4 releases 18 tags

RSS feed

• 0.142.0 7db29d1154

  Compare

  0.142.0 Stable

  damian-buho released this 2026-10-11 01:57:55 +00:00 | 19 commits to main since this release

  Signed by damian-buho

  GPG key ID: 87B15EAD49FD22AB

  46 commits, 1 contributor, 1 day since 0.141.0.

  Features

  • tls-probe: download Cloudflare's ranges into a 7-day lists bucket (7c9029c)
  • stack: detect the services an origin runs on (bce0c46)
  • name the web instance in the user agent and send client hints (223fd4d)

  Bug fixes

  • tls-probe: anchor a cross-signed root by its own key in the store (dc5432a)
  • rules: show an exact-value miss as the value, not its length (5e972d7)
  • feeds: accept a label before an item title that matches its page (cbb278a)
  • tls-probe: skip the suite rules on a Cloudflare edge (5484744)
  • tls-probe: skip the cipher and attack rules on a Cloudflare edge (d467669)
  • deps: bump @types/node 26.6.5 (0ff119a)
  • deps: bump smol-toml 1.9.1 (e3089e5)
  • deps: bump bullmq 6.3.12 (dd7ec91)
  • crawl: keep Crawlee’s global storage in memory, rooted in the XDG state directory (47031c3)
  • cli: shorten the --via help so it wraps without an orphan line (3d2d80f)
  • scripts: spell the pf-cli file flag --file (a3c75f9)
  • compose: keep the server config out of the compose file glob (20632a9)
  • deps: bump structured-headers 2.1.1 (d9c6a51)
  • deps: bump prettier 3.9.10 (08fbfcf)
  • read the projectfile subtree through pf-cli --file (4eeedfc)

  Installation

  Pull the published container image:

  Pull from DockerHub — linux/amd64

  docker pull damianbuho/spiderlint:0.142.0
  alias spiderlint='docker run --rm --user "$(id -u):$(id -g)" --group-add 0 --volume "$PWD:/app/ws" --workdir /app/ws damianbuho/spiderlint:0.142.0 spiderlint'
  

  This release also publishes the 0.142 and 0 tags — pull the precision you want to pin.

  If the registries above are unreachable, pull from the origin instead:

  Pull from Kiota — linux/amd64

  docker pull kiota.ch/damian-buho/spiderlint:0.142.0
  alias spiderlint='docker run --rm --user "$(id -u):$(id -g)" --group-add 0 --volume "$PWD:/app/ws" --workdir /app/ws kiota.ch/damian-buho/spiderlint:0.142.0 spiderlint'
  

  Then run it as if it were installed — the alias runs every example as written against the current directory:

  spiderlint --help
  

  Usage

  Run it as a step in a GitHub Actions workflow:

  - uses: damian-buho/spiderlint@0.142.0
  

  The action takes these inputs:

  Input	Default	Description
  urls		Newline-separated seed URLs. Empty takes the targets from the config file.
  config_file		Projectfile or plain YAML carrying the org.spiderlint subtree, relative to the workspace.
  site		One org.spiderlint.sites name to audit; a config declaring several needs one step per site.
  rules		Comma-separated rulesets replacing every group’s rules (e.g. recommended,axe).
  args		More audit flags, one per line with its value after a space (e.g. --max-pages 200).
  fail_on	error	Severity that fails the job: error | warning | info | never
  upload_sarif	false	Upload the SARIF report to code scanning; needs the security-events: write permission.
  cache	true	Keep the crawl store in the forge cache, so an unchanged site is re-audited with 304s.
  version		Image tag to pull (e.g. latest, 1.2.3). Empty follows the action’s own version tag, else latest.
  image		Full image reference. Takes precedence over version.

  spiderlint

  $ spiderlint --help
  spiderlint
  Site-wide linter for SEO tags, security headers, TLS and links
  https://dbuho.me/project/spiderlint/
  
  Usage: spiderlint <command> [domain…] [options]
  A domain is example.com or a URL to start from; without a scheme, https:// is
  assumed.
  
  Check a site:
    audit [domain…]                 crawl a site, then lint it
    crawl [domain…]                 fetch pages into the store, lint nothing
    lint [domain…]                  lint the stored pages, with no network
    show-report [domain…]           print the stored report again, in any format
  
  Inspect:
    show-facts <url>                fetch one page and print its facts
    export-facts [domain…]          print every stored page’s facts, no network
    list-groups [domain…]           count the pages in each URL group
  
  Rules:
    list-rules [ruleset|id…]        list rules at the severity this config gives
    list-presets                    list the shipped rulesets and their groups
    explain-rule <rule>             show a rule’s facts, expectation and fix
  
  Cache:
    show-cache [domain…]            show the entries, bytes and age of each bucket
    purge-cache [bucket] [domain…]  delete a site’s cached entries
    warm-cache [domain…]            fetch robots.txt and sitemaps without crawling
  
  Commands:
    help [command]                  show a command’s options and examples
  
  Options:
    --config <path>                 settings file
                                    (default: projectfile.yaml)
                                    (env: SPIDERLINT_CONFIG)
    --site <names>                  only these org.spiderlint.sites, repeatable
                                    (default: all)
    --[no-]color                    force or disable color
                                    (default: auto, env: NO_COLOR, FORCE_COLOR)
    --[no-]progress                 status line on an interactive stderr
                                    (default: auto)
    --log-level <level>             trace, debug, info, warn, error or silent
                                    (default: warn, env: SPIDERLINT_LOG_LEVEL)
    -V, --version                   show the version
    -h, --help                      show this screen, or a command’s
  
  Run spiderlint <command> --help for a command’s options and examples.
  
  Exit codes:
    0  clean
    1  findings at or above --fail-on
    2  usage or config error
    3  nothing fetched, or an --offline cache miss
    4  the run failed
  

  Examples and every command’s help are in Usage.

  Image digests

  A tag can move; a digest cannot. Pull this exact build:

  docker pull docker.io/damianbuho/spiderlint@sha256:81d93dc7ea1e02aee0a111da14fa224f524e4f105b6f1b5eda4099336bfa5535
  docker pull kiota.ch/damian-buho/spiderlint@sha256:81d93dc7ea1e02aee0a111da14fa224f524e4f105b6f1b5eda4099336bfa5535
  

  Platform	Digest	Size
  linux/amd64	sha256:83936264eb9fdd31efbbd33a34ce59dc266f37b1d00b3244af0fccf6d43b62e2	389.4 MB (−34.9 MB)

  Sizes are compressed layer bytes as stored in the registry.

  Verify

  Check that what you downloaded is what this project published.

  Container image

  The signature proves this project’s CI built and pushed the image; the attestation carries its software bill of materials.

  COSIGN_KEY=https://kiota.ch/damian-buho/metadata/raw/branch/main/keys/ci-cosign-key.pub
  cosign verify --key "$COSIGN_KEY" --insecure-ignore-tlog=true docker.io/damianbuho/spiderlint@sha256:81d93dc7ea1e02aee0a111da14fa224f524e4f105b6f1b5eda4099336bfa5535
  cosign verify --key "$COSIGN_KEY" --insecure-ignore-tlog=true kiota.ch/damian-buho/spiderlint@sha256:81d93dc7ea1e02aee0a111da14fa224f524e4f105b6f1b5eda4099336bfa5535
  cosign verify-attestation --key "$COSIGN_KEY" --insecure-ignore-tlog=true --type cyclonedx docker.io/damianbuho/spiderlint@sha256:81d93dc7ea1e02aee0a111da14fa224f524e4f105b6f1b5eda4099336bfa5535
  cosign verify-attestation --key "$COSIGN_KEY" --insecure-ignore-tlog=true --type cyclonedx kiota.ch/damian-buho/spiderlint@sha256:81d93dc7ea1e02aee0a111da14fa224f524e4f105b6f1b5eda4099336bfa5535
  

  Full changes: https://kiota.ch/damian-buho/spiderlint/compare/0.141.0...0.142.0

  Downloads

  • Source code (ZIP)
    0 downloads
  • Source code (TAR.GZ)
    0 downloads