[vericto]

The default cli-version moves from 1.8.2 to 1.12.0, the CLI release npm and GitHub serve. Workflows that pin cli-version keep their pin.

CLI changes 1.8.2 -> 1.12.0 that reach the action, and how they are handled:

• 1.9.0 offline mode: in CI a missing credential is still exit 3 and an unreachable API still exit 4, so the action's flow is unchanged. But a job-level VERICTO_OFFLINE=1 would have switched an api-key check to the embedded standard rules only (no workspace policy, no audit trail), and made an oidc check exit 2. check.sh now unsets VERICTO_OFFLINE before running the CLI and warns when it was set: the action always checks online.
• 1.9.0 report fields (JSON mode/engine_version, SARIF run properties): the outputs are read from the same fields as before; unchanged.
• 1.11.0 native Windows ARM64 build: resolve.sh maps Windows/ARM64 to vericto-cli-aarch64-pc-windows-msvc.zip and refuses (exit 2, with the reason) a cli-version before 1.11.0 there. CI self-tests on windows-11-arm.
• 1.11.0 BOM/UTF-16 input fix and 1.12.0 rustls-webpki/webpki-roots (RUSTSEC-2026-0382/0381): security fixes picked up by the bump.
• Exit codes 0-4 are unchanged.

The 1.12.0 assets were checked against the release's sha256.sum and per-asset .sha256 files and their Sigstore attestations; the action keeps verifying the .sha256 before extraction (no pinned hashes in the repo).

Also: the README said the CLI was under ELv2 "up to 1.9.0"; per the CLI's LICENSING.md it is 1.9.1 and earlier (FSL-1.1-ALv2 from 1.10.0). Fixed in English and Spanish.

• action.yml: default "1.12.0" # pinned-cli-version; Windows ARM64 note
• scripts/resolve.sh: Windows/ARM64; example version 1.12.0
• scripts/check.sh: ignore VERICTO_OFFLINE
• tests: fixtures and versions 1.12.0; Windows ARM64 and VERICTO_OFFLINE cases
• ci.yml: windows-11-arm self-test; VERICTO_OFFLINE=1 on the unreachable-API case
• README, CONTRIBUTING, CHANGELOG [1.2.0] - 2026-10-25

What does this PR change?

Why?

Type of change

• Input or output (action.yml)
• Installation, checksum or attestation check
• Runner support (Linux, macOS, Windows; bash 3.2 / 5.x)
• Pinned CLI version bump
• Bug fix
• Documentation
• Dependencies or CI

Tests

• Added or updated unit tests in test/, including rejected and hostile inputs
• for t in lib resolve verify-checksum install check; do bash "test/$t-test.sh"; done passes
• actionlint and shellcheck (the images CI pins) are clean
• Every uses: is pinned by full commit SHA with a version comment
• bash test/checksum-test.sh <pinned CLI version> passes (if the install or checksum path changed)

Checklist

• No ${{ inputs.* }} interpolated into a run: script; inputs go through environment variables and scripts/lib.sh
• Commits follow Conventional Commits
• CHANGELOG.md updated under [Unreleased] (if a workflow using the action can see the change)
• New or changed inputs and outputs documented in README.md and action.yml
• CI is green, including the self-test runners