Skip to content

v0.1.0 — Offline CI auditor MVP

Choose a tag to compare

View all tags
@dnlrsls dnlrsls released this 19 Oct 03:26
v0.1.0
b16b7cb
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

v0.1.0 — Offline CI auditor MVP

First release of the offline, read-only auditor: audit, saved report rendering, and conditional bootstrap --dry-run. No repository scripts are executed, no dependencies are installed and no workflow changes are applied by these commands.

Download and use

Choose the OS/architecture archive below, verify it against the attached SHA256SUMS, and extract it. Windows uses ci-trust.exe; macOS ARM64 is Apple Silicon. Other architectures can build from source.

./ci-trust --version
./ci-trust audit PATH --format json > audit.json
./ci-trust report --input audit.json --format human
./ci-trust bootstrap PATH --dry-run

Versioned binaries print ci-trust "0.1.0". Ordinary source builds still default to dev unless the documented build-time version override is supplied.

Actual native verification

Source: b16b7cbff841239d493e308802849f02395bef56. Prepared and integrated through PR #112.
Final main run: https://github.com/dnlrsls/ci-trust/actions/runs/39193971349. All three native hosts passed owned tests, public version/help/audit/report/dry-run/cold-verify/refusal/immutability checks and vet before uploading these archives. The exact tested binaries were packaged in CI; no local cross-build reconstruction is distributed. Downloaded archive/binary hashes, source/run identities and all ten upstream license texts were verified before publication.

Archive Compiler Native job
ci-trust_0.1.0_linux_amd64.zip go1.26.9 Passed
ci-trust_0.1.0_windows_amd64.zip go1.26.8 Passed
ci-trust_0.1.0_darwin_arm64.zip go1.26.9 Passed

Each ZIP includes the tested binary, RELEASE.json, project LICENSE, THIRD_PARTY_NOTICES.md and LICENSES/. SHA256SUMS covers the three ZIPs. Checksums detect byte differences; they are not independent publisher signatures. Binaries are unsigned, with no Windows signing or macOS notarization claim.

Scope and limitations

  • Configuration is not observed CI execution, validator efficacy or required-check enforcement. No aggregate trust score is provided. Exit 0 may include findings, FAIL, UNKNOWN or a conditional proposal.
  • This is the explicitly narrowed offline MVP, not completion of the earlier execution-verification scope. Issue #9 remains open; executable ESLint verification is experimental/unvalidated. Ordinary verify --check lint remains UNVERIFIABLE; its valid-report exit 0 is not a lint PASS. Existing opt-in protected-route consent/preflight controls remain unchanged.
  • No Node.js, npm, ESLint, container image or lint candidate is bundled. No new controlled runtime attempt was made for this release. Earlier failed reconstruction/profile attempts were discarded, not treated as proof.
  • Project source is MIT, copyright (c) 2026 dnlrsls. Third-party software retains the terms included in the archive.

See release scope and CLI limits.

Assets 6
Loading