CLI and GitHub Actions

Commands run on your machine or CI runner. Published CLI is npx --yes @invince/cli@0.2.3 --help after you publish this version. From this repository:

node packages/cli/bin/invince.js --help

invince scan

Walks a directory with the same deterministic SAST as the product, plus Gitleaks and OSV-Scanner when those binaries are installed.

node packages/cli/bin/invince.js scan . --format json --severity high

Exit 0 only when every scanner finished and there are no findings at or above --severity (default high). Exit 3 if a scanner is missing or failed. A partial scan is never a pass.

JSON goes to stdout. Diagnostics go to stderr. Secret values are not printed.

Scan stays local unless you pass --upload or run invince upload with INVINCE_CLI_TOKEN. That token is created in Project Settings. It is not the SDK ingest key and cannot read events.

invince.config.json holds placeholders only. Credentials go in ~/.config/invince/credentials.json (mode 0600) or CI secrets. Do not pass the token to untrusted fork pull requests.

There is no invince issues command. Reading findings needs a signed-in dashboard session.

invince check

GETs a public URL. Does not call Invince, Gemini, or Groq. Does not upload source.

1. Pass a public http or https URL.
2. 8 second timeout.
3. Exit 0 on HTTP 2xx/3xx, 1 on timeout/network/4xx/5xx, 2 if you used the command wrong.

It is a health ping.

invince verdict

GETs the last Invince public-check JSON (/api/badge/{id}/status). Exit 0 only when that check was Ready and the page was working. fix_first, do_not_launch, down, or 404 exit 1.

Pass a Check result URL, a badge status URL, or a scan UUID with --host / INVINCE_URL.

invince qa, invince qa-load, invince test-report, invince coverage, and invince eval

invince qa runs a local scan, optionally --url (one GET) and --k6 summary.json (a file k6 already wrote). It does not start k6 and does not hammer a URL.

invince qa-load k6-summary.json --upload posts extracted HTTP counts to /api/ingest/qa-load. A bare URL is rejected.

invince test-report report.json --upload posts Playwright, Cypress, Selenium, or Robot JSON to /api/ingest/qa-ci. The CLI does not start a browser. A URL file is rejected.

invince coverage coverage/lcov.info --upload posts line counts from lcov to /api/ingest/qa-coverage. Invince does not execute tests. A URL file is rejected.

invince eval eval-results.json --upload posts expected vs actual to /api/ingest/qa-eval. Invince does not call a model. A URL file and a judge/pass flag are rejected as evidence.

See Launch QA and Quality Hub. Copy packages/cli/launch-qa.yml.

Run it

node packages/cli/bin/invince.js --help
node packages/cli/bin/invince.js scan .
node packages/cli/bin/invince.js check https://your-app.example --json
node packages/cli/bin/invince.js verdict https://YOUR_INVINCE/check/SCAN_ID --json

Published CLI: npx --yes @invince/cli@0.2.3 --help after you publish this version. Install @invince/node@0.1.2 and @invince/browser@0.1.2 until you publish 0.1.3 from this repo. npm 0.1.1 shipped without dist/. 0.1.2 still stamped sdk.version as 0.1.1 in events.

GitHub Actions and GitLab CI

Copy packages/cli/github-action.yml, packages/cli/launch-qa.yml, or packages/cli/gitlab-ci.yml. Permissions stay at contents: read. Launch QA URL and k6 jobs run on workflow_dispatch only.

Secrets in the repo

The in-repo gate is CI secret gate (npm run security:gate). invince scan also flags committed .env files and known credential formats.