4 releases 18 tags

RSS feed

• 0.143.1 27e1e95b38

  Compare

  0.143.1 Stable

  damian-buho released this 2026-10-12 11:21:23 +00:00 | 8 commits to main since this release

  Signed by damian-buho

  GPG key ID: 87B15EAD49FD22AB

  4 commits, 1 contributor, 8 hours since 0.143.0.

  Bug fixes

  • action: list as Spiderlint Site Audit on the Marketplace (6d36b04)
  • lint: adopt unicorn 77 recommended set (667f8d7)
  • version: realign package manifests with the projectfile (4885a71)

  Installation

  Container image

  Pull the published container image:

  Pull from DockerHub — linux/amd64

  docker pull damianbuho/spiderlint:0.143.1
  alias spiderlint='docker run --rm --user "$(id -u):$(id -g)" --group-add 0 --volume "$PWD:/app/ws" --workdir /app/ws damianbuho/spiderlint:0.143.1 spiderlint'
  

  This release also publishes the 0.143 and 0 tags — pull the precision you want to pin.

  If the registries above are unreachable, pull from the origin instead:

  Pull from Kiota — linux/amd64

  docker pull kiota.ch/damian-buho/spiderlint:0.143.1
  alias spiderlint='docker run --rm --user "$(id -u):$(id -g)" --group-add 0 --volume "$PWD:/app/ws" --workdir /app/ws kiota.ch/damian-buho/spiderlint:0.143.1 spiderlint'
  

  Then run it as if it were installed — the alias runs every example as written against the current directory:

  spiderlint --help
  

  npm package

  Install the command globally:

  npm install --global spiderlint
  

  Needs Node.js >=26.

  Usage

  Run it as a step in a GitHub Actions workflow:

  - uses: damian-buho/spiderlint@0.143.1
  

  The action takes these inputs:

  Input	Default	Description
  urls		Newline-separated seed URLs. Empty takes the targets from the config file.
  config_file		Projectfile or plain YAML carrying the org.spiderlint subtree, relative to the workspace.
  site		One org.spiderlint.sites name to audit; a config declaring several needs one step per site.
  rules		Comma-separated rulesets replacing every group’s rules (e.g. recommended,axe).
  args		More audit flags, one per line with its value after a space (e.g. --max-pages 200).
  fail_on	error	Severity that fails the job: error | warning | info | never
  upload_sarif	false	Upload the SARIF report to code scanning; needs the security-events: write permission.
  cache	true	Keep the crawl store in the forge cache, so an unchanged site is re-audited with 304s.
  version		Image tag to pull (e.g. latest, 1.2.3). Empty follows the action’s own version tag, else latest.
  image		Full image reference. Takes precedence over version.

  spiderlint

  $ spiderlint --help
  spiderlint
  Site-wide linter for SEO tags, security headers, TLS and links
  https://dbuho.me/project/spiderlint/
  
  Usage: spiderlint <command> [domain…] [options]
  A domain is example.com or a URL to start from; without a scheme, https:// is
  assumed.
  
  Check a site:
    audit [domain…]                 crawl a site, then lint it
    crawl [domain…]                 fetch pages into the store, lint nothing
    lint [domain…]                  lint the stored pages, with no network
    show-report [domain…]           print the stored report again, in any format
  
  Inspect:
    show-facts <url>                fetch one page and print its facts
    export-facts [domain…]          print every stored page’s facts, no network
    list-groups [domain…]           count the pages in each URL group
  
  Rules:
    list-rules [ruleset|id…]        list rules at the severity this config gives
    list-presets                    list the shipped rulesets and their groups
    explain-rule <rule>             show a rule’s facts, expectation and fix
  
  Cache:
    show-cache [domain…]            show the entries, bytes and age of each bucket
    purge-cache [bucket] [domain…]  delete a site’s cached entries
    warm-cache [domain…]            fetch robots.txt and sitemaps without crawling
  
  Commands:
    help [command]                  show a command’s options and examples
  
  Options:
    --config <path>                 settings file
                                    (default: projectfile.yaml)
                                    (env: SPIDERLINT_CONFIG)
    --site <names>                  only these org.spiderlint.sites, repeatable
                                    (default: all)
    --[no-]color                    force or disable color
                                    (default: auto, env: NO_COLOR, FORCE_COLOR)
    --[no-]progress                 status line on an interactive stderr
                                    (default: auto)
    --log-level <level>             trace, debug, info, warn, error or silent
                                    (default: warn, env: SPIDERLINT_LOG_LEVEL)
    -V, --version                   show the version
    -h, --help                      show this screen, or a command’s
  
  Run spiderlint <command> --help for a command’s options and examples.
  
  Exit codes:
    0  clean
    1  findings at or above --fail-on
    2  usage or config error
    3  nothing fetched, or an --offline cache miss
    4  the run failed
  

  Examples and every command’s help are in Usage.

  Image digests

  A tag can move; a digest cannot. Pull this exact build:

  docker pull docker.io/damianbuho/spiderlint@sha256:e7bb832f7c01d26beb8e58c73f1b983a019f5a81c07d27c7bceff8ae0486065f
  docker pull kiota.ch/damian-buho/spiderlint@sha256:e7bb832f7c01d26beb8e58c73f1b983a019f5a81c07d27c7bceff8ae0486065f
  

  Platform	Digest	Size
  linux/amd64	sha256:07dc8f880918d33e6e5e64d12531821f7e0acdfdc90f1df9694f0755365592be	389.4 MB

  Sizes are compressed layer bytes as stored in the registry.

  Verify

  Check that what you downloaded is what this project published.

  Container image

  The signature proves this project’s CI built and pushed the image; the attestation carries its software bill of materials.

  COSIGN_KEY=https://kiota.ch/damian-buho/metadata/raw/branch/main/keys/ci-cosign-key.pub
  cosign verify --key "$COSIGN_KEY" --insecure-ignore-tlog=true docker.io/damianbuho/spiderlint@sha256:e7bb832f7c01d26beb8e58c73f1b983a019f5a81c07d27c7bceff8ae0486065f
  cosign verify --key "$COSIGN_KEY" --insecure-ignore-tlog=true kiota.ch/damian-buho/spiderlint@sha256:e7bb832f7c01d26beb8e58c73f1b983a019f5a81c07d27c7bceff8ae0486065f
  cosign verify-attestation --key "$COSIGN_KEY" --insecure-ignore-tlog=true --type cyclonedx docker.io/damianbuho/spiderlint@sha256:e7bb832f7c01d26beb8e58c73f1b983a019f5a81c07d27c7bceff8ae0486065f
  cosign verify-attestation --key "$COSIGN_KEY" --insecure-ignore-tlog=true --type cyclonedx kiota.ch/damian-buho/spiderlint@sha256:e7bb832f7c01d26beb8e58c73f1b983a019f5a81c07d27c7bceff8ae0486065f
  

  Full changes: https://kiota.ch/damian-buho/spiderlint/compare/0.143.0...0.143.1

  Downloads

  • Source code (ZIP)
    0 downloads
  • Source code (TAR.GZ)
    0 downloads
• 0.143.0 481f5f01dd

  Compare

  0.143.0 Stable

  damian-buho released this 2026-10-12 03:13:18 +00:00 | 13 commits to main since this release

  Signed by damian-buho

  GPG key ID: 87B15EAD49FD22AB

  5 commits, 1 contributor, 1 day since 0.142.0.

  Features

  • publish to npm as spiderlint with provenance (16a5b4d)
  • npm: publish for linux and darwin on amd64 and arm64 from the GitHub repository (94d14a6)

  Bug fixes

  • crawl: send client hints with every crawled page request (c329975)

  Installation

  Container image

  Pull the published container image:

  Pull from DockerHub — linux/amd64

  docker pull damianbuho/spiderlint:0.143.0
  alias spiderlint='docker run --rm --user "$(id -u):$(id -g)" --group-add 0 --volume "$PWD:/app/ws" --workdir /app/ws damianbuho/spiderlint:0.143.0 spiderlint'
  

  This release also publishes the 0.143 and 0 tags — pull the precision you want to pin.

  If the registries above are unreachable, pull from the origin instead:

  Pull from Kiota — linux/amd64

  docker pull kiota.ch/damian-buho/spiderlint:0.143.0
  alias spiderlint='docker run --rm --user "$(id -u):$(id -g)" --group-add 0 --volume "$PWD:/app/ws" --workdir /app/ws kiota.ch/damian-buho/spiderlint:0.143.0 spiderlint'
  

  Then run it as if it were installed — the alias runs every example as written against the current directory:

  spiderlint --help
  

  npm package

  Install the command globally:

  npm install --global spiderlint
  

  Needs Node.js >=26.

  Usage

  Run it as a step in a GitHub Actions workflow:

  - uses: damian-buho/spiderlint@0.143.0
  

  The action takes these inputs:

  Input	Default	Description
  urls		Newline-separated seed URLs. Empty takes the targets from the config file.
  config_file		Projectfile or plain YAML carrying the org.spiderlint subtree, relative to the workspace.
  site		One org.spiderlint.sites name to audit; a config declaring several needs one step per site.
  rules		Comma-separated rulesets replacing every group’s rules (e.g. recommended,axe).
  args		More audit flags, one per line with its value after a space (e.g. --max-pages 200).
  fail_on	error	Severity that fails the job: error | warning | info | never
  upload_sarif	false	Upload the SARIF report to code scanning; needs the security-events: write permission.
  cache	true	Keep the crawl store in the forge cache, so an unchanged site is re-audited with 304s.
  version		Image tag to pull (e.g. latest, 1.2.3). Empty follows the action’s own version tag, else latest.
  image		Full image reference. Takes precedence over version.

  spiderlint

  $ spiderlint --help
  spiderlint
  Site-wide linter for SEO tags, security headers, TLS and links
  https://dbuho.me/project/spiderlint/
  
  Usage: spiderlint <command> [domain…] [options]
  A domain is example.com or a URL to start from; without a scheme, https:// is
  assumed.
  
  Check a site:
    audit [domain…]                 crawl a site, then lint it
    crawl [domain…]                 fetch pages into the store, lint nothing
    lint [domain…]                  lint the stored pages, with no network
    show-report [domain…]           print the stored report again, in any format
  
  Inspect:
    show-facts <url>                fetch one page and print its facts
    export-facts [domain…]          print every stored page’s facts, no network
    list-groups [domain…]           count the pages in each URL group
  
  Rules:
    list-rules [ruleset|id…]        list rules at the severity this config gives
    list-presets                    list the shipped rulesets and their groups
    explain-rule <rule>             show a rule’s facts, expectation and fix
  
  Cache:
    show-cache [domain…]            show the entries, bytes and age of each bucket
    purge-cache [bucket] [domain…]  delete a site’s cached entries
    warm-cache [domain…]            fetch robots.txt and sitemaps without crawling
  
  Commands:
    help [command]                  show a command’s options and examples
  
  Options:
    --config <path>                 settings file
                                    (default: projectfile.yaml)
                                    (env: SPIDERLINT_CONFIG)
    --site <names>                  only these org.spiderlint.sites, repeatable
                                    (default: all)
    --[no-]color                    force or disable color
                                    (default: auto, env: NO_COLOR, FORCE_COLOR)
    --[no-]progress                 status line on an interactive stderr
                                    (default: auto)
    --log-level <level>             trace, debug, info, warn, error or silent
                                    (default: warn, env: SPIDERLINT_LOG_LEVEL)
    -V, --version                   show the version
    -h, --help                      show this screen, or a command’s
  
  Run spiderlint <command> --help for a command’s options and examples.
  
  Exit codes:
    0  clean
    1  findings at or above --fail-on
    2  usage or config error
    3  nothing fetched, or an --offline cache miss
    4  the run failed
  

  Examples and every command’s help are in Usage.

  Image digests

  A tag can move; a digest cannot. Pull this exact build:

  docker pull docker.io/damianbuho/spiderlint@sha256:d6894b946c0ee6acd603cb46fcc11cb92fecda82e58907f6b344f9c83d42011c
  docker pull kiota.ch/damian-buho/spiderlint@sha256:d6894b946c0ee6acd603cb46fcc11cb92fecda82e58907f6b344f9c83d42011c
  

  Platform	Digest	Size
  linux/amd64	sha256:cfb8615fa481398574a775c0458397115d58496101dad82f112c2951c6ac0325	389.4 MB

  Sizes are compressed layer bytes as stored in the registry.

  Verify

  Check that what you downloaded is what this project published.

  Container image

  The signature proves this project’s CI built and pushed the image; the attestation carries its software bill of materials.

  COSIGN_KEY=https://kiota.ch/damian-buho/metadata/raw/branch/main/keys/ci-cosign-key.pub
  cosign verify --key "$COSIGN_KEY" --insecure-ignore-tlog=true docker.io/damianbuho/spiderlint@sha256:d6894b946c0ee6acd603cb46fcc11cb92fecda82e58907f6b344f9c83d42011c
  cosign verify --key "$COSIGN_KEY" --insecure-ignore-tlog=true kiota.ch/damian-buho/spiderlint@sha256:d6894b946c0ee6acd603cb46fcc11cb92fecda82e58907f6b344f9c83d42011c
  cosign verify-attestation --key "$COSIGN_KEY" --insecure-ignore-tlog=true --type cyclonedx docker.io/damianbuho/spiderlint@sha256:d6894b946c0ee6acd603cb46fcc11cb92fecda82e58907f6b344f9c83d42011c
  cosign verify-attestation --key "$COSIGN_KEY" --insecure-ignore-tlog=true --type cyclonedx kiota.ch/damian-buho/spiderlint@sha256:d6894b946c0ee6acd603cb46fcc11cb92fecda82e58907f6b344f9c83d42011c
  

  Full changes: https://kiota.ch/damian-buho/spiderlint/compare/0.142.0...0.143.0

  Downloads

  • Source code (ZIP)
    0 downloads
  • Source code (TAR.GZ)
    0 downloads
• 0.142.0 7db29d1154

  Compare

  0.142.0 Stable

  damian-buho released this 2026-10-11 01:57:55 +00:00 | 19 commits to main since this release

  Signed by damian-buho

  GPG key ID: 87B15EAD49FD22AB

  46 commits, 1 contributor, 1 day since 0.141.0.

  Features

  • tls-probe: download Cloudflare's ranges into a 7-day lists bucket (7c9029c)
  • stack: detect the services an origin runs on (bce0c46)
  • name the web instance in the user agent and send client hints (223fd4d)

  Bug fixes

  • tls-probe: anchor a cross-signed root by its own key in the store (dc5432a)
  • rules: show an exact-value miss as the value, not its length (5e972d7)
  • feeds: accept a label before an item title that matches its page (cbb278a)
  • tls-probe: skip the suite rules on a Cloudflare edge (5484744)
  • tls-probe: skip the cipher and attack rules on a Cloudflare edge (d467669)
  • deps: bump @types/node 26.6.5 (0ff119a)
  • deps: bump smol-toml 1.9.1 (e3089e5)
  • deps: bump bullmq 6.3.12 (dd7ec91)
  • crawl: keep Crawlee’s global storage in memory, rooted in the XDG state directory (47031c3)
  • cli: shorten the --via help so it wraps without an orphan line (3d2d80f)
  • scripts: spell the pf-cli file flag --file (a3c75f9)
  • compose: keep the server config out of the compose file glob (20632a9)
  • deps: bump structured-headers 2.1.1 (d9c6a51)
  • deps: bump prettier 3.9.10 (08fbfcf)
  • read the projectfile subtree through pf-cli --file (4eeedfc)

  Installation

  Pull the published container image:

  Pull from DockerHub — linux/amd64

  docker pull damianbuho/spiderlint:0.142.0
  alias spiderlint='docker run --rm --user "$(id -u):$(id -g)" --group-add 0 --volume "$PWD:/app/ws" --workdir /app/ws damianbuho/spiderlint:0.142.0 spiderlint'
  

  This release also publishes the 0.142 and 0 tags — pull the precision you want to pin.

  If the registries above are unreachable, pull from the origin instead:

  Pull from Kiota — linux/amd64

  docker pull kiota.ch/damian-buho/spiderlint:0.142.0
  alias spiderlint='docker run --rm --user "$(id -u):$(id -g)" --group-add 0 --volume "$PWD:/app/ws" --workdir /app/ws kiota.ch/damian-buho/spiderlint:0.142.0 spiderlint'
  

  Then run it as if it were installed — the alias runs every example as written against the current directory:

  spiderlint --help
  

  Usage

  Run it as a step in a GitHub Actions workflow:

  - uses: damian-buho/spiderlint@0.142.0
  

  The action takes these inputs:

  Input	Default	Description
  urls		Newline-separated seed URLs. Empty takes the targets from the config file.
  config_file		Projectfile or plain YAML carrying the org.spiderlint subtree, relative to the workspace.
  site		One org.spiderlint.sites name to audit; a config declaring several needs one step per site.
  rules		Comma-separated rulesets replacing every group’s rules (e.g. recommended,axe).
  args		More audit flags, one per line with its value after a space (e.g. --max-pages 200).
  fail_on	error	Severity that fails the job: error | warning | info | never
  upload_sarif	false	Upload the SARIF report to code scanning; needs the security-events: write permission.
  cache	true	Keep the crawl store in the forge cache, so an unchanged site is re-audited with 304s.
  version		Image tag to pull (e.g. latest, 1.2.3). Empty follows the action’s own version tag, else latest.
  image		Full image reference. Takes precedence over version.

  spiderlint

  $ spiderlint --help
  spiderlint
  Site-wide linter for SEO tags, security headers, TLS and links
  https://dbuho.me/project/spiderlint/
  
  Usage: spiderlint <command> [domain…] [options]
  A domain is example.com or a URL to start from; without a scheme, https:// is
  assumed.
  
  Check a site:
    audit [domain…]                 crawl a site, then lint it
    crawl [domain…]                 fetch pages into the store, lint nothing
    lint [domain…]                  lint the stored pages, with no network
    show-report [domain…]           print the stored report again, in any format
  
  Inspect:
    show-facts <url>                fetch one page and print its facts
    export-facts [domain…]          print every stored page’s facts, no network
    list-groups [domain…]           count the pages in each URL group
  
  Rules:
    list-rules [ruleset|id…]        list rules at the severity this config gives
    list-presets                    list the shipped rulesets and their groups
    explain-rule <rule>             show a rule’s facts, expectation and fix
  
  Cache:
    show-cache [domain…]            show the entries, bytes and age of each bucket
    purge-cache [bucket] [domain…]  delete a site’s cached entries
    warm-cache [domain…]            fetch robots.txt and sitemaps without crawling
  
  Commands:
    help [command]                  show a command’s options and examples
  
  Options:
    --config <path>                 settings file
                                    (default: projectfile.yaml)
                                    (env: SPIDERLINT_CONFIG)
    --site <names>                  only these org.spiderlint.sites, repeatable
                                    (default: all)
    --[no-]color                    force or disable color
                                    (default: auto, env: NO_COLOR, FORCE_COLOR)
    --[no-]progress                 status line on an interactive stderr
                                    (default: auto)
    --log-level <level>             trace, debug, info, warn, error or silent
                                    (default: warn, env: SPIDERLINT_LOG_LEVEL)
    -V, --version                   show the version
    -h, --help                      show this screen, or a command’s
  
  Run spiderlint <command> --help for a command’s options and examples.
  
  Exit codes:
    0  clean
    1  findings at or above --fail-on
    2  usage or config error
    3  nothing fetched, or an --offline cache miss
    4  the run failed
  

  Examples and every command’s help are in Usage.

  Image digests

  A tag can move; a digest cannot. Pull this exact build:

  docker pull docker.io/damianbuho/spiderlint@sha256:81d93dc7ea1e02aee0a111da14fa224f524e4f105b6f1b5eda4099336bfa5535
  docker pull kiota.ch/damian-buho/spiderlint@sha256:81d93dc7ea1e02aee0a111da14fa224f524e4f105b6f1b5eda4099336bfa5535
  

  Platform	Digest	Size
  linux/amd64	sha256:83936264eb9fdd31efbbd33a34ce59dc266f37b1d00b3244af0fccf6d43b62e2	389.4 MB (−34.9 MB)

  Sizes are compressed layer bytes as stored in the registry.

  Verify

  Check that what you downloaded is what this project published.

  Container image

  The signature proves this project’s CI built and pushed the image; the attestation carries its software bill of materials.

  COSIGN_KEY=https://kiota.ch/damian-buho/metadata/raw/branch/main/keys/ci-cosign-key.pub
  cosign verify --key "$COSIGN_KEY" --insecure-ignore-tlog=true docker.io/damianbuho/spiderlint@sha256:81d93dc7ea1e02aee0a111da14fa224f524e4f105b6f1b5eda4099336bfa5535
  cosign verify --key "$COSIGN_KEY" --insecure-ignore-tlog=true kiota.ch/damian-buho/spiderlint@sha256:81d93dc7ea1e02aee0a111da14fa224f524e4f105b6f1b5eda4099336bfa5535
  cosign verify-attestation --key "$COSIGN_KEY" --insecure-ignore-tlog=true --type cyclonedx docker.io/damianbuho/spiderlint@sha256:81d93dc7ea1e02aee0a111da14fa224f524e4f105b6f1b5eda4099336bfa5535
  cosign verify-attestation --key "$COSIGN_KEY" --insecure-ignore-tlog=true --type cyclonedx kiota.ch/damian-buho/spiderlint@sha256:81d93dc7ea1e02aee0a111da14fa224f524e4f105b6f1b5eda4099336bfa5535
  

  Full changes: https://kiota.ch/damian-buho/spiderlint/compare/0.141.0...0.142.0

  Downloads

  • Source code (ZIP)
    0 downloads
  • Source code (TAR.GZ)
    0 downloads
• 0.141.0 0e48b19f19

  Compare

  0.141.0 Stable

  damian-buho released this 2026-10-09 03:57:35 +00:00 | 66 commits to main since this release

  Signed by damian-buho

  GPG key ID: 87B15EAD49FD22AB

  54 commits, 1 contributor, 3 days since 0.140.0.

  Features

  • well-known: check /auth.md (f7d9483)
  • live: add the info rule live/webmcp (29569a0)
  • dns: name the servers in name server findings (45eea1b)
  • rules: report long-cached files at URLs without a version (3c720f3)
  • fold: report a defect several groups share as one finding (f01ea50)
  • browser: download a missing browser before the crawl (178c722)
  • action: pass any audit flag through the args input (3141f61)
  • server: serve the scan site for an S-tier self-audit (6e3bd4d)
  • server: compress with zstd and brotli beside gzip (03bba39)
  • forge: declare and publish to GitHub (0f2be3e)
  • server: download Chromium once when a worker starts (4662d73)
  • image: download the browser on first use instead of baking it in (bda1585)
  • forge: declare and publish to Codeberg (e922fa0)

  Bug fixes

  • deps: bump @opentelemetry/sdk-trace-node 2.12.0, @opentelemetry/sdk-metrics 2.12.0, @opentelemetry/resources 2.12.0 (07f1f52)
  • deps: bump @opentelemetry/exporter-trace-otlp-http 0.223.0, @opentelemetry/exporter-metrics-otlp-http 0.223.0 (c7a9574)
  • html-validate: accept ids the HTML standard allows (532f2d0)
  • crawl: accept every dns.lookup overload in the swapped lookup (7be87ac)
  • i18n: translate the DNS and auth.md rule messages into es and uk (07e4c8b)
  • rules: declare hint for the agent rules scored below one (02075ee)
  • rules: judge CSP and document headers on documents only (95e51c2)
  • browser: read declarations from the served HTML (7b71b71)
  • feeds: read an XSLT-styled feed as served in browser mode (276b449)
  • deps: bump caniuse-lite 1.0.30001815 (1cfe747)
  • deps: bump tldts 7.4.18 (40f68c9)
  • deps: bump @hono/node-server 2.1.4 (9b4cd37)
  • tls-probe: keep the scan when the early-data check gets no answer (5cb1a07)
  • css: log missing browser targets at info (281eebe)
  • cli: keep every help item description on whole lines at 80 columns (57776d0)
  • action: render SARIF and the summary with show-report (45edf9e)
  • security: suppress advisories in the base image’s bundled npm (b2c5622)
  • security: take npm-bundled GHSA suppressions from the shared fragment (e23fb7d)

  Performance

  • container: declare M6E_VERSION next to the user stage (8e1ebe0)

  Dependencies

  • 1 dependency update

  Installation

  Pull from DockerHub — linux/amd64

  alias spiderlint='docker run --rm --user "$(id -u):$(id -g)" --group-add 0 --volume "$PWD:/app/ws" --workdir /app/ws damianbuho/spiderlint:0.141.0 spiderlint'
  

  If the registries above are unreachable, pull from the origin instead:

  Pull from Kiota — linux/amd64

  docker pull kiota.ch/damian-buho/spiderlint:0.141.0
  alias spiderlint='docker run --rm --user "$(id -u):$(id -g)" --group-add 0 --volume "$PWD:/app/ws" --workdir /app/ws kiota.ch/damian-buho/spiderlint:0.141.0 spiderlint'
  

  Then run it as if it were installed — the alias runs every example as written against the current directory:

  spiderlint --help
  

  Usage

  Run it as a step in a GitHub Actions workflow:

  - uses: damian-buho/spiderlint@0.141.0
  

  The action takes these inputs:

  Input	Default	Description
  urls		Newline-separated seed URLs. Empty takes the targets from the config file.
  config_file		Projectfile or plain YAML carrying the org.spiderlint subtree, relative to the workspace.
  site		One org.spiderlint.sites name to audit; a config declaring several needs one step per site.
  rules		Comma-separated rulesets replacing every group’s rules (e.g. recommended,axe).
  args		More audit flags, one per line with its value after a space (e.g. --max-pages 200).
  fail_on	error	Severity that fails the job: error | warning | info | never
  upload_sarif	false	Upload the SARIF report to code scanning; needs the security-events: write permission.
  cache	true	Keep the crawl store in the forge cache, so an unchanged site is re-audited with 304s.
  version		Image tag to pull (e.g. latest, 1.2.3). Empty follows the action’s own version tag, else latest.
  image		Full image reference. Takes precedence over version.

  spiderlint

  $ spiderlint --help
  spiderlint
  Site-wide linter for SEO tags, security headers, TLS and links
  https://dbuho.me/project/spiderlint/
  
  Usage: spiderlint <command> [domain…] [options]
  A domain is example.com or a URL to start from; without a scheme, https:// is
  assumed.
  
  Check a site:
    audit [domain…]                 crawl a site, then lint it
    crawl [domain…]                 fetch pages into the store, lint nothing
    lint [domain…]                  lint the stored pages, with no network
    show-report [domain…]           print the stored report again, in any format
  
  Inspect:
    show-facts <url>                fetch one page and print its facts
    export-facts [domain…]          print every stored page’s facts, no network
    list-groups [domain…]           count the pages in each URL group
  
  Rules:
    list-rules [ruleset|id…]        list rules at the severity this config gives
    list-presets                    list the shipped rulesets and their groups
    explain-rule <rule>             show a rule’s facts, expectation and fix
  
  Cache:
    show-cache [domain…]            show the entries, bytes and age of each bucket
    purge-cache [bucket] [domain…]  delete a site’s cached entries
    warm-cache [domain…]            fetch robots.txt and sitemaps without crawling
  
  Commands:
    help [command]                  show a command’s options and examples
  
  Options:
    --config <path>                 settings file
                                    (default: projectfile.yaml)
                                    (env: SPIDERLINT_CONFIG)
    --site <names>                  only these org.spiderlint.sites, repeatable
                                    (default: all)
    --[no-]color                    force or disable color
                                    (default: auto, env: NO_COLOR, FORCE_COLOR)
    --[no-]progress                 status line on an interactive stderr
                                    (default: auto)
    --log-level <level>             trace, debug, info, warn, error or silent
                                    (default: warn, env: SPIDERLINT_LOG_LEVEL)
    -V, --version                   show the version
    -h, --help                      show this screen, or a command’s
  
  Run spiderlint <command> --help for a command’s options and examples.
  
  Exit codes:
    0  clean
    1  findings at or above --fail-on
    2  usage or config error
    3  nothing fetched, or an --offline cache miss
    4  the run failed
  

  Examples and every command’s help are in Usage.

  Image digests

  A tag can move; a digest cannot. Pull this exact build:

  docker pull docker.io/damianbuho/spiderlint@sha256:eb4c39c1e8c368abea3506614e2e16d3727fabe306fb93a15cd1b6951754f0d2
  docker pull kiota.ch/damian-buho/spiderlint@sha256:eb4c39c1e8c368abea3506614e2e16d3727fabe306fb93a15cd1b6951754f0d2
  

  Platform	Digest	Size
  linux/amd64	sha256:7ab8f579be995c6a31722fde5060e596d0bf5ee02a8e8c2544698ded995b3b37	424.4 MB

  Sizes are compressed layer bytes as stored in the registry.

  Verify

  Check that what you downloaded is what this project published.

  Container image

  The signature proves this project’s CI built and pushed the image; the attestation carries its software bill of materials.

  COSIGN_KEY=https://kiota.ch/damian-buho/metadata/raw/branch/main/keys/ci-cosign-key.pub
  cosign verify --key "$COSIGN_KEY" --insecure-ignore-tlog=true docker.io/damianbuho/spiderlint@sha256:eb4c39c1e8c368abea3506614e2e16d3727fabe306fb93a15cd1b6951754f0d2
  cosign verify --key "$COSIGN_KEY" --insecure-ignore-tlog=true kiota.ch/damian-buho/spiderlint@sha256:eb4c39c1e8c368abea3506614e2e16d3727fabe306fb93a15cd1b6951754f0d2
  cosign verify-attestation --key "$COSIGN_KEY" --insecure-ignore-tlog=true --type cyclonedx docker.io/damianbuho/spiderlint@sha256:eb4c39c1e8c368abea3506614e2e16d3727fabe306fb93a15cd1b6951754f0d2
  cosign verify-attestation --key "$COSIGN_KEY" --insecure-ignore-tlog=true --type cyclonedx kiota.ch/damian-buho/spiderlint@sha256:eb4c39c1e8c368abea3506614e2e16d3727fabe306fb93a15cd1b6951754f0d2
  

  Downloads

  • Source code (ZIP)
    0 downloads
  • Source code (TAR.GZ)
    0 downloads