[SebHenn]

Closes #61.

The action ran everything through docker run, so it was Linux-only. A .NET test job on windows-latest couldn't use it at all, or pair it with dotnet-tia's action, which runs on all three OSes. Every Linux run also paid for an image pull and two or three container starts.

runtime: auto | docker | binary (default auto)

• auto: Docker on Linux, or whenever image: is set; the binary on Windows and macOS.
• binary: downloads cifail-<stamp>-<rid>.(zip|tar.gz) of the action's own release (the same version stamp the image tag uses, so pinning the action pins the code) plus its .sha256 from that release. The RID comes from RUNNER_OS and RUNNER_ARCH.
  • It checks the sha256 on every run, cached or not; a mismatch deletes the files and exits 2 without running anything.
  • It extracts with unzip, or Windows' own tar.exe (bsdtar reads zip; Git Bash's GNU tar can't), or tar -xzf, into RUNNER_TOOL_CACHE/cifail/<ver>/<rid>, which persists on self-hosted runners.
  • CIFAIL_BINARY points at a binary already on disk.
• binary with image: is refused as a contradiction.
• The provenance line names binary <archive> sha256 <hash> instead of the image digest. image-digest is empty in binary mode.
• In binary mode there's no workspace mount, so the persisted-credential warning and docker pull are skipped. The tia report is passed by path instead of a mount, and CIFAIL_DB_* reach the binary through the environment.

Portability: same_commit (from #58) used ${1,,}, which is bash 4. macOS's /bin/bash is 3.2, so it now lowercases with tr. Runner paths are converted with cygpath under Git Bash.

Verified

• Locally on Windows (Git Bash) against the real v0.5.0 release:
  • The action script downloaded cifail-0.5.0-win-x64.zip, verified it, unzipped it and ran it. The provenance line was … | cifail 0.5.0 | binary cifail-0.5.0-win-x64.zip sha256 ab23db3a…, and the outputs were rule=nuget-nu1101, matched=true.
  • A second run used the cache.
  • A tampered .sha256 was refused, exit 2, and the files were removed.
• CI:
  • build-test-windows runs the action script through Git Bash with runtime: auto and stamp 0.5.0, a published release, because this version isn't out yet.
  • docker-smoke runs runtime: binary on Linux the same way and checks that binary plus image: is refused.
• actionlint is clean. Shellcheck on the action shows the same single finding as main.

Not covered: macOS has no CI job here. Its path is the same tar.gz branch that Linux CI exercises, plus shasum instead of sha256sum.

🤖 Generated with Claude Code