pushci 1.7.5 → 1.8.1

package/README.md

@@ -1,8 +1,9 @@
 # PushCI
 
 [![npm version](https://img.shields.io/npm/v/pushci.svg)](https://www.npmjs.com/package/pushci)
+[![npm downloads](https://img.shields.io/npm/dm/pushci.svg)](https://www.npmjs.com/package/pushci)
 [![License: BUSL-1.1](https://img.shields.io/badge/License-BUSL--1.1-blue.svg)](LICENSE)
-[![CI](https://github.com/finsavvyai/pushci/actions/workflows/ci.yml/badge.svg)](https://github.com/finsavvyai/pushci/actions/workflows/ci.yml)
+[![Release](https://img.shields.io/github/v/release/finsavvyai/pushci-cli)](https://github.com/finsavvyai/pushci-cli/releases/latest)
 [![MCP](https://img.shields.io/badge/MCP-compatible-purple.svg)](https://pushci.dev/ai)
 
 **Zero-config AI CI/CD. Runs on your machine. Free forever.**
@@ -16,8 +17,22 @@ pushci init             # AI detects your stack in 30 seconds
 git push                # tests run automatically
 ```
 
-<!-- TODO: Add 30-second demo GIF here -->
-<!-- ![PushCI Demo](assets/demo.gif) -->
+```
+$ pushci init
+  Detecting stack ........................ Node 20 + Vite + Vitest
+  Detecting deploy target ................ Cloudflare Workers (wrangler.toml)
+  Writing pushci.yml ..................... 14 lines
+  Installing pre-push hook ............... done
+
+$ git push
+  → running pushci run
+  ✓ lint                                                                3.2s
+  ✓ test                                                                8.4s
+  ✓ build                                                              12.1s
+  → 24 commits ahead of origin/main · all checks passed
+```
+
+See it live at <a href="https://pushci.dev">pushci.dev</a> (the terminal in the hero is real, not a render).
 
 ## Why PushCI?
 
@@ -183,6 +198,59 @@ personas:
       fail:  ["Avast, the build hath sunk."]
 ```
 
+## Secrets
+
+PushCI resolves secret references inline in `pushci.yml` env blocks.
+Three schemes are supported today; PushCI never writes a plaintext
+secret to disk it didn't already encrypt.
+
+| Scheme | Backed by | Best for |
+|---|---|---|
+| `keychain://service[#account]` | macOS Keychain / Windows Credential Manager / Linux Secret Service, with AES-encrypted fallback at `~/.pushci/keychain.enc` for headless CI | Local dev, individual machines |
+| `vault://path#field` | HashiCorp Vault AppRole (`VAULT_ADDR` + `VAULT_ROLE_ID` + `VAULT_SECRET_ID`) | Teams, audited environments |
+| `pushci secrets set KEY VAL` | Per-project AES file at `.pushci/secrets.enc`, machine-bound | Quick one-offs, throwaway scripts |
+
+```yaml
+# pushci.yml
+stages:
+  - name: publish
+    env:
+      NPM_TOKEN: keychain://npm-publish-token
+      DEPLOY_KEY: keychain://deploy-bot#prod
+      DB_PASSWORD: vault://secret/data/prod/db#password
+    checks:
+      - name: publish
+        run: npm publish
+```
+
+**Managing keychain entries from the CLI:**
+
+```bash
+pushci secrets keychain set npm-publish-token npm_xxxxxxxxxxxx
+pushci secrets keychain set deploy-bot#prod  s3cr3t
+pushci secrets keychain get npm-publish-token
+pushci secrets keychain list      # fallback-file entries only
+pushci secrets keychain rm  npm-publish-token
+```
+
+On macOS the storage layout matches the `security` CLI verbatim, so the
+common `.zshrc` helper functions work side-by-side:
+
+```bash
+secret()     { security find-generic-password -a "$USER" -s "$1" -w 2>/dev/null; }
+secret-set() { security add-generic-password    -a "$USER" -s "$1" -w "$2" -U; }
+```
+
+Entries written by `secret-set` are readable by `pushci secrets keychain
+get`, and vice versa — no `go-keyring-base64:` prefix gymnastics.
+
+**Headless Linux CI:** when D-Bus and Secret Service aren't running,
+PushCI falls back transparently to an AES-encrypted file at
+`~/.pushci/keychain.enc` with a machine-bound key. A one-time stderr
+warning fires the first time a fallback read or write happens, so the
+behavior is never silent. Override account default with the `#account`
+suffix; the current OS user is used when omitted.
+
 ## Configuration
 
 `pushci.yml` is optional — `pushci init` generates one that works, and

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pushci",
-  "version": "1.7.5",
+  "version": "1.8.1",
   "description": "AI-native CI/CD that runs on your machine. Zero config, zero cost. Works inside AI agent sandboxes (Claude, Cursor, Windsurf). 33 languages, 40+ frameworks, 22 deploy targets, 25 installable skills, Tailscale mesh, blast radius analysis.",
   "bin": {
     "pushci": "bin/pushci.js"