vericto · Oct 26, 2026 · Oct 26, 2026
@@ -99,7 +99,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        os: [ubuntu-latest, ubuntu-24.04-arm, macos-latest, windows-latest]
+        os: [ubuntu-latest, ubuntu-24.04-arm, macos-latest, windows-latest, windows-11-arm]
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
@@ -135,10 +135,14 @@ jobs:
           test "$RESULT" = fail
 
       # 2. The CLI runs end to end (cached install, globs, key via env) against
-      #    an address nothing listens on: no verdict, exit 4, no SARIF.
+      #    an address nothing listens on: no verdict, exit 4, no SARIF. A
+      #    job-level VERICTO_OFFLINE=1 is ignored: offline mode (CLI 1.9.0+)
+      #    would answer locally (exit 1 on the fixtures' DELETE) instead.
       - name: "Action: API unreachable"
         id: offline
         continue-on-error: true
+        env:
+          VERICTO_OFFLINE: "1"
         uses: ./
         with:
           api-key: vtro_selftest_not_a_real_key

@@ -7,6 +7,60 @@ and this project adheres to
 
 ## [Unreleased]
 
+## [1.2.0] - 2026-10-25
+
+**The default CLI moves to 1.12.0, and Windows ARM64 runners are supported.**
+`uses: vericto/check-sql@v1` moves to 1.2.0. Workflows that pin `cli-version`
+keep the version they pin. Inputs, outputs and exit codes are unchanged.
+
+### Security
+- The default `cli-version` is now **1.12.0** (was 1.8.2). Among the CLI
+  changes since 1.8.2 that reach this action: 1.12.0 updates rustls-webpki and
+  webpki-roots (RUSTSEC-2026-0382, RUSTSEC-2026-0381), so the TLS connection
+  to the Vericto API no longer trusts distrusted intermediates; 1.11.0 checks
+  SQL files saved with a UTF-8 byte-order mark instead of letting them through
+  as a parse error, and reads UTF-16 files with a BOM. See the
+  [CLI changelog](https://github.com/vericto/vericto-cli/blob/main/CHANGELOG.md#1120---2026-10-22).
+  The download is verified as before, against the release's `.sha256` file
+  before extraction; the 1.12.0 assets were checked against `sha256.sum` and
+  their Sigstore build attestations before this release.
+- **A job-level `VERICTO_OFFLINE` is ignored.** CLI 1.9.0 added an offline
+  mode (`--offline` or `VERICTO_OFFLINE=1`) that checks with the embedded
+  engine's standard rules only, without the workspace's custom rules,
+  overrides, sensitive columns or audit trail. With the variable set on the
+  job, the action would have checked offline with an `api-key`, or failed with
+  exit 2 with `oidc: true`. `check.sh` now unsets it before running the CLI and
+  logs a warning when it was set, so the action always checks online. The
+  rest of the 1.9.0 change does not affect the action: in CI a missing
+  credential is still exit 3 (the action fails with 3 before the CLI runs),
+  and an unreachable API is still exit 4, never an offline verdict.
+
+### Added
+- **Windows ARM64 runners** (`windows-11-arm`), with CLI 1.11.0 or later,
+  which publishes a native `vericto-cli-aarch64-pc-windows-msvc.zip`. With an
+  older `cli-version` on Windows ARM64, the action stops with exit 2 and says
+  so instead of failing on a missing download.
+
+### Changed
+- Reports from CLI 1.9.0 and later carry the check mode: JSON has top-level
+  `mode` and `engine_version`, SARIF a run `properties` bag. The action's
+  outputs (`blocked`, `flagged`, `monitored`, `parse-errors`, `result`) are
+  read from the same fields as before and are unchanged.
+- CLI 1.11.0 reports Windows paths with `/` in SARIF and annotations, so on
+  Windows runners Code Scanning annotations attach to files like on Linux.
+- The test fixtures (the stand-in CLI, the `file://` release in
+  `test/install-test.sh`, the versions in `test/resolve-test.sh`) and the
+  example in the `cli-version` error message use 1.12.0. The CI self-test runs
+  on `windows-11-arm` too, and its unreachable-API case sets
+  `VERICTO_OFFLINE=1` on the step to prove it is ignored.
+
+### Fixed
+- The README and the 1.1.0 notes said the Vericto CLI was under the Elastic
+  License 2.0 "up to 1.9.0". Per the CLI's `LICENSING.md`, versions 1.9.1 and
+  earlier are under the Elastic License 2.0 and 1.10.0 and later under
+  FSL-1.1-ALv2. The README (English and Spanish) now says so; the default CLI,
+  1.12.0, is under FSL-1.1-ALv2.
+
 ## [1.1.0] - 2026-10-18
 
 **Now open source under the Apache License 2.0.** From this version on, the

@@ -77,9 +77,10 @@ API.
 4. Open a PR using the template. Keep PRs focused and under ~500 lines.
 
 CI also runs the action itself (`uses: ./`) on `ubuntu-latest`,
-`ubuntu-24.04-arm`, `macos-latest` and `windows-latest`: without credentials,
-against an unreachable API, with OIDC but no `id-token` permission, and with
-hostile inputs. The live check against the Vericto API runs only where the
+`ubuntu-24.04-arm`, `macos-latest`, `windows-latest` and `windows-11-arm`:
+without credentials, against an unreachable API (with `VERICTO_OFFLINE=1` on
+the step, which the action must ignore), with OIDC but no `id-token`
+permission, and with hostile inputs. The live check against the Vericto API runs only where the
 `VERICTO_API_KEY` secret is available, so not on pull requests from forks.
 
 ### Rules for the scripts

@@ -9,7 +9,8 @@ The action wraps [`vericto check`](https://github.com/vericto/vericto-cli) from
 the Vericto CLI. It downloads a pinned CLI release, verifies its SHA-256 before
 extracting it, runs the check and uploads the SARIF report.
 
-- Works on Linux (x64, arm64), macOS (x64, arm64) and Windows (x64) runners.
+- Works on Linux (x64, arm64), macOS (x64, arm64) and Windows (x64, arm64)
+  runners.
 - Checks only the `*.sql` files a PR changes by default, or the files you list.
 - Authenticates with an API key or with GitHub OIDC (no stored secret).
 - Exits with the CLI's code, so a block fails the build and an outage is not
@@ -100,7 +101,7 @@ jobs:
 | `upload-sarif` | `true` | Upload the SARIF report to Code Scanning (only with `format: sarif`). |
 | `api-url` | CLI default | Vericto API base URL (`https://api.vericto.com`). |
 | `timeout` | CLI default (30) | Per-request timeout, in seconds. |
-| `cli-version` | `1.8.2` | Vericto CLI release to install. Pinned per action release; `latest` is rejected. See [Sanitized mode](#sanitized-mode-needs-cli-182-or-later) before pinning an older one. |
+| `cli-version` | `1.12.0` | Vericto CLI release to install. Pinned per action release; `latest` is rejected. See [Sanitized mode](#sanitized-mode-needs-cli-182-or-later) before pinning an older one; Windows ARM64 runners need 1.11.0 or later. |
 | `working-directory` | `.` | Where the check runs (where `.vericto.toml` lives). With `changed`, it must be the root of the checkout. |
 
 `fail_on` (which severity fails the run) is read from `.vericto.toml`; the
@@ -253,6 +254,12 @@ changed, the check passes and no SQL is sent.
   allowance is used up. `vericto doctor` shows which.
 - **`oidc: true needs 'permissions: id-token: write'`:** add the permission to
   the job. Pull requests from forks don't get OIDC tokens or secrets.
+- **`VERICTO_OFFLINE is set on the job; ignored here`:** the action always
+  checks online (see [Offline mode is not used](#offline-mode-is-not-used)).
+  Set `VERICTO_OFFLINE` only on the steps that run the CLI themselves.
+- **`Windows ARM64 runners need cli-version 1.11.0 or later` (exit 2):** CLI
+  releases before 1.11.0 have no Windows ARM64 build. Pin 1.11.0 or later, or
+  leave `cli-version` at its default.
 - **Exit 4:** the API could not be reached, or the workspace config could not
   be read. Corporate TLS proxies: set `VERICTO_CA_BUNDLE` (a PEM path) in the
   job's `env`.
@@ -289,8 +296,8 @@ Report vulnerabilities as described in [SECURITY.md](SECURITY.md).
 
 ## SQL never leaves your CI unless it is selected for the check
 
-The CLI is a thin client: it evaluates nothing locally, so checking SQL means
-sending it to your Vericto workspace. What is sent, per the
+The action runs the CLI online: checking SQL means sending it to your
+Vericto workspace, which evaluates it with your rules. What is sent, per the
 [CLI design](https://github.com/vericto/vericto-cli/blob/main/DESIGN.md):
 
 - **Only the files selected for the check** (the changed `*.sql` files, or
@@ -326,7 +333,19 @@ cannot read with certainty. See the
 [CLI changelog for 1.8.2](https://github.com/vericto/vericto-cli/blob/main/CHANGELOG.md#182---2026-10-18).
 
 Nothing changes for a workspace in `raw` mode. If you pin `cli-version`, your
-pin still applies; with a `sanitized` workspace, pin `1.8.2` or later.
+pin still applies; with a `sanitized` workspace, pin `1.8.2` or later. Since
+action 1.2.0 the default is CLI 1.12.0.
+
+### Offline mode is not used
+
+Since CLI 1.9.0, `vericto check --offline` (or `VERICTO_OFFLINE=1`) checks SQL
+on the machine with the engine built into the CLI and its standard rules only:
+no custom rules, overrides, sensitive columns, allowlists or audit trail. The
+action never uses it. It always checks online against your workspace, needs a
+credential (a missing one is exit 3, never a silent switch to offline), and
+ignores a `VERICTO_OFFLINE` set on the job, with a warning, so a variable meant
+for another step cannot weaken the check. To check offline in a workflow, run
+the CLI in its own step.
 
 ## Links
 
@@ -339,7 +358,7 @@ pin still applies; with a `sanitized` workspace, pin `1.8.2` or later.
 
 Releases follow [Semantic Versioning](https://semver.org). The major tag
 (`v1`) moves to each compatible release, the usual convention for GitHub
-Actions; `@v1.0.0` or a commit SHA stays fixed. Each action release pins a
+Actions; `@v1.2.0` or a commit SHA stays fixed. Each action release pins a
 CLI version, and a CLI bump ships as a new action release.
 
 ## Tests
@@ -373,8 +392,8 @@ license grants no right to the Vericto name or logo: see
 
 The Vericto CLI that the action downloads and runs is a separate program under
 its own license: the Functional Source License (FSL-1.1-ALv2) from CLI 1.10.0,
-the Elastic License 2.0 for 1.9.0 and earlier (including the default
-`cli-version`, 1.8.2). See its
+the Elastic License 2.0 for 1.9.1 and earlier. The default `cli-version`,
+1.12.0, is under FSL-1.1-ALv2. See its
 [LICENSING.md](https://github.com/vericto/vericto-cli/blob/main/LICENSING.md).
 The Vericto service it calls is offered under its own
 [terms](https://vericto.com/terms).
@@ -409,8 +428,8 @@ steps:
   revisar archivos concretos, indíquelos en `files`.
 - Para no guardar una clave, use OIDC: `oidc: true`, `workspace: ws_...` y el
   permiso `id-token: write`.
-- La acción descarga una versión fija del CLI y verifica su SHA-256 antes de
-  extraerlo. La clave de API se pasa solo por variable de entorno y nunca
+- La acción descarga una versión fija del CLI (1.12.0 por defecto) y
+  verifica su SHA-256 antes de extraerlo. La clave de API se pasa solo por variable de entorno y nunca
   aparece en la línea de comandos.
 - El SQL seleccionado se envía a su espacio de trabajo para evaluarlo. Si el
   espacio está en modo `sanitized`, los valores literales se reemplazan en el
@@ -419,7 +438,8 @@ steps:
 Licencia: código abierto bajo la [Apache License 2.0](LICENSE) desde 1.1.0. Las
 versiones 1.0.3 y anteriores se publicaron bajo la Elastic License 2.0 y siguen
 bajo ella. La CLI de Vericto que la action descarga tiene su propia licencia
-(FSL-1.1-ALv2 desde la CLI 1.10.0; Elastic License 2.0 hasta la 1.9.0). La
+(FSL-1.1-ALv2 desde la CLI 1.10.0, incluida la 1.12.0 que instala por
+defecto; Elastic License 2.0 hasta la 1.9.1). La
 licencia no otorga derechos sobre la marca Vericto
 ([TRADEMARKS.md](TRADEMARKS.md)).
 

@@ -84,9 +84,10 @@ inputs:
   cli-version:
     description: >-
       Vericto CLI release to install (from github.com/vericto/vericto-cli).
-      Pinned per action release; `latest` is not accepted.
+      Pinned per action release; `latest` is not accepted. Windows ARM64
+      runners need 1.11.0 or later.
     required: false
-    default: "1.8.2" # pinned-cli-version
+    default: "1.12.0" # pinned-cli-version
   working-directory:
     description: >-
       Directory to run the check from (where .vericto.toml lives). With

@@ -154,6 +154,16 @@ elif [ -z "${VERICTO_API_KEY:-}" ]; then
 fi
 unset VA_API_KEY
 
+# The action always checks online, against the workspace's own policy. Since
+# CLI 1.9.0, VERICTO_OFFLINE=1 switches `vericto check` to the embedded engine's
+# standard rules only (no custom rules, overrides or audit trail), and with
+# --oidc it is a usage error. A job-level VERICTO_OFFLINE, meant for another
+# step, must not quietly weaken this check: it is ignored here.
+if [ -n "${VERICTO_OFFLINE:-}" ]; then
+  gh_warning "VERICTO_OFFLINE is set on the job; ignored here: the action always checks online against your workspace's rules."
+fi
+unset VERICTO_OFFLINE
+
 [ -n "$dialect" ] && args+=("--dialect=$dialect")
 [ -n "$baseline" ] && args+=("--baseline=$baseline")
 [ -n "$timeout" ] && args+=("--timeout=$timeout")

@@ -15,7 +15,7 @@ set -euo pipefail
 version=${VA_CLI_VERSION:-}
 version=${version#v}
 if ! matches '^[0-9]+\.[0-9]+\.[0-9]+(-[0-9A-Za-z.]+)?$' "$version"; then
-  gh_error "cli-version must be an exact release such as 1.8.2 (got '${VA_CLI_VERSION:-}'). 'latest' is not accepted: pin a version."
+  gh_error "cli-version must be an exact release such as 1.12.0 (got '${VA_CLI_VERSION:-}'). 'latest' is not accepted: pin a version."
   exit 2
 fi
 
@@ -41,8 +41,18 @@ case "$os/$arch" in
   macOS/X64) target=x86_64-apple-darwin ext=tar.xz ;;
   macOS/ARM64) target=aarch64-apple-darwin ext=tar.xz ;;
   Windows/X64) target=x86_64-pc-windows-msvc ext=zip ;;
+  Windows/ARM64)
+    # vericto-cli publishes a native Windows ARM64 build from 1.11.0 on.
+    major=${version%%.*} rest=${version#*.}
+    minor=${rest%%.*}
+    if [ "$major" -lt 1 ] || { [ "$major" -eq 1 ] && [ "$minor" -lt 11 ]; }; then
+      gh_error "Windows ARM64 runners need cli-version 1.11.0 or later (got '$version'): earlier CLI releases have no Windows ARM64 build."
+      exit 2
+    fi
+    target=aarch64-pc-windows-msvc ext=zip
+    ;;
   *)
-    gh_error "unsupported runner '$os/$arch'. Supported: Linux X64/ARM64, macOS X64/ARM64, Windows X64."
+    gh_error "unsupported runner '$os/$arch'. Supported: Linux X64/ARM64, macOS X64/ARM64, Windows X64/ARM64."
     exit 2
     ;;
 esac

@@ -175,6 +175,22 @@ expect_eq "$(logged workspace-id)" ws_123 "exports VERICTO_WORKSPACE_ID"
 check "$ws" VA_OIDC=true ACTIONS_ID_TOKEN_REQUEST_URL=https://token.example VA_FILES=migrations/0001_create_users.sql
 expect_eq "$(logged workspace-id)" "<unset>" "no workspace input: left to the CLI (.vericto.toml)"
 
+echo "# offline mode (CLI 1.9.0+) is never used"
+check "$ws" VA_API_KEY="$KEY" VERICTO_OFFLINE=1 VA_FILES=migrations/0001_create_users.sql
+expect_rc 0 "a job-level VERICTO_OFFLINE=1 with an api-key"
+expect_eq "$(logged offline)" "<unset>" "VERICTO_OFFLINE does not reach the CLI"
+expect_out "::warning title=Vericto SQL Check::VERICTO_OFFLINE is set on the job; ignored here: the action always checks online against your workspace's rules." "with a warning"
+case "$(logged args)" in *--offline*) not_ok "passes --offline" "$(logged args)" ;; *) ok "never passes --offline" ;; esac
+check "$ws" VA_OIDC=true VA_WORKSPACE=ws_123 VERICTO_OFFLINE=true ACTIONS_ID_TOKEN_REQUEST_URL=https://token.example \
+  VA_FILES=migrations/0001_create_users.sql
+expect_rc 0 "VERICTO_OFFLINE with oidc (the CLI would exit 2)"
+expect_eq "$(logged offline)" "<unset>" "oidc: VERICTO_OFFLINE does not reach the CLI"
+check "$ws" VA_API_KEY="$KEY" VERICTO_OFFLINE= VA_FILES=migrations/0001_create_users.sql
+expect_eq "$(logged offline)" "<unset>" "an empty VERICTO_OFFLINE is unset too"
+expect_no_out "VERICTO_OFFLINE is set" "an empty VERICTO_OFFLINE: no warning"
+check "$ws" VA_API_KEY="$KEY" VA_FILES=migrations/0001_create_users.sql
+expect_no_out "VERICTO_OFFLINE" "no VERICTO_OFFLINE: no warning"
+
 echo "# CLI arguments"
 check "$ws" VA_API_KEY="$KEY" VA_FILES=migrations/0001_create_users.sql VA_DIALECT=mysql VA_BASELINE="base line.json" \
   VA_TIMEOUT=45 VA_API_URL=https://eu.vericto.example
@@ -251,7 +267,7 @@ if [ -s "$sarif" ]; then ok "sarif-file points at the report"; else not_ok "sari
 expect_output report-file "$sarif" "report-file is the same report"
 expect_out "Running: vericto check --format=sarif --stdin-file-list --output=" "logs the command"
 case "$(summary)" in
-  *"### Vericto SQL Check: PASS"*"| Blocked / flagged / monitored / parse errors | 0 / 0 / 0 / 0 |"*"| SQL checked | 1 file(s) from \`files\` |"*"| CLI | \`vericto 1.8.2\` |"*)
+  *"### Vericto SQL Check: PASS"*"| Blocked / flagged / monitored / parse errors | 0 / 0 / 0 / 0 |"*"| SQL checked | 1 file(s) from \`files\` |"*"| CLI | \`vericto 1.12.0\` |"*)
     ok "job summary: result, counts, selection and CLI version" ;;
   *) not_ok "job summary" "$(summary)" ;;
 esac

@@ -5,9 +5,10 @@
 # A stand-in for the Vericto CLI in test/check-test.sh. It never contacts
 # anything.
 #
-#   vericto --version   prints "vericto $FAKE_VERSION" (default 1.8.2)
-#   vericto check ...   records its arguments, the credentials it was given
-#                       and the file list read from stdin under $FAKE_LOG_DIR,
+#   vericto --version   prints "vericto $FAKE_VERSION" (default 1.12.0)
+#   vericto check ...   records its arguments, the credentials it was given,
+#                       VERICTO_OFFLINE and the file list read from stdin
+#                       under $FAKE_LOG_DIR,
 #                       then reports a finding for every line that starts with
 #                       "DELETE FROM" and has no WHERE, with the decision
 #                       $FAKE_DECISION (default BLOCKED).
@@ -19,7 +20,7 @@
 set -euo pipefail
 
 if [ "${1:-}" = --version ]; then
-  echo "vericto ${FAKE_VERSION:-1.8.2}"
+  echo "vericto ${FAKE_VERSION:-1.12.0}"
   exit 0
 fi
 if [ "${1:-}" != check ]; then
@@ -32,6 +33,7 @@ log=${FAKE_LOG_DIR:?}
 printf '%s\n' "$@" >"$log/args"
 printf '%s' "${VERICTO_API_KEY-<unset>}" >"$log/api-key"
 printf '%s' "${VERICTO_WORKSPACE_ID-<unset>}" >"$log/workspace-id"
+printf '%s' "${VERICTO_OFFLINE-<unset>}" >"$log/offline"
 
 format=sarif output="" list=false
 for a in "$@"; do