feat: Implement automated release process and enhance security features

Author: segraef

.github/workflows/release.yml

@@ -0,0 +1,34 @@
+# Automated releases for SecKit, driven by Conventional Commits.
+#
+# How it works (release-please):
+# - Every push to main is scanned for conventional commits (feat:, fix:, ...).
+# - release-please keeps an open "release PR" that bumps version.txt + the
+#   manifest and rewrites CHANGELOG.md from those commits.
+# - Merging that PR tags the commit (vX.Y.Z) and publishes a GitHub Release.
+#
+# Pre-1.0 bumping: feat -> minor, fix -> patch (see release-please-config.json).
+#
+# Repo setting required once: Settings > Actions > General >
+# "Allow GitHub Actions to create and approve pull requests" must be ON,
+# otherwise the release PR cannot be opened with the default GITHUB_TOKEN.
+name: release
+
+on:
+  push:
+    branches: [main]
+  workflow_dispatch:
+
+permissions:
+  contents: write
+  pull-requests: write
+
+jobs:
+  release-please:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Run release-please
+        uses: googleapis/release-please-action@v4
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
+          config-file: release-please-config.json
+          manifest-file: .release-please-manifest.json

.release-please-manifest.json

@@ -0,0 +1,3 @@
+{
+  ".": "0.1.0"
+}

CHANGELOG.md

@@ -5,29 +5,36 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
-## [Unreleased]
-
-### Added
-
-- Added xyz [@your_username](https://github.com/your_username)
-
-### Fixed
+From v0.1.0 onward this file is generated automatically by
+[release-please](https://github.com/googleapis/release-please) from
+[Conventional Commits](https://www.conventionalcommits.org/). Do not edit
+released sections by hand; write a good commit message instead.
 
-- Fixed zyx [@your_username](https://github.com/your_username)
-
-## [1.1.0] - 2021-06-23
+## [Unreleased]
 
 ### Added
 
-- Added x [@your_username](https://github.com/your_username)
+- `harden` now drops `ignore-scripts=true` into `.npmrc` on Node repos to block
+  install-time script execution (the vector used by self-propagating npm worms
+  such as the May 2026 `redhat-cloud-services` worm). The payload runs from a
+  package's `preinstall`/`install`/`postinstall` hook during `npm install`,
+  before any of your own code; this stops it even for variants no scanner has
+  catalogued yet.
+- `harden` surfaces the trade-off concretely: it lists the installed deps in the
+  target repo that legitimately build via install scripts (e.g. `esbuild`,
+  `sharp`), so they can be allowlisted with `@lavamoat/allow-scripts` instead of
+  disabling the protection. The generated `.npmrc` documents the allowlist flow
+  inline.
+- `seckit version` (`--version`/`-v`) prints the installed version, sourced from
+  `version.txt`.
 
 ### Changed
 
-- Changed y [@your_username](https://github.com/your_username)
+- Introduced automated releases via release-please and a `version.txt` source of
+  truth. This is the first tracked release.
 
-## [1.0.0] - 2021-06-20
-
-### Added
+## [0.1.0] - 2026-06-02
 
-- Inititated y [@your_username](https://github.com/your_username)
-- Inititated z [@your_username](https://github.com/your_username)
+Baseline release. Establishes versioning and the automated release flow for the
+existing toolkit (`install`, `doctor`, `scan`, `scan-skill`, `harden`, `agent`,
+`mcp`, `audit`, `enforce`, `reminders`, `startup`).

README.md

@@ -24,7 +24,7 @@ pwsh ./seckit.ps1           # Windows
 | **install**   | Installs every missing scanner and client via brew/npm/pipx/scoop. Run this once on a fresh machine.                                                           |
 | **scan**      | Sweeps a folder of repos for vulnerable dependencies, code/IaC flaws, malware and secrets. Pick all scanners or a subset (osv, gitleaks, trufflehog, semgrep, checkov, socket). |
 | **scan-skill** | Statically vets an AI agent skill or MCP server (directory, `.zip` or git URL) before you install it: prompt-injection, data exfiltration, credential theft, supply-chain RCE, obfuscation, over-broad agency and MCP tool poisoning. Never executes the target; prints a 0-100 risk verdict and a markdown report. |
-| **harden**    | Drops pre-commit, gitleaks, SECURITY.md, CODEOWNERS, dependabot, CodeQL and PR templates into a repo so the next commit is clean.                              |
+| **harden**    | Drops pre-commit, gitleaks, SECURITY.md, CODEOWNERS, dependabot, CodeQL and PR templates into a repo so the next commit is clean. On Node repos it also sets `ignore-scripts=true` in `.npmrc` to block install-time supply-chain worms (see below). |
 | **agent**     | Installs the SecKit prompt as a Claude subagent, Copilot chat mode, Cursor rule or `AGENTS.md` section so any AI assistant runs the same playbook.             |
 | **mcp**       | Wires the official MCP servers (Semgrep, Snyk, OSV, Trivy, Scorecard, GitHub, ADO, Atlassian, Microsoft Learn, Terraform, Foundry) into Claude/Copilot/Cursor. |
 | **audit**     | Read-only posture check against a GitHub org/repo or Azure DevOps project/repo. Safe to run anywhere because every call is a `GET`.                            |
@@ -40,5 +40,31 @@ Drop-in pipelines that run the same flow on every push: `seckit install` provisi
 
 Both are soft-fail by default (findings produce a warning plus the report artifact, not a red build); flip the gate step to `exit 1` / remove `continueOnError` to block merges on findings.
 
-More: [`docs/`](docs/) · [`CONTRIBUTING.md`](CONTRIBUTING.md) · [`LICENSE`](LICENSE)
+## Blocking npm install-script worms
+
+Self-propagating npm worms (for example the May 2026 `redhat-cloud-services` worm that hit 90+ packages) run their payload from a package's `preinstall`/`install`/`postinstall` hook **during `npm install`, before any of your own code runs**. A scanner only helps if it runs before install, and only catches what it has catalogued; by the time a brand-new variant has an advisory, the hook has already executed and exfiltrated your npm/GitHub/cloud/SSH tokens.
+
+`seckit harden` closes the vector at the source on any repo with a `package.json`: it appends `ignore-scripts=true` to `.npmrc`, so no dependency lifecycle script executes on install. This holds even for a variant no scanner knows about yet.
+
+**The trade-off, handled.** A few legitimate deps build native code in those hooks (`esbuild`, `sharp`, `bcrypt`, ...), and your own root `postinstall`/`prepare` (husky, prisma) is skipped too. `harden` does not leave you to discover this the hard way: it scans `node_modules` and prints the exact deps in your repo that build via install scripts, and the generated `.npmrc` documents how to allowlist them rather than disabling the protection:
+
+```bash
+npx --yes @lavamoat/allow-scripts auto   # write a vetted allowlist into package.json
+npx --yes @lavamoat/allow-scripts        # run ONLY allowlisted scripts, after install
+# or, dependency-free, for a single vetted native dep:
+npm rebuild <pkg> --ignore-scripts=false
+```
+
+A hardened install flow then looks like `npm ci && npx --yes @lavamoat/allow-scripts && npm run prepare`.
+
+## Releases
+
+Releases are automated with [release-please](https://github.com/googleapis/release-please), driven by [Conventional Commits](https://www.conventionalcommits.org/) on `main`:
+
+- Push a `feat:`/`fix:` commit to `main`. The [`release`](.github/workflows/release.yml) workflow opens (or updates) a **release PR** that bumps `version.txt` + `.release-please-manifest.json` and rewrites `CHANGELOG.md` from your commits.
+- Merge that PR. release-please tags the commit `vX.Y.Z` and publishes a GitHub Release.
+
+Pre-1.0, `feat:` bumps the minor and `fix:` bumps the patch (configured in [`release-please-config.json`](release-please-config.json)). `seckit version` prints the current version. One-time repo setting: **Settings > Actions > General > "Allow GitHub Actions to create and approve pull requests"** must be enabled so the release PR can be opened with the default token.
+
+More: [`docs/`](docs/) · [`CONTRIBUTING.md`](CONTRIBUTING.md) · [`CHANGELOG.md`](CHANGELOG.md) · [`LICENSE`](LICENSE)
 

release-please-config.json

@@ -0,0 +1,20 @@
+{
+  "$schema": "https://raw.githubusercontent.com/googleapis/release-please/main/schemas/config.json",
+  "bump-minor-pre-major": true,
+  "bump-patch-for-minor-pre-major": true,
+  "include-component-in-tag": false,
+  "changelog-sections": [
+    { "type": "feat", "section": "Added" },
+    { "type": "fix", "section": "Fixed" },
+    { "type": "perf", "section": "Performance" },
+    { "type": "refactor", "section": "Changed" },
+    { "type": "docs", "section": "Documentation" },
+    { "type": "chore", "section": "Miscellaneous", "hidden": true }
+  ],
+  "packages": {
+    ".": {
+      "release-type": "simple",
+      "package-name": "seckit"
+    }
+  }
+}

seckit.sh

@@ -14,6 +14,7 @@
 #   seckit enforce <p> <s> write the missing settings (dry-run by default)
 #   seckit reminders    print all security reminders
 #   seckit startup      animated banner + one rotating reminder + tool health
+#   seckit version      print the installed SecKit version
 #   seckit help         this help
 #
 # Run it before you start work in any repo. Reminders live in reminders.txt.
@@ -22,6 +23,9 @@ set -uo pipefail
 
 HERE="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 
+# Single source of truth, maintained by release-please (see version.txt).
+SECKIT_VERSION="$(cat "$HERE/version.txt" 2>/dev/null || echo dev)"
+
 # Optional animated banner (defines banner(); does not auto-play here because
 # this script runs non-interactively).
 [[ -f "$HERE/banner.sh" ]] && source "$HERE/banner.sh"
@@ -230,7 +234,7 @@ print_status() {
   fi
 }
 
-cmd_help() { sed -n '3,20p' "${BASH_SOURCE[0]}" | sed 's/^# \{0,1\}//'; }
+cmd_help() { sed -n '3,21p' "${BASH_SOURCE[0]}" | sed 's/^# \{0,1\}//'; }
 
 # Interactive menu: shown when seckit is run with no arguments on a terminal.
 cmd_menu() {
@@ -378,6 +382,39 @@ _h_block() {  # append SecKit block to dest if marker not already present
   echo "  ${GRN}block ->${RST} ${dest#$root/}"
 }
 
+# Node repos: append ignore-scripts=true to .npmrc, then make the catch concrete
+# by listing the installed deps that actually declare a build hook (so they get
+# allowlisted, not used as an excuse to disable the protection).
+_h_npm_hardening() {
+  [[ -f "$root/package.json" ]] || return 0   # Node projects only
+  local rc="$root/.npmrc"
+  if [[ -f "$rc" ]] && grep -q 'ignore-scripts' "$rc" 2>/dev/null; then
+    echo "  ${DIM}ok (already set): .npmrc ignore-scripts${RST}"
+  else
+    [[ -f "$rc" ]] && printf '\n' >> "$rc"
+    cat "$TPL/repo/npmrc-hardened" >> "$rc"
+    echo "  ${GRN}block ->${RST} .npmrc ${DIM}(ignore-scripts=true)${RST}"
+  fi
+  # The catch, surfaced for THIS repo: which installed deps build via a hook?
+  if [[ -d "$root/node_modules" ]] && have jq; then
+    local hooked
+    hooked="$(find "$root/node_modules" -maxdepth 3 -name package.json -print0 2>/dev/null \
+      | xargs -0 jq -r 'select(.scripts.preinstall or .scripts.install or .scripts.postinstall) | .name // empty' 2>/dev/null \
+      | sort -u)"
+    if [[ -n "$hooked" ]]; then
+      local n; n="$(printf '%s\n' "$hooked" | grep -c .)"
+      echo "  ${YEL}heads-up${RST} ${n} installed dep(s) build via install scripts and will NOT run with ignore-scripts on:"
+      printf '%s\n' "$hooked" | sed 's/^/      /'
+      echo "  ${DIM}allowlist: npx --yes @lavamoat/allow-scripts auto && npx --yes @lavamoat/allow-scripts${RST}"
+      echo "  ${DIM}or one-off: npm rebuild <pkg> --ignore-scripts=false${RST}"
+    else
+      echo "  ${DIM}ok: no installed dep declares an install script - nothing to allowlist${RST}"
+    fi
+  else
+    echo "  ${DIM}tip: after 'npm ci --ignore-scripts', re-run to list deps that need a build (needs jq + node_modules)${RST}"
+  fi
+}
+
 # Confirm before writing (skipped with --yes, or when non-interactive).
 _h_confirm() {
   (( yes )) && return 0
@@ -471,6 +508,7 @@ cmd_harden() {
   echo "  .github/copilot-instructions.md         ${DIM}agent instructions${RST}"
   echo "  .github/copilot-content-exclusion.yml   ${DIM}paste into GitHub${RST}"
   echo "  .pre-commit-config.yaml, .gitleaks.toml ${DIM}gitleaks gate${RST}"
+  echo "  .npmrc                                  ${DIM}ignore-scripts (Node repos)${RST}"
   echo "  SECURITY.md, CODEOWNERS                 ${DIM}repo hygiene${RST}"
   echo "  .github/pull_request_template.md        ${DIM}PR checklist${RST}"
   echo "  .github/dependabot.yml                  ${DIM}dependency updates${RST}"
@@ -496,6 +534,8 @@ cmd_harden() {
   # gitleaks pre-commit gate (blocks any secret before it commits).
   _h_put "$root/.pre-commit-config.yaml" "$TPL/pre-commit-config.yaml"
   _h_put "$root/.gitleaks.toml"          "$TPL/gitleaks.toml"
+  # Block install-time script execution on Node repos + surface the build-script catch.
+  _h_npm_hardening
   # Repo hygiene + PR/CODEOWNERS + dependabot + codeql + ADO PR template.
   _h_put "$root/SECURITY.md"                              "$TPL/repo/SECURITY.md"
   _h_put "$root/CODEOWNERS"                               "$TPL/repo/CODEOWNERS"
@@ -642,6 +682,7 @@ case "$cmd" in
   enforce)          exec bash "$HERE/enforce.sh" "$@" ;;
   reminders|tips)   cmd_reminders ;;
   startup|hello)    cmd_startup ;;
+  version|--version|-v) echo "seckit $SECKIT_VERSION" ;;
   help|-h|--help)   cmd_help ;;
   *) echo "Unknown command: $cmd" >&2; cmd_help; exit 2 ;;
 esac

templates/repo/npmrc-hardened

@@ -0,0 +1,24 @@
+# --- SecKit: block install-time script execution ---------------------------
+# Supply-chain worms (e.g. the redhat-cloud-services npm worm, May 2026) run
+# their payload from a package's preinstall / install / postinstall hook during
+# `npm install`, BEFORE any of your own code runs. This setting stops every
+# lifecycle script from executing on install, which neutralises that vector
+# even for a brand-new variant no scanner has catalogued yet.
+#
+# THE CATCH: a few legitimate deps compile native code in these hooks
+# (esbuild, sharp, bcrypt, better-sqlite3, node-gyp builds, ...). With this on
+# they will NOT build, and your OWN root postinstall/prepare (husky, prisma
+# generate) is skipped too. Do NOT turn this back off to fix that. Allowlist
+# the specific packages you trust instead:
+#
+#   npx --yes @lavamoat/allow-scripts auto   # write an allowlist into package.json
+#   npx --yes @lavamoat/allow-scripts        # run ONLY allowlisted scripts, post-install
+#
+# Dependency-free alternative for one vetted native dep:
+#   npm rebuild <pkg> --ignore-scripts=false
+#
+# For your own root scripts, run them explicitly in your setup/CI step:
+#   npm ci && npx --yes @lavamoat/allow-scripts && npm run prepare
+#
+# Vet anything new with `seckit scan` / `socket` BEFORE adding it.
+ignore-scripts=true

version.txt

@@ -0,0 +1 @@
+0.1.0