wrap
Attest any command execution automatically.
treeship wrap runs a command as a subprocess and produces a signed artifact recording what happened.
Usage
treeship wrap [OPTIONS] -- <command> [args...]What gets captured automatically
| Field | Value |
|---|---|
| actor | From --actor flag or TREESHIP_ACTOR env var |
| action | The binary name of the command (or --action override) |
| exit_code | The subprocess exit code; 128 + signal when a signal ended it |
| signal | The signal that ended the subprocess, when one did (JSON output only) |
| elapsed_ms | Elapsed time in milliseconds |
| timestamp | RFC 3339 at the moment of signing |
| parent_id | From --parent flag or TREESHIP_PARENT |
| output_digest | SHA-256 hash of stdout + stderr |
| output_summary | Last non-empty line of stdout (secrets are redacted) |
| chain | Shows parent -> current artifact IDs when auto-chaining |
| signed_key | Key ID used to sign the artifact |
Examples
treeship wrap -- npm testtreeship wrap --actor agent://ci-runner -- cargo build --releasetreeship wrap \
--actor agent://deployer \
--parent art_previous \
-- kubectl apply -f deploy.yamltreeship wrap --push -- npm testThe --push flag pushes the artifact to the Hub immediately after attesting.
Options
| Option | Description |
|---|---|
--actor <uri> | Override default actor |
--action <label> | Override action label (default: executable name) |
--parent <id> | Parent artifact ID for chain linking |
--push | Push to Hub immediately after attesting |
treeship wrap always propagates the subprocess exit code. If your command exits 1, treeship wrap exits 1. A command ended by a signal exits 128 + signal, as a shell reports it (137 for SIGKILL), and the JSON output names the signal in signal. A command that cannot be started exits 127, with nothing signed. The artifact is still signed and stored for every command that ran -- even failed runs are attested.
The propagated code is the child's, so it can coincide with one of treeship wrap's own codes (1 general error, 4 usage, 127 not started): read --format json's exit_code and succeeded, or stderr, to tell them apart.