feat(generate): add --cli-install=binary for allowlist-free CLI install#653
Merged
Conversation
…CLI install generate-workflow gains a --cli-install flag (action|binary, default action). In binary mode every generated setup-cli step is a self-contained run: step that uses no third-party action: it resolves the release tag, detects OS/arch, installs a checksum-verified cosign by direct download, and runs the same mandatory sha256 gate and keyless cosign verification the composite action performs. The verify logic lives in one install.sh, embedded and emitted inline, so both modes share a single contract. This lets a repo adopt cascade without an organization Actions allowlist entry. Default action mode is byte-identical to before (zero drift). Signed-off-by: Joshua Temple <joshua.temple@stablekernel.com>
This was referenced Jul 21, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #651.
Problem
Generated workflows install the CLI via
uses: stablekernel/cascade/.github/actions/setup-cli@<ref>, a third-party action. Organizations that run a GitHub Actions allowlist must approve it before any generated pipeline can run, which is an adoption barrier. A shell-based binary fetch is not a third-party action and does not hit the allowlist.Fix
generate-workflowgains--cli-install=action|binary(defaultaction), threaded as a generator option (mirrors--own-repo; not a manifest field).action(default): unchanged, byte-identical output.binary: emits a self-containedrun:install with no third-partyuses:at all. Token and version pass throughenv(never spliced into the script, so no parse-time${{ }}). It resolveslatestto a concrete tag, detects OS/arch, installs cosign by pinned checksum-verified direct download (not the installer action), then runs the action'sinstall.shverbatim (embedded via//go:embed, kept in sync by a byte-identity guard test). This preserves the exact verification the action performs: mandatory sha256 gate plus keyless cosign verify, with the same loud sha256-only fallback. First-partyactions/*are untouched.Same security posture as the action, without requiring an org action-allowlist entry. Verification steps are documented in
security.md#verifying-cascade-releases, which the new docs link.Verification
go build ./...,go test ./...(3665 pass),go test -race ./internal/generate/... ./internal/setupcli/...(944 pass),golangci-lint run ./...all clean.generate-workflow --own-reporegeneration: zero drift (action mode unchanged).internal/setupclirunning the realinstall.sh(tied to the emitted copy by the byte-identity guard).Docs updated: CLI reference, getting-started, README.