poll-ci v1.2.0

What's new in v1.2.0

• Built-in trivy source scan (scan:). Add a scan: block and poll-ci runs
  a trivy filesystem scan of the checkout as a gate step,
  reported as a ci/trivy commit status. A finding fails the gate — so,
  combined with promote:, vulnerable deps, leaked secrets, or misconfigured
  Dockerfiles/IaC never advance a deploy branch. Shift-left scanning of the
  source, complementary to scanning built images. Needs no GitHub token; the
  trivy DB is cached in a named volume so it isn't re-downloaded each run.

  checks:
    - { name: test, run: go test ./... }
  scan: {}                 # defaults: vuln,secret,misconfig · HIGH,CRITICAL
  promote:
    branch: release        # only green + clean source promotes

• Promotion-pipeline heartbeat (dead-man's-switch). Optional systemd
  timer + monitor (deploy/heartbeat-monitor.sh) that alerts if the poller
  stops advancing the deploy branch — so a silently-stuck pipeline is noticed.
  Installed by deploy/install.sh.

Install

# Docker
docker run -d --restart always \
  -e GITHUB_TOKEN=github_pat_xxx -e REPO=you/repo -e BRANCH=main \
  -v /var/run/docker.sock:/var/run/docker.sock \
  -v poll-ci-state:/var/lib/poll-ci \
  ghcr.io/extremeshok/poll-ci:v1.2.0

# Systemd service (one command)
git clone https://github.com/extremeshok/poll-ci && sudo poll-ci/deploy/install.sh

# Go
go install github.com/extremeshok/poll-ci@v1.2.0

Prebuilt binaries below (verify with poll-ci_v1.2.0_checksums.txt).
Full docs: README.