From 8ec0cb1a5e55f7e4455ec43750445e89bb4a1815 Mon Sep 17 00:00:00 2001 From: Furkan Date: Sun, 19 Jul 2026 13:31:59 +0300 Subject: [PATCH] chore: release v1.49.0 --- CHANGELOG.md | 14 ++++++++ README.md | 4 +-- .../corpus-metrics-regression-diff.md | 2 +- docs/guides/github-action.md | 36 +++++++++---------- package-lock.json | 4 +-- package.json | 2 +- 6 files changed, 38 insertions(+), 24 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index a75a675..68c5589 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -4,6 +4,20 @@ All notable changes to `codex-plugin-doctor` are documented here. This changelog groups the shipped work into product-level release blocks instead of repeating every low-level git diff in isolation. +## [1.49.0] - 2026-07-19 + +### Added + +- added `doctor corpus metrics diff --before --after` for deterministic precision, recall, and reviewed false-positive share comparisons +- added `--fail-on-regression` so CI can block precision or recall decreases and false-positive share increases +- added stable `corpusDigest` identities and a public `doctor.validation.corpus.metrics.diff` output contract + +### Security + +- reject incomplete, oversized, internally inconsistent, malformed, and different-corpus report pairs with exit `2` +- recompute comparisons from integer finding counts instead of trusting rounded display metrics +- keep input report paths, private corpus paths, source contents, evidence, and reviewer notes out of diff reports + ## [1.48.0] - 2026-07-17 ### Added diff --git a/README.md b/README.md index c746751..8ed22a0 100644 --- a/README.md +++ b/README.md @@ -427,9 +427,9 @@ jobs: runs-on: ubuntu-latest steps: - uses: actions/checkout@v5 - - uses: Esquetta/CodexPluginDoctor@v1.48.0 + - uses: Esquetta/CodexPluginDoctor@v1.49.0 with: - version: "1.48.0" + version: "1.49.0" path: . runtime: "true" policy: codex-publish diff --git a/docs/architecture/corpus-metrics-regression-diff.md b/docs/architecture/corpus-metrics-regression-diff.md index b523ea0..7d6b41e 100644 --- a/docs/architecture/corpus-metrics-regression-diff.md +++ b/docs/architecture/corpus-metrics-regression-diff.md @@ -2,7 +2,7 @@ ## Status -Planned for `v1.49.0` as an additive comparison layer over the corpus quality metrics shipped in `v1.48.0`. +Shipped in `v1.49.0` as an additive comparison layer over the corpus quality metrics shipped in `v1.48.0`. ## Purpose diff --git a/docs/guides/github-action.md b/docs/guides/github-action.md index 02cc443..20d5f5c 100644 --- a/docs/guides/github-action.md +++ b/docs/guides/github-action.md @@ -22,9 +22,9 @@ jobs: runs-on: ubuntu-latest steps: - uses: actions/checkout@v5 - - uses: Esquetta/CodexPluginDoctor@v1.48.0 + - uses: Esquetta/CodexPluginDoctor@v1.49.0 with: - version: "1.48.0" + version: "1.49.0" path: . runtime: "true" policy: codex-publish @@ -51,9 +51,9 @@ Every action run also writes `codex-plugin-doctor-action-manifest.json`. The man Use SARIF when repository security tooling should ingest validation findings. ```yaml -- uses: Esquetta/CodexPluginDoctor@v1.48.0 +- uses: Esquetta/CodexPluginDoctor@v1.49.0 with: - version: "1.48.0" + version: "1.49.0" path: . sarif: "true" ``` @@ -65,9 +65,9 @@ The action writes `codex-plugin-doctor.sarif` into `output-dir`. Uploading it to Use artifact and summary controls when the workflow needs custom retention or wants to disable generated report uploads. ```yaml -- uses: Esquetta/CodexPluginDoctor@v1.48.0 +- uses: Esquetta/CodexPluginDoctor@v1.49.0 with: - version: "1.48.0" + version: "1.49.0" path: . output-dir: doctor-ci-reports artifact-name: codex-plugin-doctor-reports @@ -100,11 +100,11 @@ The action also exposes these workflow outputs for follow-up steps: Use review bundle artifacts when a pull request or release workflow should preserve signed runtime approval, runtime policy, attestation, and release evidence handoff files. ```yaml -- uses: Esquetta/CodexPluginDoctor@v1.48.0 +- uses: Esquetta/CodexPluginDoctor@v1.49.0 env: CODEX_PLUGIN_DOCTOR_SIGNING_KEY: ${{ secrets.CODEX_PLUGIN_DOCTOR_SIGNING_KEY }} with: - version: "1.48.0" + version: "1.49.0" path: . review-bundle: "true" review-bundle-verify: "true" @@ -150,9 +150,9 @@ The history file is newline-delimited JSON. Store it as an artifact, cache, or r The composite action can also append history directly: ```yaml -- uses: Esquetta/CodexPluginDoctor@v1.48.0 +- uses: Esquetta/CodexPluginDoctor@v1.49.0 with: - version: "1.48.0" + version: "1.49.0" path: . runtime: "true" history: validation-history.jsonl @@ -172,9 +172,9 @@ Use profiles when a consuming workflow needs a named validation policy instead o The composite action can pass profiles directly: ```yaml -- uses: Esquetta/CodexPluginDoctor@v1.48.0 +- uses: Esquetta/CodexPluginDoctor@v1.49.0 with: - version: "1.48.0" + version: "1.49.0" path: . profile: publish ``` @@ -184,9 +184,9 @@ The composite action can pass profiles directly: Use policy presets when a workflow should apply one of the opinionated release gates without adding a local `.codex-doctor.json`. ```yaml -- uses: Esquetta/CodexPluginDoctor@v1.48.0 +- uses: Esquetta/CodexPluginDoctor@v1.49.0 with: - version: "1.48.0" + version: "1.49.0" path: . policy: codex-publish ``` @@ -198,9 +198,9 @@ Supported policy values are `codex-publish`, `mcp-strict`, and `security`. The C Use installed-cache mode only in environments where Codex plugins are already available on the runner. ```yaml -- uses: Esquetta/CodexPluginDoctor@v1.48.0 +- uses: Esquetta/CodexPluginDoctor@v1.49.0 with: - version: "1.48.0" + version: "1.49.0" installed: "true" filter: github runtime: "false" @@ -211,9 +211,9 @@ Use installed-cache mode only in environments where Codex plugins are already av Pin both the action ref and npm package version for reproducible CI: ```yaml -- uses: Esquetta/CodexPluginDoctor@v1.48.0 +- uses: Esquetta/CodexPluginDoctor@v1.49.0 with: - version: "1.48.0" + version: "1.49.0" ``` Use `version: "latest"` only when the consuming repository intentionally wants automatic CLI upgrades. diff --git a/package-lock.json b/package-lock.json index 20eee60..c29d9f3 100644 --- a/package-lock.json +++ b/package-lock.json @@ -1,12 +1,12 @@ { "name": "codex-plugin-doctor", - "version": "1.48.0", + "version": "1.49.0", "lockfileVersion": 3, "requires": true, "packages": { "": { "name": "codex-plugin-doctor", - "version": "1.48.0", + "version": "1.49.0", "license": "MIT", "bin": { "codex-plugin-doctor": "dist/cli.js" diff --git a/package.json b/package.json index aa1cbe3..1d785a0 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "codex-plugin-doctor", - "version": "1.48.0", + "version": "1.49.0", "description": "CLI-first validator for Codex plugins, skills, and MCP package surfaces with runtime MCP protocol validation.", "type": "module", "main": "./dist/index.js",