From f9b7a3a8fe28657d772b0c9668956cd15c4a01db Mon Sep 17 00:00:00 2001 From: Richard Hope Date: Wed, 29 Jul 2026 07:38:27 +1000 Subject: [PATCH] Install from the repository, not from PyPI IcebergSCA is released from its GitHub repo and there is no icebergsca package on PyPI, so every install line now points at a tagged git ref: uv tool install git+https://github.com/IcebergAI/IcebergSCA@v0.1.0 uvx --from git+https://github.com/IcebergAI/IcebergSCA@v0.1.0 icebergsca ... Says so explicitly rather than just omitting PyPI. A reader who assumes `pip install icebergsca` works is one squatted name away from installing someone else's code on the strength of our documentation. The tag is pinned everywhere, CI snippets included. Covers the README, the docs site (home page and CI page) and the bundled agent skill, which carried the same instructions. Co-Authored-By: Claude Opus 5 (1M context) --- README.md | 18 ++++++++++++---- .../.agents/skills/icebergsca/SKILL.md | 11 ++++++++-- .../icebergsca/references/ci-integration.md | 12 ++++++++--- website/docs/index.md | 21 +++++++++++++++---- website/docs/output.md | 8 +++++-- website/zensical.toml | 7 +++---- 6 files changed, 58 insertions(+), 19 deletions(-) diff --git a/README.md b/README.md index 1f11e18..9b90c90 100644 --- a/README.md +++ b/README.md @@ -14,13 +14,21 @@ Documentation: ## Install -It's a CLI application, not a library dependency — install it as a tool: +Released from this repository, not from PyPI — there is no `icebergsca` package on PyPI, and +anything published under that name is not this project. It's a CLI application, not a library +dependency, so install it as a tool: ```bash -uv tool install icebergsca # or: uvx icebergsca scan . -pipx install icebergsca +uv tool install git+https://github.com/IcebergAI/IcebergSCA@v0.1.0 +pipx install git+https://github.com/IcebergAI/IcebergSCA.git@v0.1.0 + +# or run it without installing +uvx --from git+https://github.com/IcebergAI/IcebergSCA@v0.1.0 icebergsca scan . ``` +Pin the tag: without `@v0.1.0` you get whatever `main` is at that moment. Upgrade by re-running +the same command against a newer tag with `--force`. + ## Usage ```bash @@ -105,7 +113,9 @@ SARIF and CycloneDX are validated against the official published schemas in the ### GitHub Actions ```yaml -- run: uvx icebergsca scan . --format sarif --output icebergsca.sarif +- run: >- + uvx --from git+https://github.com/IcebergAI/IcebergSCA@v0.1.0 + icebergsca scan . --format sarif --output icebergsca.sarif - uses: github/codeql-action/upload-sarif@v3 with: sarif_file: icebergsca.sarif diff --git a/src/icebergsca/.agents/skills/icebergsca/SKILL.md b/src/icebergsca/.agents/skills/icebergsca/SKILL.md index 4260855..9cf3c84 100644 --- a/src/icebergsca/.agents/skills/icebergsca/SKILL.md +++ b/src/icebergsca/.agents/skills/icebergsca/SKILL.md @@ -25,12 +25,19 @@ dependency graph, checks each package against [OSV](https://osv.dev), and report icebergsca scan ./myproject ``` -The tool is a CLI application, not a library. Install it as a tool, not as a dependency: +The tool is a CLI application, not a library. Install it as a tool, not as a dependency. It is +released from its GitHub repository; there is **no `icebergsca` package on PyPI**, so +`pip install icebergsca` does not install this project. ```bash -uv tool install icebergsca # or run ad hoc: uvx icebergsca scan . +uv tool install git+https://github.com/IcebergAI/IcebergSCA@v0.1.0 + +# or run ad hoc, without installing +uvx --from git+https://github.com/IcebergAI/IcebergSCA@v0.1.0 icebergsca scan . ``` +Pin the tag. Without `@v0.1.0` you get whatever `main` is at that moment. + ## Machine-readable output Always request JSON when a program or agent will read the result. The table format is for diff --git a/src/icebergsca/.agents/skills/icebergsca/references/ci-integration.md b/src/icebergsca/.agents/skills/icebergsca/references/ci-integration.md index 085981e..8f46d2d 100644 --- a/src/icebergsca/.agents/skills/icebergsca/references/ci-integration.md +++ b/src/icebergsca/.agents/skills/icebergsca/references/ci-integration.md @@ -31,7 +31,9 @@ A built-in `--fail-on ` flag is planned but not yet implemented. ```yaml - name: Scan dependencies - run: uvx icebergsca scan . --format sarif --output icebergsca.sarif + run: >- + uvx --from git+https://github.com/IcebergAI/IcebergSCA@v0.1.0 + icebergsca scan . --format sarif --output icebergsca.sarif - uses: github/codeql-action/upload-sarif@v3 with: @@ -77,7 +79,9 @@ jobs: - uses: astral-sh/setup-uv@v8 - name: Scan - run: uvx icebergsca scan . --exclude 'tests/fixtures/**' --format sarif --output sca.sarif + run: >- + uvx --from git+https://github.com/IcebergAI/IcebergSCA@v0.1.0 + icebergsca scan . --exclude 'tests/fixtures/**' --format sarif --output sca.sarif - uses: github/codeql-action/upload-sarif@v3 if: always() @@ -93,7 +97,9 @@ because the code changed. ```yaml - name: Generate SBOM - run: uvx icebergsca sbom . --output sbom.cdx.json + run: >- + uvx --from git+https://github.com/IcebergAI/IcebergSCA@v0.1.0 + icebergsca sbom . --output sbom.cdx.json - uses: actions/upload-artifact@v5 with: diff --git a/website/docs/index.md b/website/docs/index.md index 86eee77..d7c0c09 100644 --- a/website/docs/index.md +++ b/website/docs/index.md @@ -29,14 +29,27 @@ check. ## Install and scan ```bash -uv tool install icebergsca # or run it ad hoc: uvx icebergsca scan . -pipx install icebergsca +uv tool install git+https://github.com/IcebergAI/IcebergSCA@v0.1.0 +pipx install git+https://github.com/IcebergAI/IcebergSCA.git@v0.1.0 -icebergsca scan ./myproject +# or run it without installing +uvx --from git+https://github.com/IcebergAI/IcebergSCA@v0.1.0 icebergsca scan . ``` It is a CLI application, not a library — install it as a tool rather than adding -it to the dependency tree it is meant to be auditing. +it to the dependency tree it is meant to be auditing. Then point it at a project: + +```bash +icebergsca scan ./myproject +``` + +!!! info "Released from the repository, not from PyPI" + + There is no `icebergsca` package on PyPI, and anything published under that + name is not this project. + + Pin the tag: without `@v0.1.0` you get whatever `main` is at that moment. + Upgrade by re-running the same command against a newer tag with `--force`. ![A scan reporting 12 vulnerabilities across three Python packages](assets/scan-table.svg){ .term } diff --git a/website/docs/output.md b/website/docs/output.md index f22f3d8..89da8fc 100644 --- a/website/docs/output.md +++ b/website/docs/output.md @@ -66,7 +66,9 @@ The complete field reference ships with the package, in ## SARIF and GitHub code scanning ```yaml -- run: uvx icebergsca scan . --format sarif --output icebergsca.sarif +- run: >- + uvx --from git+https://github.com/IcebergAI/IcebergSCA@v0.1.0 + icebergsca scan . --format sarif --output icebergsca.sarif - uses: github/codeql-action/upload-sarif@v3 with: sarif_file: icebergsca.sarif @@ -156,7 +158,9 @@ jobs: - uses: astral-sh/setup-uv@v8 - name: Scan - run: uvx icebergsca scan . --exclude 'tests/fixtures/**' --format sarif --output sca.sarif + run: >- + uvx --from git+https://github.com/IcebergAI/IcebergSCA@v0.1.0 + icebergsca scan . --exclude 'tests/fixtures/**' --format sarif --output sca.sarif - uses: github/codeql-action/upload-sarif@v3 if: always() diff --git a/website/zensical.toml b/website/zensical.toml index 95ccda1..780ea57 100644 --- a/website/zensical.toml +++ b/website/zensical.toml @@ -78,10 +78,9 @@ toggle.name = "Switch to light mode" icon = "fontawesome/brands/github" link = "https://github.com/IcebergAI/IcebergSCA" -# A PyPI social link belongs here too, but icebergsca has no release yet -# (pypi.org/pypi/icebergsca/json is a 404) and a footer icon that 404s is -# exactly the kind of unearned claim this tool exists to complain about. -# Restore it with the first release. +# No PyPI social link: IcebergSCA is released from its repository and there is +# no icebergsca package on PyPI. A footer icon pointing at a name we do not own +# would send readers to whoever registers it first. # ---------------------------------------------------------------------------- # Markdown extensions (carried over from the Zensical default template)