4 releases 18 tags

RSS feed

• 0.143.0 481f5f01dd

  Compare

  0.143.0 Stable

  damian-buho released this 2026-10-12 03:13:18 +00:00 | 13 commits to main since this release

  Signed by damian-buho

  GPG key ID: 87B15EAD49FD22AB

  5 commits, 1 contributor, 1 day since 0.142.0.

  Features

  • publish to npm as spiderlint with provenance (16a5b4d)
  • npm: publish for linux and darwin on amd64 and arm64 from the GitHub repository (94d14a6)

  Bug fixes

  • crawl: send client hints with every crawled page request (c329975)

  Installation

  Container image

  Pull the published container image:

  Pull from DockerHub — linux/amd64

  docker pull damianbuho/spiderlint:0.143.0
  alias spiderlint='docker run --rm --user "$(id -u):$(id -g)" --group-add 0 --volume "$PWD:/app/ws" --workdir /app/ws damianbuho/spiderlint:0.143.0 spiderlint'
  

  This release also publishes the 0.143 and 0 tags — pull the precision you want to pin.

  If the registries above are unreachable, pull from the origin instead:

  Pull from Kiota — linux/amd64

  docker pull kiota.ch/damian-buho/spiderlint:0.143.0
  alias spiderlint='docker run --rm --user "$(id -u):$(id -g)" --group-add 0 --volume "$PWD:/app/ws" --workdir /app/ws kiota.ch/damian-buho/spiderlint:0.143.0 spiderlint'
  

  Then run it as if it were installed — the alias runs every example as written against the current directory:

  spiderlint --help
  

  npm package

  Install the command globally:

  npm install --global spiderlint
  

  Needs Node.js >=26.

  Usage

  Run it as a step in a GitHub Actions workflow:

  - uses: damian-buho/spiderlint@0.143.0
  

  The action takes these inputs:

  Input	Default	Description
  urls		Newline-separated seed URLs. Empty takes the targets from the config file.
  config_file		Projectfile or plain YAML carrying the org.spiderlint subtree, relative to the workspace.
  site		One org.spiderlint.sites name to audit; a config declaring several needs one step per site.
  rules		Comma-separated rulesets replacing every group’s rules (e.g. recommended,axe).
  args		More audit flags, one per line with its value after a space (e.g. --max-pages 200).
  fail_on	error	Severity that fails the job: error | warning | info | never
  upload_sarif	false	Upload the SARIF report to code scanning; needs the security-events: write permission.
  cache	true	Keep the crawl store in the forge cache, so an unchanged site is re-audited with 304s.
  version		Image tag to pull (e.g. latest, 1.2.3). Empty follows the action’s own version tag, else latest.
  image		Full image reference. Takes precedence over version.

  spiderlint

  $ spiderlint --help
  spiderlint
  Site-wide linter for SEO tags, security headers, TLS and links
  https://dbuho.me/project/spiderlint/
  
  Usage: spiderlint <command> [domain…] [options]
  A domain is example.com or a URL to start from; without a scheme, https:// is
  assumed.
  
  Check a site:
    audit [domain…]                 crawl a site, then lint it
    crawl [domain…]                 fetch pages into the store, lint nothing
    lint [domain…]                  lint the stored pages, with no network
    show-report [domain…]           print the stored report again, in any format
  
  Inspect:
    show-facts <url>                fetch one page and print its facts
    export-facts [domain…]          print every stored page’s facts, no network
    list-groups [domain…]           count the pages in each URL group
  
  Rules:
    list-rules [ruleset|id…]        list rules at the severity this config gives
    list-presets                    list the shipped rulesets and their groups
    explain-rule <rule>             show a rule’s facts, expectation and fix
  
  Cache:
    show-cache [domain…]            show the entries, bytes and age of each bucket
    purge-cache [bucket] [domain…]  delete a site’s cached entries
    warm-cache [domain…]            fetch robots.txt and sitemaps without crawling
  
  Commands:
    help [command]                  show a command’s options and examples
  
  Options:
    --config <path>                 settings file
                                    (default: projectfile.yaml)
                                    (env: SPIDERLINT_CONFIG)
    --site <names>                  only these org.spiderlint.sites, repeatable
                                    (default: all)
    --[no-]color                    force or disable color
                                    (default: auto, env: NO_COLOR, FORCE_COLOR)
    --[no-]progress                 status line on an interactive stderr
                                    (default: auto)
    --log-level <level>             trace, debug, info, warn, error or silent
                                    (default: warn, env: SPIDERLINT_LOG_LEVEL)
    -V, --version                   show the version
    -h, --help                      show this screen, or a command’s
  
  Run spiderlint <command> --help for a command’s options and examples.
  
  Exit codes:
    0  clean
    1  findings at or above --fail-on
    2  usage or config error
    3  nothing fetched, or an --offline cache miss
    4  the run failed
  

  Examples and every command’s help are in Usage.

  Image digests

  A tag can move; a digest cannot. Pull this exact build:

  docker pull docker.io/damianbuho/spiderlint@sha256:d6894b946c0ee6acd603cb46fcc11cb92fecda82e58907f6b344f9c83d42011c
  docker pull kiota.ch/damian-buho/spiderlint@sha256:d6894b946c0ee6acd603cb46fcc11cb92fecda82e58907f6b344f9c83d42011c
  

  Platform	Digest	Size
  linux/amd64	sha256:cfb8615fa481398574a775c0458397115d58496101dad82f112c2951c6ac0325	389.4 MB

  Sizes are compressed layer bytes as stored in the registry.

  Verify

  Check that what you downloaded is what this project published.

  Container image

  The signature proves this project’s CI built and pushed the image; the attestation carries its software bill of materials.

  COSIGN_KEY=https://kiota.ch/damian-buho/metadata/raw/branch/main/keys/ci-cosign-key.pub
  cosign verify --key "$COSIGN_KEY" --insecure-ignore-tlog=true docker.io/damianbuho/spiderlint@sha256:d6894b946c0ee6acd603cb46fcc11cb92fecda82e58907f6b344f9c83d42011c
  cosign verify --key "$COSIGN_KEY" --insecure-ignore-tlog=true kiota.ch/damian-buho/spiderlint@sha256:d6894b946c0ee6acd603cb46fcc11cb92fecda82e58907f6b344f9c83d42011c
  cosign verify-attestation --key "$COSIGN_KEY" --insecure-ignore-tlog=true --type cyclonedx docker.io/damianbuho/spiderlint@sha256:d6894b946c0ee6acd603cb46fcc11cb92fecda82e58907f6b344f9c83d42011c
  cosign verify-attestation --key "$COSIGN_KEY" --insecure-ignore-tlog=true --type cyclonedx kiota.ch/damian-buho/spiderlint@sha256:d6894b946c0ee6acd603cb46fcc11cb92fecda82e58907f6b344f9c83d42011c
  

  Full changes: https://kiota.ch/damian-buho/spiderlint/compare/0.142.0...0.143.0

  Downloads

  • Source code (ZIP)
    0 downloads
  • Source code (TAR.GZ)
    0 downloads