opiv0.14.0

CASOON Open Source

Run a repository. Check it before it ships.

opi gives every project the same terminal interface: its scripts in one keyboard-driven list, and the checks its own tools can answer — before a commit, a push, a release or a deployment. npm, pnpm, Yarn, bun and Cargo, without configuring anything first.

curl -fsSL https://raw.githubusercontent.com/casoon/opi/main/install.sh | sh
cargo binstall opi
cargo install opi
MITcrates.io 0.14.0macOS · Linux
opi listing a monorepo's scripts, switching groups, searching across all of them and running one

Run

A better npm run, for every kind of project

The start screen is the project's scripts. Enter runs the highlighted one, / filters across every group, and opi dev skips the list entirely.

  • Grouped by prefix, labelled from scripts-info; past 15 entries or 5 groups the groups become tabs
  • Workspace members appear under their own name: opi blog/dev runs the member’s script
  • cargo run, cargo build and cargo clippy in the same list as the npm scripts
  • The script replaces the opi process, so Ctrl-C and the exit code belong to it
Scripts →Rust projects →Configuration →
opi dev starting the dev server directly, then opi api/db:migrate running a workspace member's script by path

What opi reads, per ecosystem

  • npm
  • pnpm
  • Yarn
  • bun
  • Cargo

Check

Four areas, one key each

opi detects the tools a project already depends on, runs them concurrently and relays what they said. It reimplements no rules and keeps no score.

What each area runs

opi --health running six checks in a project with package.json and Cargo.toml: Docs, Secrets, Lockfile, Lint and Tests pass, Format (rust) fails and rustfmt's diff of src/report.rs is shown under it, ending with '1 of 6 checks failed.'
opi --security: no secrets found by the bundled nosecrets scanner, one high vulnerability in lodash, every installed package's signature verified, a note that no minimum release age is set, no dependencies with install scripts, and the license overview
opi --updates listing lodash 4.17.20 → 4.18.1 as a minor update that is safe to take, with the Rust dependencies current

Recorded with opi 0.14.0 in a demo project with package.json and Cargo.toml, an unformatted Rust file and an old lodash.

HealthSecurityUpdatesClean

Check

Before a commit, a push, a release, a deployment

opi --check commit runs the project checks except tests and dead-code analysis, and looks at what is staged: secrets in the index, whitespace errors, conflict markers and new files over 500 KiB. It writes and stages nothing.

--check push, --check release and --check deploy add the tests and the build on a clean tree — push also checks it is not behind upstream, release that the version is not tagged yet. The deploy check never runs your deploy script.

opi --checks push picks which checks a workflow runs, saved in .opi/checks.json to share in Git. opi --hooks installs the push check as git's pre-push hook, so a repository without CI cannot push a red state by accident.

opi --hooks installing the pre-push hook, then git push running opi --check push: working tree clean, not behind upstream, the checks and both builds, with Format (rust) failing, so the push is refused
WorkflowsHooks and CIMore output in the showcase

New in v0.14.0

Changelog →

Quickstart

Install, change into a project, type opi. Grouping and confirmations can be refined in package.json — see Configuration in the documentation.

  1. Install the release binary with the install script or cargo binstall opi, or build it with cargo install opi.
  2. Change into any directory of a project with a package.json or Cargo.toml.
  3. Run opi and pick a script — or name it: opi dev.
Read the documentation
Usage
opi                 # pick a script
opi dev             # run one directly
opi --check commit  # checks before a commit
opi --hooks         # checks before every push

Frequently asked questions

How do I know a downloaded binary is the one GitHub built?

Every release archive carries a signed build provenance attestation, and the release has a CycloneDX SBOM attested against each archive. gh attestation verify checks both; the installation page has the commands.

Can I check a downloaded binary for known vulnerabilities?

Yes. The release binaries are built with cargo auditable, which embeds the dependency list, so cargo audit bin opi works on the file itself.

Does opi write anything into my project?

Only what you ask for: the hook from opi --hooks, workflow selections from opi --checks in .opi/checks.json, and SBOMs from opi --sbom in .opi/sbom/, which stays ignored. No manifest, lockfile or script is rewritten.

One key to run it, one key to check it.

Read the quickstart