™Fini Proof · CLI 0.6.4
One command in the pipeline you already have.
Run the fini-proof 0.6.4 CLI in the pipeline you already have. Installation and an optional evidence upload use the network. The checks themselves run on the runner.
Setup on a runner: install the pinned package, then run the check. npx --yes fini-proof@0.6.4 check. Exit 0 is PASS, 1 is FAIL, 2 is a usage error, 3 is NOT_MEASURED, and 4 is a licence refusal. Pin fini-proof@0.6.4. Do not run an unpinned fini-proof.
The package includes CI examples for GitHub Actions, GitLab CI, Jenkins and Bitbucket Pipelines, plus a daily run of the default branch. The GitHub example checks out with full history and runs npx --yes fini-proof@0.6.4 check --base origin/<base>. A licence, when you have one, is passed as FINI_PROOF_LICENCE.
npx downloads the package. That step uses the network. After the package is on the runner, the engines read the repository locally. They do not call a model. The 0.6.4 licence check verifies an Ed25519 signature on the machine and does not phone home for that check.
--upload is optional. It needs FINI_PROOF_API_KEY. Without the key, nothing is sent. With the key, the CLI posts the evidence record already on disk to the Developer workspace API (default https://developer.finipe.com/api/v1/fini-proof). The README states that file contents are not in that record. The record does include paths, file hashes, finding text, commit and tree hashes, the git author email of HEAD, and licence or trial status. A failed upload does not change the local verdict.
The local trial in 0.6.4 is recorded on the machine: one repository, seven days, and at most seven proof runs, starting at the first licensed check. Account creation on the website is not described by the CLI as a reset of that file. Online licence authorisation is not what 0.6.4 implements.