feat(cli): compile plugin to native CLI

[Monforton]

Summary by mrge

Added a native CLI tool for sending JUnit test reports to Fern, with cross-platform builds and a GitHub workflow to publish native executables.

• New Features
  • New CLI with commands for sending test reports.
  • Native builds for Windows, macOS, and Linux using GraalVM.
  • GitHub Actions workflow to build and release native executables.

[cubic-dev-ai]

mrge found 13 issues across 10 files. View them in mrge.io

[cubic-dev-ai]

mrge found 12 issues across 9 files. View them in mrge.io

[kusari-inspector]

Kusari Analysis Results

Analysis for commit: 976e602, performed at: 2025-06-06T21:25:09Z

• @kusari-inspector rerun - Trigger a re-analysis of this PR

• @kusari-inspector feedback [your message] - Send feedback to our AI and team

---

Recommendation

✅ PROCEED with this Pull Request

Summary

✅ No Flagged Issues Detected

All values appear to be within acceptable risk parameters.

The PR introduces a native CLI build feature with no dependency changes or code vulnerabilities. While there are several GitHub Actions workflow security issues, they are configuration-related rather than functional code problems. The previous command injection vulnerability appears to have been addressed, making the core changes safe to merge.

Found this helpful? Give it a 👍 or 👎 reaction!

Click to expand for details and specific link to issues

Recommended Mitigations

Recommended Code Mitigations

Location: .github/workflows/release.yml:35
Pin GitHub Actions to specific commit hashes instead of version tags for better security against supply chain attacks.

Potential Code Fix:

      - name: Setup GraalVM
        uses: graalvm/setup-graalvm@<specific-commit-hash> # Replace with actual hash

Location: .github/workflows/release.yml:66
Pin GitHub Actions to specific commit hashes instead of version tags for better security against supply chain attacks.

Potential Code Fix:

      - name: Create GitHub Release
        id: create_release
        uses: ncipollo/release-action@<specific-commit-hash> # Replace with actual hash

Location: .github/workflows/release.yml:3
Add a permissions block to limit workflow permissions to only what's needed, following the principle of least privilege.

Potential Code Fix:

on:
  workflow_dispatch:
    inputs:
      tag:
        description: 'Tag for the release (e.g., 1.0.0)'
        required: true
        default: '0.0.0'
      draft-release:
        description: 'Should this release be a draft?'
        type: boolean
        required: false
        default: true

permissions:
  contents: write # For creating releases
  actions: read # For artifacts

Location: .github/workflows/release.yml:32
Set persist-credentials to false to prevent credential persistence through GitHub Actions artifacts.

Potential Code Fix:

      - name: Checkout code
        uses: actions/checkout@v4
        with:
          persist-credentials: false

[kusari-inspector]

Kusari PR Analysis rerun based on - 976e602 performed at: 2025-06-06T21:25:09Z - link to updated analysis