A lightweight CI/CD orchestrator built with Deno that unifies Node.js, Docker, NPM, SSH, and Git workflows into a single CLI. Ships standalone binaries for GNU Linux, macOS and Windows, and an explicit Deno source runtime for musl Linux.

Issue Reporting and Security

For reporting bugs, issues, or security vulnerabilities, please visit community.foss.global/. This is the central community hub for all issue reporting. Developers who sign and comply with our contribution agreement and go through identification can also get a code.foss.global/ account to submit Pull Requests directly.

🏗️ Architecture

szci is a thin orchestrator — it doesn't reinvent the wheel. Instead, it wires up best-in-class tools and handles the CI-specific glue:

Domain	What szci does	Delegates to
🐳 Docker	Bridges `SZCI_LOGIN_DOCKER*` env vars, auto-detects GitLab CI tokens	`@git.zone/tsdocker`
📦 NPM	Generates `.npmrc` from `SZCI_TOKEN_NPM*` env vars, handles multi-registry publish	`pnpm` + `npm publish`
🟢 Node.js	Manages Node versions via NVM with named aliases	`nvm`
🔑 SSH	Deploys SSH keys from env vars to `~/.ssh`	`@push.rocks/smartssh`
🔀 Git	Mirrors repos to GitHub	`git remote`

CLI Input (Deno.args)
    ↓
SmartCLI Router
    ↓
├─ szci docker *   → env var bridging → npx @git.zone/tsdocker
├─ szci npm *      → .npmrc generation → pnpm / npm publish
├─ szci node *     → version aliasing  → nvm install
├─ szci git *      → token injection   → git push --mirror
└─ szci ssh *      → key parsing       → write to ~/.ssh

📥 Installation

With pnpm

pnpm install -g @ship.zone/szci

Node.js 22 or newer is required by the npm wrapper. Platform-specific optional packages carry the executable bytes and their executable-file metadata; no postinstall download or package-directory permission repair runs. Keep optional dependencies enabled. A missing native package fails with a reinstall instruction.

Platform	Runtime
Linux x64 / ARM64 with GNU libc 2.27+	Matching native package
macOS x64 / ARM64	Matching native package; macOS 12+
Windows x64	Matching native package
Linux x64 / ARM64 with musl	Packaged Deno source; Deno 2.7.4+ on PATH

On musl, the wrapper selects source before looking for a native package. Install Deno using its supported platform distribution before running SZCI. The frozen Deno graph resolves into Deno's cache, so the installed package can be read-only. The first source launch needs public JSR and npm connectivity. Frozen npm artifact URLs use registry.npmjs.org with their locked integrity values; no private registry or registry credentials are required for startup. szci npm prepare remains a direct Node command and needs no native/Deno startup.

The existing SIGILL recovery remains: if a native executable exits with that signal, the wrapper retries the packaged source and requires Deno on PATH.

Standalone GNU/macOS/Windows installation

The repository release provides the same native bytes, checksums and third-party materials as the npm platform packages. Preserve those materials when copying an executable. Linux standalone binaries require GNU libc; use the pnpm/Deno path above on musl.

curl -fsSL https://code.foss.global/ship.zone/szci/raw/branch/main/install.sh | sudo bash

A specific immutable release can be selected with --version v8.0.0.

From source

pnpm install
pnpm build

Native release builds require Deno 2.9.6 and Python 3.12+ for the deterministic corresponding-source archives. The build compiles six Node package entrypoints with TsBuild and typechecks the Deno program while compiling all five native targets. Binaries remain in dist/binaries/ and are copied into their owning dist_ts_native_* package folders. mod.ts remains the public Deno entrypoint; its implementation and frozen runtime configuration live in deno_src/. For direct source execution use deno run --allow-all --config deno_src/deno.json mod.ts. The root deno.json contains version/task metadata and delegates to that runtime configuration. Its Node build dependencies are locked by pnpm; they are not part of the Deno runtime graph.

Release packaging

The private repository prepares six public packages with TSPublish. The five native siblings publish before the main wrapper, all at the exact same version. GitZone CLI 6.10.0 or later is required. Its configured release journal owns Git, the Gitea release assets, and both npm registries. pnpm build produces a version-bound asset manifest with source archives, native binaries, legal materials and checksums. The CLI freezes those bytes, publishes and anonymously verifies the source archive, legal archive, source manifest and checksums first, then the five native executable assets, and finally the native npm packages. Each asset is verified before the next upload. CI checks the source and publishes nothing. Existing release assets are never deleted or overwritten.

The publisher uses an existing repository-admin PAT with write:repository scope through GITZONE_RELEASE_GITEA_TOKEN. Code-push permission alone does not prove access to Gitea's Releases unit. Confirm the deployed repository.release.FILE_MAX_SIZE and proxy request-body limit for the largest generated artifact; the public issue-attachment size setting is a separate limit. The CLI neither creates credentials nor broadens their scope.

Every native package exports ./corresponding-source: its binary hash and the immutable source archive URL/hash. The shared source archive is retained for as long as the matching binary versions remain downloadable. An interrupted release resumes from the CLI's retained journal; it does not rebuild artifacts.

The complete native inventory, exact source references and library replacement instructions are in third_party/szci. Native runtime upgrades require a refreshed inventory and distribution qualification.

🚀 Quick Start

# Setup Node.js environment
szci node install stable

# Install project dependencies
szci npm install

# Build & push Docker images
szci docker build
szci docker push registry.example.com

# Run tests
szci npm test

📖 CLI Reference

`szci docker` — Docker Operations

All Docker commands delegate to @git.zone/tsdocker after bridging environment variables.

szci docker build                        # Build all Dockerfiles in cwd
szci docker login                        # Login to all configured registries
szci docker prepare                      # Alias for login
szci docker push registry.example.com    # Push images to a registry
szci docker pull registry.example.com    # Pull images from a registry
szci docker test                         # Test Dockerfiles

Env var bridging: Before delegating, szci converts its own env var format to tsdocker's expected format:

SZCI_LOGIN_DOCKER_1  →  DOCKER_REGISTRY_1
SZCI_LOGIN_DOCKER_2  →  DOCKER_REGISTRY_2
...

In GitLab CI, CI_JOB_TOKEN is automatically bridged as DOCKER_REGISTRY_0 for registry.gitlab.com.

`szci npm` — NPM/pnpm Workflows

szci npm install     # Runs pnpm install
szci npm build       # Runs pnpm run build
szci npm test        # Runs pnpm test
szci npm prepare     # Generates ~/.npmrc from SZCI_TOKEN_NPM* env vars
szci npm publish     # Full workflow: prepare → install → build → clean → npm publish

szci npm prepare runs directly through the Node wrapper, so npm authentication setup remains available during cross-platform Docker builds where a Deno binary cannot execute under CPU emulation.

The publish command supports multi-registry publishing. If npmAccessLevel is public and a Verdaccio registry is configured, it publishes to both npm and Verdaccio automatically.

`szci node` — Node.js Version Management

szci node install stable    # Node.js 22
szci node install lts       # Node.js 20
szci node install legacy    # Node.js 18
szci node install 21        # Any specific version

Uses NVM under the hood (auto-detected at /usr/local/nvm/nvm.sh or ~/.nvm/nvm.sh). After installing, it:

Sets the installed version as nvm alias default
Upgrades npm to latest
Installs any global tools listed in .smartconfig.json → npmGlobalTools

`szci ssh` — SSH Key Deployment

szci ssh prepare    # Deploy SSH keys from env vars to ~/.ssh

Reads all SZCI_SSHKEY_* env vars and writes the keys to disk.

`szci git` — Git Mirroring

szci git mirror    # Mirror repository to GitHub

Pushes all branches and tags to a GitHub mirror. Requires SZCI_GIT_GITHUBTOKEN. Refuses to mirror packages marked as private in package.json.

⚙️ Configuration

`.smartconfig.json`

Place this in your project root to configure szci behavior:

{
  "@ship.zone/szci": {
    "npmGlobalTools": ["typescript", "pnpm"],
    "npmAccessLevel": "public",
    "npmRegistryUrl": "registry.npmjs.org",
    "urlCloudly": "https://cloudly.example.com"
  }
}

Option	Type	Default	Description
`npmGlobalTools`	`string[]`	`[]`	Global npm packages to install during `node install`
`npmAccessLevel`	`"public" \| "private"`	`"private"`	Access level for `npm publish`
`npmRegistryUrl`	`string`	`"registry.npmjs.org"`	Default npm registry
`urlCloudly`	`string?`	—	Cloudly endpoint URL (can also be set via `SZCI_URL_CLOUDLY`)

🔐 Environment Variables

Docker Registry Authentication

Pipe-delimited format: registry|username|password

SZCI_LOGIN_DOCKER_1="registry.example.com|myuser|mypass"
SZCI_LOGIN_DOCKER_2="ghcr.io|token|ghp_xxxx"

In GitLab CI, the CI_JOB_TOKEN is automatically used for registry.gitlab.com — no manual config needed.

NPM Registry Authentication

Pipe-delimited format: registry|token[|plain]

# Base64-encoded token (default)
SZCI_TOKEN_NPM_1="registry.npmjs.org|dGhlLXRva2VuLWhlcmU="

# Plain text token
SZCI_TOKEN_NPM_2="verdaccio.example.com|the-token-here|plain"

SZCI validates every configured npm credential before writing .npmrc. Malformed registry, encoding, or token values fail without logging the credential.

SSH Keys

Pipe-delimited format: host|privKeyBase64|pubKeyBase64

SZCI_SSHKEY_1="github.com|BASE64_PRIVATE_KEY|BASE64_PUBLIC_KEY"
SZCI_SSHKEY_2="gitlab.com|BASE64_PRIVATE_KEY|##"   # Use ## to skip a field

Git Mirroring

SZCI_GIT_GITHUBTOKEN="ghp_your_personal_access_token"
SZCI_GIT_GITHUBGROUP="your-org"       # Defaults to repo owner
SZCI_GIT_GITHUB="your-repo"           # Defaults to repo name

Debugging & Testing

DEBUG_SZCI="true"      # Log all shell commands before execution
SZCI_TEST="true"       # Test mode: mocks bash execution, skips SSH disk writes

Full Environment Variable Reference

Variable	Purpose
`SZCI_LOGIN_DOCKER_*`	Docker registry credentials (pipe-delimited)
`SZCI_TOKEN_NPM_*`	NPM registry auth tokens (pipe-delimited)
`SZCI_SSHKEY_*`	SSH key pairs (pipe-delimited)
`SZCI_GIT_GITHUBTOKEN`	GitHub personal access token for mirroring
`SZCI_GIT_GITHUBGROUP`	GitHub org/user for mirror target
`SZCI_GIT_GITHUB`	GitHub repo name for mirror target
`SZCI_URL_CLOUDLY`	Cloudly endpoint URL
`SZCI_COMPUTED_REPOURL`	Override auto-detected repo URL
`DEBUG_SZCI`	Enable verbose shell command logging
`SZCI_TEST`	Enable test mode (mock execution)

🔄 CI/CD Integration Examples

GitLab CI

image: node:22

stages:
  - prepare
  - build
  - test
  - deploy

before_script:
  - curl -sSL https://code.foss.global/ship.zone/szci/raw/branch/main/install.sh | bash

prepare:
  stage: prepare
  script:
    - szci node install stable
    - szci npm install

build:
  stage: build
  script:
    - szci docker build

test:
  stage: test
  script:
    - szci npm test

deploy:
  stage: deploy
  script:
    - szci docker push $CI_REGISTRY
  only:
    - master

💡 In GitLab CI, CI_JOB_TOKEN is automatically detected — szci will login to registry.gitlab.com without any extra config.

GitHub Actions

name: CI/CD

on:
  push:
    branches: [main]

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Install szci
        run: curl -sSL https://code.foss.global/ship.zone/szci/raw/branch/main/install.sh | sudo bash

      - name: Setup Node.js
        run: szci node install stable

      - name: Install & Build
        run: |
          szci npm install
          szci npm build

      - name: Test
        run: szci npm test

      - name: Push Docker
        if: github.ref == 'refs/heads/main'
        run: szci docker push ghcr.io
        env:
          SZCI_LOGIN_DOCKER_1: "ghcr.io|${{ github.actor }}|${{ secrets.GITHUB_TOKEN }}"

Gitea CI (Woodpecker)

steps:
  - name: ci
    image: node:22
    commands:
      - curl -sSL https://code.foss.global/ship.zone/szci/raw/branch/main/install.sh | bash
      - szci node install stable
      - szci npm install
      - szci docker build
      - szci npm test

🔄 Migration from npmci

Upgrading from @ship.zone/npmci? Three steps:

Rename the binary — replace npmci with szci in all CI scripts
Rename env vars — NPMCI_* → SZCI_* (same formats, just the prefix changed)
Docker ops — now delegate to @git.zone/tsdocker (installed automatically via npx)

Old	New
`NPMCI_LOGIN_DOCKER*`	`SZCI_LOGIN_DOCKER*`
`NPMCI_TOKEN_NPM*`	`SZCI_TOKEN_NPM*`
`NPMCI_SSHKEY_*`	`SZCI_SSHKEY_*`
`NPMCI_GIT_GITHUBTOKEN`	`SZCI_GIT_GITHUBTOKEN`
`NPMCI_URL_CLOUDLY`	`SZCI_URL_CLOUDLY`
`DEBUG_NPMCI`	`DEBUG_SZCI`
`NPMTS_TEST`	`SZCI_TEST`

🛠️ Development

# Type check
deno task check

# Run tests
deno task test

# Watch tests
deno task test:watch

# Dev mode
deno task dev -- --help

# Compile binaries for all platforms
deno task compile

# Format code
deno task fmt

# Lint
deno task lint

License and Legal Information

This repository contains open-source code licensed under the MIT License. A copy of the license can be found in the license.md file.

Please note: The MIT License does not grant permission to use the trade names, trademarks, service marks, or product names of the project, except as required for reasonable and customary use in describing the origin of the work and reproducing the content of the NOTICE file.

Trademarks

This project is owned and maintained by Task Venture Capital GmbH. The names and logos associated with Task Venture Capital GmbH and any related products or services are trademarks of Task Venture Capital GmbH or third parties, and are not included within the scope of the MIT license granted herein.

Use of these trademarks must comply with Task Venture Capital GmbH's Trademark Guidelines or the guidelines of the respective third-party owners, and any usage must be approved in writing. Third-party trademarks used herein are the property of their respective owners and used only in a descriptive manner, e.g. for an implementation of an API or similar.

readme.md

@ship.zone/szci