mickdownunder/SafeInstall Policy Check

Run SafeInstall policy checks in CI. Blocks risky package installs before they land in your repo.

Trust Signals

name	description	required	default
mode	"check" evaluates direct dependencies against policy without installing. "install" runs the package manager through SafeInstall so policy is enforced before any packages are written to disk.	no	check
package-manager	Package manager to use in install mode (npm, pnpm, or bun). Ignored in check mode.	no	pnpm
args	Additional arguments forwarded to the package manager in install mode. Example: "--frozen-lockfile". Ignored in check mode.	no	""
config-path	Explicit path to safeinstall.config.json. If omitted, SafeInstall discovers the nearest config by walking upward from the project directory.	no	""
version	SafeInstall CLI version to install. Defaults to the latest published version. Pin to a specific version for reproducible builds.	no	latest
verify-trust	When "true", verify the Agent Trust Surface before running the policy check: the committed .safeinstall/trust-surface.lock must exist and match the repository state. This catches tampering with SafeInstall config, agent hooks, rules files, and MCP configs — even when the tampering happened on a fully compromised local machine, because CI re-verifies the committed baseline.	no	false

name	description
decision	Policy decision: allow or block
summary	Human-readable one-line summary
exit-code	SafeInstall exit code (0 = allow, 2 = block, 1 = error)
json	Full JSON result from SafeInstall