoAdvisories(owner, repo, options = {}) {
         cached = undefined;
     }
     const isStale = cached ? now - cached.fetchedAt >= ttl : false;
-    if (cached && !isStale)
-        return { advisories: cached.advisories };
+    const cachedTruncated = cached?.truncated ? { truncated: true } : {};
+    if (cached && !isStale) {
+        return { advisories: cached.advisories, ...cachedTruncated };
+    }
     if (options.offline) {
         return cached
-            ? { advisories: cached.advisories, stale: true }
+            ? { advisories: cached.advisories, stale: true, ...cachedTruncated }
             : { error: 'offline and not cached' };
     }
     const httpGet = options.httpGet ??
@@ -433,22 +435,39 @@ async function fetchRepoAdvisories(owner, repo, options = {}) {
         const advisories = parseAdvisories(JSON.parse(response.body));
         // Later pages only from the API's own origin, which the token is for.
         const origin = new URL(url).origin;
-        for (let pages = 1; pages < MAX_ADVISORY_PAGES; pages++) {
+        const sameOriginNext = () => {
             const next = nextPageUrl(response.link);
-            if (!next || new URL(next, url).origin !== origin)
+            return next && new URL(next, url).origin === origin
+                ? new URL(next, url).toString()
+                : undefined;
+        };
+        for (let pages = 1; pages < MAX_ADVISORY_PAGES; pages++) {
+            const next = sameOriginNext();
+            if (!next)
                 break;
-            response = await page(new URL(next, url).toString());
+            response = await page(next);
             advisories.push(...parseAdvisories(JSON.parse(response.body)));
         }
+        const truncated = sameOriginNext() !== undefined;
         fs.mkdirSync(path.dirname(file), { recursive: true });
-        const entry = { api, fetchedAt: now, advisories };
+        const entry = {
+            api,
+            fetchedAt: now,
+            advisories,
+            ...(truncated ? { truncated } : {})
+        };
         fs.writeFileSync(file, JSON.stringify(entry, null, 2));
-        return { advisories };
+        return { advisories, ...(truncated ? { truncated } : {}) };
     }
     catch (error) {
         const message = describeError(error, !!token);
         return cached
-            ? { advisories: cached.advisories, stale: true, error: message }
+            ? {
+                advisories: cached.advisories,
+                stale: true,
+                error: message,
+                ...cachedTruncated
+            }
             : { error: message };
     }
 }
@@ -507,6 +526,9 @@ class AdvisoryChecker {
                 else if (result.stale) {
                     report.stale.push(repoName);
                 }
+                if (result.truncated) {
+                    (report.truncated ?? (report.truncated = [])).push(repoName);
+                }
             }
             const advisories = relevant(target, result.advisories ?? []);
             if (advisories.length === 0)
@@ -589,6 +611,13 @@ function describeReport(report, failOn) {
             text: `Used cached security advisories older than 24h for ${report.stale.join(', ')} (they could not be refreshed).`
         });
     }
+    if (report.truncated?.length) {
+        lines.push({
+            level: 'warn',
+            kind: 'note',
+            text: `Only the first ${(MAX_ADVISORY_PAGES * 100).toLocaleString('en-US')} security advisories were read for ${report.truncated.join(', ')}; later ones were not checked.`
+        });
+    }
     return lines;
 }
 /**
@@ -624,6 +653,10 @@ function mergeReports(reports) {
             if (!merged.stale.includes(s))
                 merged.stale.push(s);
         }
+        for (const t of r.truncated ?? []) {
+            if (!merged.truncated?.includes(t))
+                (merged.truncated ?? (merged.truncated = [])).push(t);
+        }
     }
     return merged;
 }

package/dist/cli.js

@@ -123,6 +123,8 @@ program
     .option('--matrix <key:value...>', 'Run only the matrix combinations whose key has this value (as shown in the job name). Repeat for more keys (all must match) or values (any matches)')
     .option('--offline', 'Use only cached remote actions and workflows; never download')
     .option('--no-local-checkout', 'Run the real actions/checkout for this repository instead of using the working copy')
+    .option('--fetch-refs', "Fetch an actions/checkout ref: the local repository doesn't have (e.g. refs/pull/N/merge) from origin into its path: copy. Uses your git credentials, or GITHUB_TOKEN for the server's own host. Off by default: a run doesn't touch the network for checkouts")
+    .option('--registry-login', 'Pull job and service container images that set credentials: with them: a temporary login, removed right after the pull, with the password on stdin and masked in logs. Off by default: credentials: are warned about and your own docker login is used')
     .addOption(new commander_1.Option('--container-runtime <name>', 'Container engine for jobs. "host" runs steps directly on this machine, without a container. Config: container-runtime')
     .choices(['auto', 'docker', 'podman', 'containerd', 'host'])
     .default(defaultContainerRuntime))
@@ -136,6 +138,7 @@ program
     .option('--isolate-workspace', "Run each job in its own copy of the working copy, removed when the job ends, so parallel jobs can't overwrite each other's files. Config: isolate-workspace")
     .option('--no-isolate-workspace', 'Share the working copy between jobs, overriding isolate-workspace: true in the config')
     .option('--parallel <n>', 'Run up to this many jobs (and matrix combinations) at once; 1 runs them one after another. Default: the number of CPUs. Config: parallel', String(defaultParallel))
+    .option('--concurrency <mode>', 'How jobs sharing a concurrency: group run: serialize (one at a time, all of them) or github (also cancel as GitHub does: one pending per group, newer pending replaces older, cancel-in-progress). Default: serialize. Config: concurrency')
     .action(async (file, options) => {
     if (configError) {
         logger_1.logger.error(configError);
@@ -191,6 +194,7 @@ program
             fromEnv: process.env
         });
         const parallel = (0, scheduler_1.parseParallel)(options.parallel);
+        const concurrency = (0, config_1.resolveConcurrency)(options.concurrency, globalConfig);
         const result = await (0, executor_1.executeWorkflow)(file, {
             dryRun: false,
             inputs,
@@ -202,6 +206,8 @@ program
             job: options.job,
             matrix,
             localCheckout: options.localCheckout,
+            fetchRefs: options.fetchRefs === true,
+            registryLogin: options.registryLogin === true,
             offline: options.offline,
             verbose: program.opts().verbose,
             containerRuntime: options.containerRuntime,
@@ -214,6 +220,7 @@ program
             containerMemoryLimit: options.containerMemory,
             networkDisabled: (0, config_1.resolveNetworkDisabled)({ network: options.network, allowNetwork: options.allowNetwork }, globalConfig),
             parallel,
+            concurrency,
             isolateWorkspace: (0, config_1.resolveIsolateWorkspace)(options.isolateWorkspace, globalConfig)
         });
         if (!result.success) {

package/dist/config.js

@@ -45,6 +45,7 @@ exports.setConfigValue = setConfigValue;
 exports.unsetConfigValue = unsetConfigValue;
 exports.parseConfigValue = parseConfigValue;
 exports.resolveIsolateWorkspace = resolveIsolateWorkspace;
+exports.resolveConcurrency = resolveConcurrency;
 exports.resolveNetworkDisabled = resolveNetworkDisabled;
 const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
@@ -116,6 +117,7 @@ exports.CONFIG_KEYS = [
     'allow-network',
     'parallel',
     'isolate-workspace',
+    'concurrency',
     'env-file',
     'secret-file',
     'input-file',
@@ -186,6 +188,8 @@ function parseConfigValue(key, rawValue) {
             return rawValue === 'true';
         case 'parallel':
             return (0, scheduler_1.parseParallel)(rawValue);
+        case 'concurrency':
+            return (0, scheduler_1.parseConcurrencyMode)(rawValue);
         case 'container-image':
         case 'container-memory':
             return rawValue;
@@ -207,6 +211,14 @@ function parseConfigValue(key, rawValue) {
 function resolveIsolateWorkspace(flag, config = loadConfig()) {
     return flag ?? config['isolate-workspace'] === true;
 }
+/**
+ * How job `concurrency:` groups apply: `--concurrency`, else
+ * `concurrency` in the config file, else serialize.
+ */
+function resolveConcurrency(flag, config = loadConfig()) {
+    const value = flag ?? config.concurrency;
+    return value === undefined ? 'serialize' : (0, scheduler_1.parseConcurrencyMode)(value);
+}
 /**
  * Whether container networking should be disabled. Networking is on by
  * default (matching GitHub-hosted runners); `--no-network` turns it off and

package/dist/parser/pipeline-contract-validator.js

@@ -290,7 +290,7 @@ async function buildGraph(parsed, recurse, offline) {
     // workflow_call, the event is the caller's, so it isn't known.
     graph.events = triggerEvents(parsed.file.on);
     const known = graph.events
-        ? graph.events.map((event) => ({ github: { event_name: event } }))
+        ? graph.events.map((event) => triggerFacts(parsed.file.on, event))
         : [{}];
     /** `runs`, narrowed by a job or step's own `if:`. */
     const within = (runs, condition) => runs.map((outer, i) => {
@@ -480,6 +480,103 @@ function triggerEvents(on) {
         ? undefined
         : events;
 }
+/** Characters that make a branch/tag filter pattern a glob. */
+const GLOB_CHARS = /[*?+[\]]/;
+/** The literal text a filter pattern starts with (before any glob). */
+function literalStart(pattern) {
+    const at = pattern.search(GLOB_CHARS);
+    return at === -1 ? pattern : pattern.slice(0, at);
+}
+/** Longest common prefix of `values` ('' for none). */
+function commonPrefix(values) {
+    if (values.length === 0)
+        return '';
+    let prefix = values[0];
+    for (const value of values.slice(1)) {
+        while (!value.startsWith(prefix))
+            prefix = prefix.slice(0, -1);
+    }
+    return prefix;
+}
+/**
+ * `github.ref` / `github.ref_name` for a ref under `kind` (`refs/heads/`
+ * or `refs/tags/`) matching the positive `patterns`: exact for a single
+ * literal pattern, else known by prefix. `!negations` only narrow further.
+ */
+function refFromPatterns(kind, patterns) {
+    const positive = (Array.isArray(patterns) ? patterns : [])
+        .map(String)
+        .filter((p) => !p.startsWith('!'));
+    if (positive.length === 1 && !GLOB_CHARS.test(positive[0])) {
+        return { ref: kind + positive[0], ref_name: positive[0] };
+    }
+    const start = commonPrefix(positive.map(literalStart));
+    return { ref: (0, expression_1.knownPrefix)(kind + start), ref_name: (0, expression_1.knownPrefix)(start) };
+}
+/**
+ * What a workflow's `on.<event>` filters tell about `github.ref`: a push
+ * filtered only by branches (or only by tags) runs only for those refs;
+ * pull_request runs on `refs/pull/<n>/merge`; pull_request_target on the
+ * base branch, which its `branches:` filter matches. Unfiltered pushes and
+ * other events leave the ref unknown.
+ */
+function refFacts(event, config) {
+    const filters = config && typeof config === 'object' && !Array.isArray(config)
+        ? config
+        : {};
+    const has = (key) => key in filters;
+    const branchFilter = has('branches') || has('branches-ignore');
+    const tagFilter = has('tags') || has('tags-ignore');
+    if (event === 'push') {
+        if (branchFilter && !tagFilter) {
+            return refFromPatterns('refs/heads/', filters.branches);
+        }
+        if (tagFilter && !branchFilter) {
+            return refFromPatterns('refs/tags/', filters.tags);
+        }
+        return {};
+    }
+    if (event === 'pull_request')
+        return { ref: (0, expression_1.knownPrefix)('refs/pull/') };
+    if (event === 'pull_request_target') {
+        return refFromPatterns('refs/heads/', filters.branches);
+    }
+    return {};
+}
+/**
+ * What's known about one trigger of a workflow for static `if:` checks:
+ * `github.event_name`, `github.ref` / `ref_name` where its filters pin
+ * them, and `inputs.*`. Inputs are empty on events other than
+ * workflow_dispatch, so a declared dispatch input is null there; on
+ * workflow_dispatch only a choice with a single option is known (a
+ * `default` can be overridden by whoever dispatches).
+ */
+function triggerFacts(on, event) {
+    const config = on && typeof on === 'object' && !Array.isArray(on)
+        ? on[event]
+        : undefined;
+    const dispatch = on && typeof on === 'object' && !Array.isArray(on)
+        ? on
+            .workflow_dispatch
+        : undefined;
+    const declared = Object.entries(dispatch?.inputs ?? {});
+    const inputs = {};
+    for (const [name, spec] of declared) {
+        const input = (spec ?? {});
+        if (event !== 'workflow_dispatch') {
+            inputs[name] = null;
+        }
+        else if (input.type === 'choice' &&
+            Array.isArray(input.options) &&
+            input.options.length === 1) {
+            inputs[name] = String(input.options[0]);
+        }
+    }
+    return {
+        github: { event_name: event, ...refFacts(event, config) },
+        ...(declared.length > 0 ? { inputs } : {})
+    };
+}
 function splitActionRef(uses) {
     const atIndex = uses.lastIndexOf('@');
     if (atIndex === -1 || uses.startsWith('docker://')) {

package/dist/runner/actions.js

@@ -301,7 +301,9 @@ async function executeAction(step, options, startTime, runtime, ctx) {
         }
         if (options.localCheckout !== false &&
             (0, checkout_1.isLocalCheckout)(step.uses, step.with, callerCtx)) {
-            return (0, checkout_1.localCheckout)(step, callerCtx, runtime, startTime);
+            return (0, checkout_1.localCheckout)(step, callerCtx, runtime, startTime, {
+                fetchRefs: options.fetchRefs
+            });
         }
         const builtin = (0, builtin_actions_1.builtinActionFor)(step.uses);
         if (builtin) {

package/dist/runner/checkout.js

@@ -37,12 +37,15 @@ exports.copyWorkingCopy = copyWorkingCopy;
 exports.createIsolatedWorkspace = createIsolatedWorkspace;
 exports.removeIsolatedWorkspace = removeIsolatedWorkspace;
 exports.isLocalCheckout = isLocalCheckout;
+exports.gitAuthEnv = gitAuthEnv;
 exports.localCheckout = localCheckout;
 const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
 const child_process_1 = require("child_process");
 const logger_1 = require("../utils/logger");
 const expression_1 = require("./expression");
+const job_container_1 = require("./job-container");
+const container_runtime_1 = require("./container-runtime");
 /** Marks a `path:` copy made by localCheckout, so it may be replaced. */
 const CHECKOUT_MARKER = '.secureci-checkout';
 /**
@@ -129,18 +132,98 @@ function escapesViaSymlink(workspace, dest) {
     return real !== root && !real.startsWith(root + path.sep);
 }
 /** Run git in `cwd` on the host; undefined when it fails. */
-function gitOutput(cwd, args) {
+function gitOutput(cwd, args, env) {
     try {
         return (0, child_process_1.execFileSync)('git', args, {
             cwd,
             encoding: 'utf8',
-            stdio: ['ignore', 'pipe', 'ignore']
+            stdio: ['ignore', 'pipe', 'ignore'],
+            ...(env ? { env: { ...process.env, ...env } } : {})
         }).trim();
     }
     catch {
         return undefined;
     }
 }
+/**
+ * Environment for a git fetch from `url`: never prompts, and sends
+ * `token` (as actions/checkout does) only to an https URL on the server's
+ * own host, scoped to that host by the config key. Passed through the
+ * environment, so it never shows in the process list.
+ */
+function gitAuthEnv(url, token, serverUrl) {
+    const env = { GIT_TERMINAL_PROMPT: '0' };
+    let target;
+    let server;
+    try {
+        target = new URL(url);
+        server = new URL(serverUrl);
+    }
+    catch {
+        return env;
+    }
+    if (!token || target.protocol !== 'https:' || target.host !== server.host) {
+        return env;
+    }
+    return {
+        ...env,
+        GIT_CONFIG_COUNT: '1',
+        GIT_CONFIG_KEY_0: `http.https://${target.host}/.extraheader`,
+        GIT_CONFIG_VALUE_0: `AUTHORIZATION: basic ${Buffer.from(`x-access-token:${token}`).toString('base64')}`
+    };
+}
+/** `fetch-depth`: a non-negative integer, default 1 as on GitHub; 0 is all. */
+function fetchDepth(raw) {
+    const n = Number(raw === undefined || raw === '' ? 1 : raw);
+    return Number.isInteger(n) && n >= 0 ? n : 1;
+}
+/**
+ * Check out `commit` (fetched from `source` when given, else from the
+ * local repository) into an empty `dest`, with `depth` commits of history
+ * (0: all). The working copy's `.git` is only read: a full-depth local
+ * checkout shares its objects; anything fetched lands in `dest` only.
+ * Returns the commit checked out, or undefined.
+ */
+function cloneInto(workspace, dest, what, depth) {
+    const ok = (args, cwd = dest, env) => gitOutput(cwd, args, env) !== undefined;
+    const depthArgs = depth > 0 ? ['--depth', String(depth)] : [];
+    if ('commit' in what && depth === 0) {
+        return ok(['clone', '--quiet', '--shared', '--no-checkout', '--', workspace, dest], workspace) && ok(['checkout', '--quiet', '--detach', what.commit])
+            ? what.commit
+            : undefined;
+    }
+    fs.mkdirSync(dest, { recursive: true });
+    if (!ok(['init', '--quiet']) || !ok(['remote', 'add', 'origin', workspace])) {
+        return undefined;
+    }
+    const [source, ref, env] = 'commit' in what
+        ? [`file://${workspace}`, what.commit, undefined]
+        : [what.source, what.ref, what.env];
+    // `source` (the origin URL) and `ref` come from outside: never let either
+    // be read as an option (`--upload-pack=<cmd>`), and never allow the
+    // `ext::` transport, which runs a command, whatever the user's config says.
+    if (!ok([
+        '-c',
+        'protocol.ext.allow=never',
+        'fetch',
+        '--quiet',
+        '--no-tags',
+        ...depthArgs,
+        '--end-of-options',
+        source,
+        ref
+    ], dest, env)) {
+        return undefined;
+    }
+    const commit = gitOutput(dest, [
+        'rev-parse',
+        '--verify',
+        'FETCH_HEAD^{commit}'
+    ]);
+    return commit && ok(['checkout', '--quiet', '--detach', commit])
+        ? commit
+        : undefined;
+}
 /**
  * The commit `ref` names in the local repository (as given, else as a
  * branch of `origin`), or undefined. A ref that looks like an option is
@@ -176,7 +259,7 @@ function uninitializedSubmodules(workspace) {
         .map((line) => line.slice(1).split(' ')[1])
         .filter(Boolean);
 }
-function localCheckout(step, ctx, runtime, startTime) {
+function localCheckout(step, ctx, runtime, startTime, options = {}) {
     const withValues = (0, expression_1.substituteRecord)(step.with, ctx);
     const outputs = {
         ref: String(ctx.github.ref ?? ''),
@@ -196,18 +279,27 @@ function localCheckout(step, ctx, runtime, startTime) {
     }
     // A ref other than the current one: check out that commit, when the local
     // repository has it, into path: (never over the user's working copy).
+    // With --fetch-refs, a ref the local repository lacks is fetched from
+    // origin into the path: copy (never into the user's repository).
     const ref = withValues.ref;
     let commit;
+    let fetchFrom;
     if (ref &&
         ![ctx.github.ref, ctx.github.ref_name, ctx.github.sha].includes(ref)) {
         commit = resolveLocalRef(workspace, ref);
-        if (!commit) {
-            logger_1.logger.warn(`actions/checkout: ref "${ref}" isn't in the local repository; using the local working copy (fetch it, or pass --no-local-checkout to run the real action)`);
-        }
-        else if (relative === '') {
+        if (relative === '') {
             logger_1.logger.warn(`actions/checkout: not checking out ref "${ref}" over your working copy; add a path: to check it out there, or pass --no-local-checkout to run the real action`);
             commit = undefined;
         }
+        else if (!commit && options.fetchRefs && !ref.startsWith('-')) {
+            fetchFrom = gitOutput(workspace, ['remote', 'get-url', 'origin']);
+            if (!fetchFrom) {
+                return fail(`actions/checkout: can't fetch ref "${ref}": the local repository has no origin remote`);
+            }
+        }
+        else if (!commit) {
+            logger_1.logger.warn(`actions/checkout: ref "${ref}" isn't in the local repository; using the local working copy (pass --fetch-refs to fetch it from origin, or --no-local-checkout to run the real action)`);
+        }
     }
     const submodules = String(withValues.submodules ?? '').toLowerCase();
     if (submodules === 'true' || submodules === 'recursive') {
@@ -226,21 +318,26 @@ function localCheckout(step, ctx, runtime, startTime) {
                 return fail(`actions/checkout: path "${withValues.path}" already exists in the working copy; remove it or pass --no-local-checkout`);
             }
         }
-        if (commit) {
-            // A local clone, sharing the repository's objects: nothing is fetched
-            // and the working copy's .git is only read.
-            const cloned = gitOutput(workspace, [
-                'clone',
-                '--quiet',
-                '--shared',
-                '--no-checkout',
-                '--',
-                workspace,
-                dest
-            ]) !== undefined &&
-                gitOutput(dest, ['checkout', '--quiet', '--detach', commit]) !==
-                    undefined;
-            if (!cloned) {
+        const depth = fetchDepth(withValues['fetch-depth']);
+        if (fetchFrom) {
+            const token = withValues.token || String(ctx.github.token ?? '');
+            const fetched = cloneInto(workspace, dest, {
+                ref: String(ref),
+                source: fetchFrom,
+                env: gitAuthEnv(fetchFrom, token, String(ctx.github.server_url ?? 'https://github.com'))
+            }, depth);
+            if (!fetched) {
+                fs.rmSync(dest, { recursive: true, force: true });
+                return fail(`actions/checkout: couldn't fetch ref "${ref}" from origin (${fetchFrom})`);
+            }
+            outputs.ref = String(ref);
+            outputs.commit = fetched;
+            output = `Fetched ${ref} (${fetched.slice(0, 7)}) to ${relative}`;
+        }
+        else if (commit) {
+            // A local clone (sharing the repository's objects at full depth):
+            // nothing is fetched and the working copy's .git is only read.
+            if (!cloneInto(workspace, dest, { commit }, depth)) {
                 fs.rmSync(dest, { recursive: true, force: true });
                 return fail(`actions/checkout: couldn't check out ref "${ref}" to "${withValues.path}"`);
             }
@@ -258,6 +355,9 @@ function localCheckout(step, ctx, runtime, startTime) {
             step: postStep,
             condition: 'always()',
             run: async () => {
+                // Files a container step created as root may not be removable by
+                // the host user: remove the copy from inside the container first.
+                await (0, job_container_1.removeInContainer)(runtime, path.posix.join(container_runtime_1.CONTAINER_WORKDIR, ...relative.split(path.sep)));
                 fs.rmSync(dest, { recursive: true, force: true });
                 return { step: postStep, success: true, duration: 0 };
             }

package/dist/runner/container-runtime.js

@@ -34,6 +34,7 @@ var __importStar = (this && this.__importStar) || (function () {
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.CONTAINER_EXCHANGE_DIR = exports.CONTAINER_WORKDIR = void 0;
+exports.registryOf = registryOf;
 exports.resolveContainerRuntime = resolveContainerRuntime;
 exports._resetRuntimeCacheForTests = _resetRuntimeCacheForTests;
 const child_process_1 = require("child_process");
@@ -50,6 +51,18 @@ const RUNTIME_BINARIES = {
     podman: 'podman',
     containerd: 'nerdctl'
 };
+/**
+ * The registry an image reference pulls from: its first path component
+ * when that names a host (has a `.` or `:`, or is `localhost`), else
+ * Docker Hub.
+ */
+function registryOf(image) {
+    const slash = image.indexOf('/');
+    if (slash === -1)
+        return 'docker.io';
+    const first = image.slice(0, slash);
+    return /[.:]/.test(first) || first === 'localhost' ? first : 'docker.io';
+}
 exports.CONTAINER_WORKDIR = '/secureci-workspace';
 exports.CONTAINER_EXCHANGE_DIR = '/secureci-exchange';
 /**
@@ -232,6 +245,7 @@ class CliContainerRuntime {
             'exec',
             '-w',
             options.workingDir || exports.CONTAINER_WORKDIR,
+            ...(options.user ? ['-u', options.user] : []),
             ...env.args
         ];
         if (options.args) {
@@ -294,7 +308,64 @@ class CliContainerRuntime {
             // Best effort: the container may already be gone
         }
     }
-    runCli(args, timeoutMs, env) {
+    async pull(image, auth) {
+        const invalid = (0, container_policy_1.invalidImageReason)(image);
+        if (invalid)
+            return { success: false, error: invalid };
+        const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'secureci-auth-'));
+        fs.chmodSync(dir, 0o700);
+        try {
+            const clientEnv = { ...process.env };
+            if (this.name === 'podman') {
+                clientEnv.REGISTRY_AUTH_FILE = path.join(dir, 'auth.json');
+            }
+            else {
+                clientEnv.DOCKER_CONFIG = dir;
+                // A docker context lives in the user's config dir: pin its
+                // endpoint so the private config dir talks to the same engine.
+                if (this.name === 'docker' && !process.env.DOCKER_HOST) {
+                    const context = await this.runCli([
+                        'context',
+                        'inspect',
+                        '--format',
+                        '{{.Endpoints.docker.Host}}'
+                    ]);
+                    const host = context.stdout.trim();
+                    if (context.success && host)
+                        clientEnv.DOCKER_HOST = host;
+                }
+            }
+            const transport = {
+                args: [],
+                clientEnv,
+                cleanup: () => { }
+            };
+            const login = await this.runCli([
+                'login',
+                '--username',
+                auth.username,
+                '--password-stdin',
+                auth.registry
+            ], undefined, transport, auth.password);
+            if (!login.success) {
+                return {
+                    success: false,
+                    error: `login to ${auth.registry} failed: ${login.stderr.trim() || `exit code ${login.exitCode}`}`
+                };
+            }
+            const pulled = await this.runCli(['pull', image], undefined, transport);
+            return pulled.success
+                ? { success: true }
+                : {
+                    success: false,
+                    error: pulled.stderr.trim() || `exit code ${pulled.exitCode}`
+                };
+        }
+        finally {
+            fs.rmSync(dir, { recursive: true, force: true });
+        }
+    }
+    runCli(args, timeoutMs, env, input) {
         const startTime = Date.now();
         return new Promise((resolve) => {
             let child;
@@ -305,6 +376,8 @@ class CliContainerRuntime {
                 env?.cleanup();
                 throw err;
             }
+            if (input !== undefined)
+                child.stdin.end(input);
             let stdout = '';
             let stderr = '';
             let timedOut = false;

package/dist/runner/executor.js

@@ -162,15 +162,20 @@ async function executeWorkflow(filePath, options = {}, internal = {}) {
                 return { success: false, jobs: [], duration: Date.now() - startTime };
             }
             logger_1.logger.info(`Executing workflow: ${parsed.file.name}`);
-            const concurrencyAt = [
-                ...(parsed.file.concurrency ? ['workflow'] : []),
-                ...Object.entries(parsed.file.jobs)
-                    .filter(([, job]) => job.concurrency)
-                    .map(([id]) => `jobs.${id}`)
-            ];
-            if (concurrencyAt.length > 0) {
-                logger_1.logger.info(`concurrency: isn't applied in a local run (${concurrencyAt.join(', ')}): it doesn't queue behind or cancel other runs, and jobs run as needs: and --parallel allow`);
+            const concurrencyMode = options.concurrency ?? 'serialize';
+            if (parsed.file.concurrency && !internal.groups) {
+                logger_1.logger.info("workflow-level concurrency: isn't applied in a local run: there are no other runs to queue behind or cancel");
             }
+            const notCancelling = Object.entries(parsed.file.jobs)
+                .filter(([, job]) => typeof job.concurrency === 'object' &&
+                job.concurrency['cancel-in-progress'] !== undefined &&
+                job.concurrency['cancel-in-progress'] !== false)
+                .map(([id]) => `jobs.${id}`);
+            if (concurrencyMode === 'serialize' && notCancelling.length > 0) {
+                logger_1.logger.info(`cancel-in-progress isn't applied with --concurrency serialize (${notCancelling.join(', ')}): jobs in a group run one at a time, all of them; pass --concurrency github to cancel as GitHub does`);
+            }
+            const groups = internal.groups ??
+                new scheduler_1.ConcurrencyGroups(concurrencyMode, (message) => logger_1.logger.info(message));
             options = {
                 ...options,
                 inputs: {
@@ -268,6 +273,40 @@ async function executeWorkflow(filePath, options = {}, internal = {}) {
                 // Each combination's result and outputs, by combination index.
                 const unitResults = [];
                 const unitOutputs = [];
+                // `concurrency:`: each combination waits for its group (with the
+                // group evaluated for its matrix values) before taking a slot.
+                const concurrencySpec = typeof job.concurrency === 'string'
+                    ? { group: job.concurrency }
+                    : job.concurrency;
+                const concurrencyGate = concurrencySpec
+                    ? {
+                        gate: (index, abort) => {
+                            const values = selected[index].values;
+                            const ctx = { ...jobIfCtx, matrix: values };
+                            let group = '';
+                            try {
+                                group = (0, expression_1.substituteExpressions)(String(concurrencySpec.group ?? ''), ctx).trim();
+                            }
+                            catch (error) {
+                                logger_1.logger.warn(`jobs.${jobId}.concurrency: ${error instanceof Error ? error.message : String(error)}; running without a group`);
+                            }
+                            if (!group)
+                                return Promise.resolve(() => undefined);
+                            return groups.enter(group, (0, job_plan_1.isTruthySetting)(concurrencySpec['cancel-in-progress'], ctx), abort, labelOf(values));
+                        },
+                        onGateCancelled: (index) => {
+                            const { index: combinationIndex, values } = selected[index];
+                            unitResults[combinationIndex] = {
+                                job: labelOf(values),
+                                success: false,
+                                cancelled: true,
+                                steps: [],
+                                duration: 0
+                            };
+                            return { result: 'cancelled' };
+                        }
+                    }
+                    : {};
                 let outcomes;
                 if (job.uses) {
                     // A reusable workflow call (once per matrix combination). The
@@ -276,7 +315,7 @@ async function executeWorkflow(filePath, options = {}, internal = {}) {
                         const { index: combinationIndex, values: matrixValues } = selected[index];
                         const label = labelOf(matrixValues);
                         return tagged(label, async () => {
-                            const reusableResult = await executeReusableWorkflowJob(label, job, filePath, options, { ...jobIfCtx, matrix: matrixValues }, { slots, signal });
+                            const reusableResult = await executeReusableWorkflowJob(label, job, filePath, options, { ...jobIfCtx, matrix: matrixValues }, { slots, signal, groups });
                             const cancelled = !reusableResult.success && signal.aborted;
                             unitResults[combinationIndex] = cancelled
                                 ? { ...reusableResult, cancelled: true }
@@ -291,7 +330,12 @@ async function executeWorkflow(filePath, options = {}, internal = {}) {
                                         : 'failure'
                             };
                         }, true);
-                    }, { failFast, maxParallel, signal: internal.signal });
+                    }, {
+                        failFast,
+                        maxParallel,
+                        signal: internal.signal,
+                        ...concurrencyGate
+                    });
                 }
                 else {
                     // Outputs so far, as each combination's result reports them.
@@ -540,6 +584,9 @@ async function executeWorkflow(filePath, options = {}, internal = {}) {
                             finally {
                                 signal.removeEventListener('abort', onAbort);
                                 await stopping;
+                                if (options.isolateWorkspace) {
+                                    await (0, job_container_1.clearIsolatedWorkspace)(runtime);
+                                }
                                 await (0, job_container_1.stopJobContainer)(runtime);
                             }
                         }
@@ -577,6 +624,7 @@ async function executeWorkflow(filePath, options = {}, internal = {}) {
                         maxParallel,
                         slots,
                         signal: internal.signal,
+                        ...concurrencyGate,
                         onFailFast: () => logger_1.logger.info(concurrent
                             ? `Cancelling remaining matrix jobs for ${jobId} (fail-fast)`
                             : `Skipping remaining matrix jobs for ${jobId} (fail-fast)`)

package/dist/runner/expression.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.createContext = createContext;
+exports.knownPrefix = knownPrefix;
 exports.resolveExpressionValue = resolveExpressionValue;
 exports.substituteExpressions = substituteExpressions;
 exports.substituteRecord = substituteRecord;
@@ -398,6 +399,29 @@ class Unknown {
         this.truthy = truthy;
     }
 }
+/**
+ * A string static evaluation knows only the start of (lower-cased), e.g.
+ * `github.ref` on a tags-only push: `refs/tags/`. Decides `==` / `!=`
+ * against a literal that can't share the prefix and `startsWith`.
+ */
+class KnownPrefix extends Unknown {
+    constructor(prefix) {
+        super(prefix !== '' ? true : undefined);
+        this.prefix = prefix;
+    }
+}
+/** A string known to start with `prefix` (compared case-insensitively). */
+function knownPrefix(prefix) {
+    return new KnownPrefix(prefix.toLowerCase());
+}
+/** False when `a == b` can't hold because of a known prefix, else undefined. */
+function prefixRulesOutEquality(a, b) {
+    const [known, other] = a instanceof KnownPrefix ? [a, unwrap(b)] : [b, unwrap(a)];
+    if (!(known instanceof KnownPrefix) || typeof other !== 'string') {
+        return false;
+    }
+    return !other.toLowerCase().startsWith(known.prefix);
+}
 /** Contexts an expression may name; static evaluation knows only some. */
 const NAMED_CONTEXTS = new Set([
     'env',
@@ -506,6 +530,10 @@ class Parser {
         while (this.isOp('==', '!=')) {
             const op = this.next().value;
             const right = this.parseComparison();
+            if (prefixRulesOutEquality(left, right)) {
+                left = op !== '==';
+                continue;
+            }
             if (left instanceof Unknown || right instanceof Unknown) {
                 left = new Unknown();
                 continue;
@@ -674,6 +702,18 @@ class Parser {
         const lower = name.toLowerCase();
         if (lower === 'success' || lower === 'always')
             return true;
+        if (lower === 'startswith' && args[0] instanceof KnownPrefix) {
+            const search = unwrap(args[1]);
+            if (typeof search === 'string') {
+                const { prefix } = args[0];
+                const wanted = search.toLowerCase();
+                if (prefix.startsWith(wanted))
+                    return true;
+                if (!wanted.startsWith(prefix))
+                    return false;
+            }
+            return new Unknown();
+        }
         if (['failure', 'cancelled', 'hashfiles'].includes(lower) ||
             args.some((arg) => arg instanceof Unknown)) {
             return new Unknown();

package/dist/runner/job-container.js

@@ -38,6 +38,8 @@ exports.installContainerCleanup = installContainerCleanup;
 exports.noRuntimeMessage = noRuntimeMessage;
 exports.startJobContainer = startJobContainer;
 exports.runnerImage = runnerImage;
+exports.clearIsolatedWorkspace = clearIsolatedWorkspace;
+exports.removeInContainer = removeInContainer;
 exports.stopJobContainer = stopJobContainer;
 exports.startJobServices = startJobServices;
 exports.stopJobServices = stopJobServices;
@@ -144,6 +146,11 @@ async function startJobContainer(job, ctx, options, runtime, runDir) {
         : {};
     if (!extras)
         return false;
+    if (specImage &&
+        spec &&
+        !(await pullWithCredentials(`jobs.${ctx.github.job ?? '<id>'}.container`, image, spec.credentials, ctx, options, containerRuntime))) {
+        return false;
+    }
     const exchangeDir = fs.mkdtempSync(path.join(runDir, 'container-'));
     fs.chmodSync(exchangeDir, 0o777);
     fs.copyFileSync(runtime.eventPath, path.join(exchangeDir, 'event.json'));
@@ -210,15 +217,42 @@ function jobContainerExtras(spec, ctx, options, workspace) {
             return undefined;
         }
     }
-    if (spec.credentials) {
-        logger_1.logger.warn(`${label}: credentials are ignored; log in with \`docker login\` instead.`);
-    }
     return {
         extraArgs: kept,
         ports: (spec.ports ?? []).map((port) => (0, expression_1.substituteExpressions)(String(port), ctx)),
         volumes
     };
 }
+/**
+ * `credentials:` of a job or service container. Without --registry-login
+ * they're only warned about. With it, the image is pulled with them first
+ * (a private, temporary login: see ContainerRuntime.pull), and the
+ * password is masked in the logs. False (the job fails) when they're
+ * incomplete or the pull fails.
+ */
+async function pullWithCredentials(label, image, credentials, ctx, options, runtime) {
+    if (!credentials)
+        return true;
+    if (!options.registryLogin) {
+        logger_1.logger.warn(`${label}: credentials are ignored; pass --registry-login to log in for this run, or log in with \`docker login\`.`);
+        return true;
+    }
+    const username = (0, expression_1.substituteExpressions)(String(credentials.username ?? ''), ctx).trim();
+    const password = (0, expression_1.substituteExpressions)(String(credentials.password ?? ''), ctx);
+    logger_1.logger.registerSecrets({ password });
+    if (!username || !password) {
+        logger_1.logger.error(`${label}: credentials need a username and a password.`);
+        return false;
+    }
+    const registry = (0, container_runtime_1.registryOf)(image);
+    logger_1.logger.info(`${label}: pulling ${image} with credentials for ${registry}`);
+    const pulled = await runtime.pull(image, { registry, username, password });
+    if (!pulled.success) {
+        logger_1.logger.error(`${label}: couldn't pull ${image}: ${pulled.error}`);
+        return false;
+    }
+    return true;
+}
 /**
  * The image for a job's `runs-on`: the first label with a mapping in
  * `runner-images` (or the built-in one), else the default image, with a
@@ -250,6 +284,59 @@ function runnerImage(runsOn, ctx, options) {
     }
     return fallback;
 }
+/**
+ * Empty a job's --isolate-workspace copy from inside its container, as
+ * root, before the container is stopped: files a step created as root
+ * (rootful engines) can't always be removed by the host user afterwards.
+ * Removing them from inside works with rootful and rootless engines alike
+ * (a chown back would map to a subordinate uid when rootless). `.git` is
+ * mounted read-only, so it's left for the host to remove. Only ever call
+ * this for an isolated copy, never for the user's working copy.
+ */
+async function clearIsolatedWorkspace(runtime) {
+    const container = runtime.container;
+    if (!container)
+        return;
+    const result = await container.runtime.exec(container.id, {
+        args: [
+            'find',
+            container_runtime_1.CONTAINER_WORKDIR,
+            '-mindepth',
+            '1',
+            '-maxdepth',
+            '1',
+            '!',
+            '-name',
+            '.git',
+            '-exec',
+            'rm',
+            '-rf',
+            '--',
+            '{}',
+            '+'
+        ],
+        user: '0',
+        workingDir: '/'
+    });
+    if (!result.success) {
+        logger_1.logger.debug(`Couldn't empty the workspace copy in the job container: ${result.stderr.trim()}`);
+    }
+}
+/**
+ * Remove `containerPath` from inside the job's container, as root, so a
+ * copy holding files a step created as root can then be removed on the
+ * host. No-op without a container.
+ */
+async function removeInContainer(runtime, containerPath) {
+    const container = runtime.container;
+    if (!container)
+        return;
+    await container.runtime.exec(container.id, {
+        args: ['rm', '-rf', '--', containerPath],
+        user: '0',
+        workingDir: '/'
+    });
+}
 async function stopJobContainer(runtime) {
     const container = runtime.container;
     if (container) {
@@ -319,10 +406,10 @@ async function startJobServices(job, ctx, options, runtime) {
                 return false;
             }
         }
-        if (service.credentials) {
-            logger_1.logger.warn(`services.${serviceId}: credentials are ignored; log in with \`docker login\` instead.`);
-        }
         const image = (0, expression_1.substituteExpressions)(service.image, ctx);
+        if (!(await pullWithCredentials(`services.${serviceId}`, image, service.credentials, ctx, options, containerRuntime))) {
+            return false;
+        }
         logger_1.logger.info(`Starting service ${serviceId}: ${image}`);
         const started = await containerRuntime.start({
             image,

package/dist/runner/scheduler.js

@@ -33,9 +33,10 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.Slots = void 0;
+exports.ConcurrencyGroups = exports.Slots = void 0;
 exports.defaultParallelism = defaultParallelism;
 exports.parseParallel = parseParallel;
+exports.parseConcurrencyMode = parseConcurrencyMode;
 exports.runMatrix = runMatrix;
 exports.runJobGraph = runJobGraph;
 const os = __importStar(require("os"));
@@ -84,6 +85,65 @@ function parseParallel(raw) {
     }
     return n;
 }
+/** Parse `--concurrency` / config `concurrency`. */
+function parseConcurrencyMode(raw) {
+    const mode = raw.trim().toLowerCase();
+    if (mode === 'serialize' || mode === 'github')
+        return mode;
+    throw new Error(`Invalid value "${raw}" for concurrency. Must be serialize or github.`);
+}
+/** `concurrency:` groups of one run, keyed case-insensitively. */
+class ConcurrencyGroups {
+    constructor(mode, note = () => undefined) {
+        this.mode = mode;
+        this.note = note;
+        this.holders = new Map();
+        this.waiting = new Map();
+    }
+    /**
+     * Wait to run in `group`. `abort` cancels this job once it's running
+     * (github mode, for a newcomer with cancel-in-progress).
+     */
+    enter(group, cancelInProgress, abort, label) {
+        const key = group.toLowerCase();
+        return new Promise((admit) => {
+            const entry = { label, abort, admit };
+            const holder = this.holders.get(key);
+            if (!holder) {
+                this.admit(key, entry);
+                return;
+            }
+            const queue = this.waiting.get(key) ?? [];
+            this.waiting.set(key, queue);
+            if (this.mode === 'github') {
+                if (cancelInProgress) {
+                    this.note(`Cancelling ${holder.label}: ${label} joined concurrency group "${group}" with cancel-in-progress`);
+                    holder.abort();
+                }
+                for (const older of queue.splice(0)) {
+                    this.note(`Cancelling ${older.label}: ${label} is now pending in concurrency group "${group}"`);
+                    older.admit('cancelled');
+                }
+            }
+            queue.push(entry);
+        });
+    }
+    admit(key, entry) {
+        this.holders.set(key, entry);
+        let left = false;
+        entry.admit(() => {
+            if (left)
+                return;
+            left = true;
+            const next = this.waiting.get(key)?.shift();
+            if (next)
+                this.admit(key, next);
+            else
+                this.holders.delete(key);
+        });
+    }
+}
+exports.ConcurrencyGroups = ConcurrencyGroups;
 /**
  * Run `count` matrix combinations, at most `maxParallel` at once and each
  * holding one of the global `slots` while it runs. With fail-fast, a
@@ -105,6 +165,29 @@ async function runMatrix(count, run, options) {
     };
     options.signal?.addEventListener('abort', onParentAbort);
     const runOne = async (index) => {
+        const controller = new AbortController();
+        let leaveGroup;
+        if (options.gate) {
+            const admission = await options.gate(index, () => controller.abort());
+            if (admission === 'cancelled' || controller.signal.aborted) {
+                if (admission !== 'cancelled')
+                    admission();
+                if (!stopped && options.onGateCancelled) {
+                    outcomes[index] = await options.onGateCancelled(index);
+                    finished++;
+                }
+                return;
+            }
+            leaveGroup = admission;
+        }
+        try {
+            await runAdmitted(index, controller);
+        }
+        finally {
+            leaveGroup?.();
+        }
+    };
+    const runAdmitted = async (index, controller) => {
         const releaseLocal = await local.acquire();
         try {
             if (stopped)
@@ -115,7 +198,6 @@ async function runMatrix(count, run, options) {
             try {
                 if (stopped)
                     return;
-                const controller = new AbortController();
                 controllers.set(index, controller);
                 try {
                     const outcome = await run(index, controller.signal);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@secureci/cli",
-  "version": "1.1.0",
+  "version": "1.2.0",
   "description": "SecureCI: validate, check against pipeline standards, and run GitHub Actions workflows locally",
   "main": "dist/index.js",
   "bin": {