Configuration

CI/lock is args-only: CLI flags are the primary — and almost only — configuration interface. There is no config file. Every knob resolves through three layers, in most-specific-wins order:

Source of truth: rookery/cilock/internal/options/resolve.go and internal/options/root.go.

No config file (removed)

Earlier releases inherited a .witness.yaml YAML config file (with a --config, -c override flag) from the witness lineage. That surface was removed deliberately:

• The default path was CWD-relative, so a malicious cloned repository could ship a .witness.yaml that silently overrode security-critical flags — archivista-server, enable-archivista, signer-file-key-path, policy-ca-roots — redirecting evidence or verification trust anchors without the operator noticing.
• Two sources of truth for "what flags drove this run" complicated audit: the configuration attestor now captures exactly the CLI surface, with nothing hidden in a file.

If you previously used a config file, move the values onto the command line (or generate the command line in your CI templating). --config / -c no longer parse; invocations passing them fail fast with an unknown-flag error.

For repeated infrastructure config (Archivista URL, Fulcio, TSA), prefer --platform-url: everything auto-derives from the platform discovery document, which is one flag instead of five.

Environment variables

CI/lock does not expose a general CILOCK_* env var prefix mirroring its CLI flags — flags are the primary interface. A few low-level feature toggles are read from the environment, though: CILOCK_FANOTIFY and CILOCK_FSVERITY force those capture features on/off (and win over --hardening), CILOCK_TRACE_MODE selects the tracing backend, CILOCK_FANOTIFY_MAX_DIGESTS caps the digest map, and --diagnose (or CILOCK_DIAGNOSE) enables verbose internals, and CILOCK_SUMMARY sets the run summary mode for run and attest. Separately, the cilock-action GitHub Action uses CILOCK_* env vars internally to pass values to CI/lock — that's an action-layer convention, not a CLI-flag prefix.

Run summary

cilock run and cilock attest print a human summary of the run on stderr. --summary sets how much of it you get:

The mode resolves in this order:

1. --summary, when passed.
2. CILOCK_SUMMARY, when set. Set it once in a shared CI library or shell hook instead of editing each invocation.
3. short when cilock detects CI, full otherwise. CI means CI is set to anything other than false or 0, or one of JENKINS_URL, GITHUB_ACTIONS, GITLAB_CI, BUILDKITE, CIRCLECI, TF_BUILD, TEAMCITY_VERSION, CODEBUILD_BUILD_ID, BITBUCKET_BUILD_NUMBER or TRAVIS is set.

An empty value from either source selects the default in step 3. A value other than full, short or none (case-insensitive) fails the run rather than falling back.

short and none also lower the default --log-level to warn and error, which drops cilock's per-stage info progress lines. An explicit --log-level always wins.

The mode changes only cilock's own report. The wrapped command's stdout and stderr, the signed evidence, and the --json result on stdout (always the full summary) are the same in every mode.

# A CI job's log carries one cilock line per step by default. To see the level guidance:
cilock run --summary full --step build -- make build
# Or for every step in the job:
export CILOCK_SUMMARY=full

Example: standardized CI invocations

Per-step CI/lock calls carry their full configuration on the command line:

cilock run --step build --platform-url "$PLATFORM_URL" -- go build ./cmd/myapp
cilock run --step test  --platform-url "$PLATFORM_URL" -- go test ./...

Shared values live in your CI system's variables ($PLATFORM_URL above), not in a file cilock reads implicitly.

For the full set of flags supported under each subcommand, see the CLI reference:

• All run flags → cilock run
• All sign flags → cilock sign
• All verify flags → cilock verify