[anilkreddy]

Purpose

Adds the public Setup CommerceKit CLI JavaScript Action. The Action installs and verifies an exact CommerceKit CLI version or the latest stable CLI release. It does not run project checks or inspect a consumer's repository.

Action contract

• version is optional.
• Accepts latest or an exact semantic version; other aliases, ranges, tags, URLs, and Git refs are rejected.
• Omitting version and supplying version: latest both resolve GitHub's latest non-prerelease CommerceKit CLI release, verify its discovery metadata, validate a stable semantic version, and install from the immutable cli-v<resolved-version> tag.
• Supports CLI 0.1.0-preview.2 and newer compatible releases. Preview releases require an explicit exact version.
• The current public CLI has no stable release, so omission and latest currently fail clearly instead of selecting a preview.
• Maps all six published targets: Linux, macOS, and Windows on x64 and ARM64.
• Verifies release-manifest.json against SHA256SUMS, validates schema 1 at runtime, cross-checks target metadata and hashes, and verifies the archive SHA-256 before extraction.
• Finds only the expected executable, verifies its exact --version, places it in the runner tool cache, re-verifies cache hits, and adds its directory to PATH.
• Exposes version, path, target, build-id, and cache-hit outputs.

Latest-stable trust flow

The mutable GitHub releases/latest/download path is used only to discover a non-prerelease version. Its manifest is checksum-verified and validated before use. The Action then downloads and verifies metadata again from that version's exact cli-v<version> tag and downloads the archive only from the exact tag. Prerelease metadata is rejected by the stable resolver.

Security and privacy

• Restricts downloads to public commercekit-tools/cli GitHub release URLs.
• Rejects unsafe metadata filenames, unsupported schemas or targets, duplicate entries, checksum mismatches, ambiguous executables, and corrupted cache entries.
• Uses argument-array process execution without a shell.
• Has no telemetry, SAP credentials, project source access, source uploads, private repository dependency, Homebrew dependency, or WinGet dependency.
• Pins this repository's workflow Actions to full commit SHAs.
• Includes CodeQL because organization default setup is not currently configured for this repository, plus weekly Dependabot updates without automerge.

SHA-256 checks validate downloaded bytes against the release's published integrity metadata; they are not publisher identity or code-signing verification.

Tests and release integration

• 143 unit tests cover optional input behavior, the latest selector, exact version validation, stable resolution, prerelease rejection, the six platform mappings, checksum parsing, manifest validation, release resolution, cache behavior, installation failures, safe errors, orchestration, and binary verification.
• Coverage: 93.75% statements, 90% branches, 93.1% functions, 93.92% lines.
• Local real-release integration downloaded and verified explicit 0.1.0-preview.2, executed the exact installed darwin-arm64 binary, validated help output, and confirmed a verified same-job cache hit.
• Real omitted-version and explicit-latest probes confirm the current no-stable-release state fails safely with no success outputs.
• CI passed the committed Action with explicit preview.2 on all six current hosted runner target families.
• dist/index.js is committed and reproducibly generated with @vercel/ncc.
• pnpm quality, the full dependency audit, and real public-release integration pass locally on Node 24.21.0 / pnpm 12.6.0.

Public repository readiness

• Uses the established CommerceKit public MIT license and attribution.
• Includes consumer documentation, security policy, contribution instructions, Action release policy, dependency notices, Marketplace metadata, pinned CI, and a committed bundle.
• Documents the independent Action version (v1) and CLI version selection policy.

Deferred by design

CommerceKit command execution, notifications, Slack, Teams, email, reusable workflows, CCv2 build/deploy, SAP credentials/API logic, Homebrew, WinGet, Action tags/releases, and Marketplace publication are outside this PR.

Checklist

• optional version input
• exact versions remain supported
• latest explicitly selects the latest stable release
• omission selects the latest stable release
• stable discovery metadata is verified
• resolved stable version is re-pinned to an immutable exact release tag
• minimum CLI version 0.1.0-preview.2
• no mutable alias other than latest or version range accepted
• six target mappings
• release-manifest validation
• SHA256SUMS validation
• manifest integrity checked
• archive integrity checked
• version verified after extraction
• runner tool cache
• PATH added
• outputs documented
• no telemetry
• no source scanning
• no SAP credentials
• no private repository dependency
• public preview.2 integration tested locally
• Linux x64 and ARM64 native CI tested on final commit
• macOS x64 and ARM64 native CI tested on final commit
• Windows x64 and ARM64 native CI tested on final commit
• dist committed
• dist reproducible
• CI pinned
• dependency audit clean
• README complete
• SECURITY complete
• RELEASING complete
• no Action release created
• PR not merged

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.