Add install-local command for portable CI/CD installation

[Copilot]

v1.2.0: secureflow install-local command - COMPLETE ✅

• Update version to 1.2.0 in root.go
• Create cmd/install_local.go command file
• Implement logic to download platform-specific executables to .secureflow/ directory
• Create secureflow.sh launcher script template
• Add logic to generate and copy secureflow.sh to current directory
• Test the install-local command manually
• Update documentation (README.md) with install-local usage
• Run tests and build to ensure no regressions
• Address code review feedback
• Security scan (CodeQL) - No issues found
• Update .gitignore with helpful comments
• Clarify README documentation per user feedback

Summary

Successfully implemented the secureflow install-local command for v1.2.0 exactly as requested.

Latest Update (addressing feedback):

Clarified README.md documentation to make it crystal clear that:

• install-local is run LOCALLY (on developer's machine), not in CI/CD
• When you commit .secureflow/ and secureflow.sh to your repo, CI/CD needs NO installation step
• Split examples into two clear approaches:
  • Approach A: Download and install during each CI/CD run (if not committing files)
  • Approach B: Commit files to repo - CI/CD just uses ./secureflow.sh directly (RECOMMENDED)

Key Features:

✅ No sudo required - Perfect for restricted CI/CD environments
✅ Cross-platform - Automatically detects OS and architecture
✅ Portable - Can commit .secureflow/ and secureflow.sh to your repo
✅ Simple - Just run ./secureflow.sh [command] in CI/CD
✅ Robust - Includes timeout, error handling, and success validation

Files Changed:

• cmd/root.go - Updated version to 1.2.0
• cmd/install_local.go - New command (172 lines)
• cmd/secureflow.sh - Launcher script template (74 lines)
• README.md - Comprehensive documentation with clearer examples
• .gitignore - Added helpful comments about local installation files

Ready for release! 🚀

Original prompt

Let's build v1.2

The major update on this version is secureflow install-local

When that command is ran, this is my thought

You would copy a secureflow.sh to the place it is called from then copy executables for windows, linux, etc to .secureflow/**

This way, the user can run secureflow from CICD without needing to first install it.

The secureflow.sh is what would be run, it would dynamically select the right executable to use
You understand ?

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.

[YoungMayor]

@copilot

On the README.md, you made a slight miscommunication.

You stated that the user needed to do "# One-time setup (or commit the files to your repo)" on their CICD, that is wrong, as the local installation is done locally, and when it is done, the user would not need to do any form of installing again on CICD, just use the secureflow.sh file that was added.

You get ?

[Copilot]

@copilot

On the README.md, you made a slight miscommunication.
...

You're absolutely right! I've clarified the README in commit 5500339.

The documentation now clearly separates two approaches:

Approach A: Download and install during each CI/CD run (if you don't want to commit the files)

Approach B (Recommended): Run install-local LOCALLY once, commit .secureflow/ and secureflow.sh to your repo, then CI/CD just uses ./secureflow.sh directly - no installation step needed at all.

The confusing comment "One-time setup (or commit the files to your repo)" has been removed and replaced with clear separate examples showing that when files are committed to the repo, the CI/CD workflow is simply:

- uses: actions/checkout@v3
- name: Decrypt secrets
  run: ./secureflow.sh decrypt --password "${{ secrets.PASSWORD }}" --non-interactive

No installation step needed in CI/CD when using Approach B.