Skip to content

chore: release v1.49.0 #15

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Esquetta merged 1 commit into from
Jul 19, 2026
Merged

chore: release v1.49.0 #15

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 14 additions & 0 deletions CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,20 @@ All notable changes to `codex-plugin-doctor` are documented here.

This changelog groups the shipped work into product-level release blocks instead of repeating every low-level git diff in isolation.

## [1.49.0] - 2026-07-19

### Added

- added `doctor corpus metrics diff --before --after` for deterministic precision, recall, and reviewed false-positive share comparisons

@qodo-code-review qodo-code-review Bot Jul 19, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Remediation recommended

1. Changelog missing diff args 🐞 Bug ⚙ Maintainability

The 1.49.0 changelog advertises doctor corpus metrics diff --before --after without the required
report-path arguments, but the CLI requires --before <metrics.json> and --after <metrics.json>.
Users copying the changelog snippet will not be able to run the command as written.
Agent Prompt 
## Issue description
The changelog’s new 1.49.0 entry includes a `doctor corpus metrics diff` example that omits required values for `--before` and `--after`, making the command snippet non-runnable.

## Issue Context
The CLI implementation requires explicit paths for both flags (`--before <metrics.json>` and `--after <metrics.json>`), and the public output contract doc also shows placeholders.

## Fix Focus Areas
- CHANGELOG.md[7-12]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

- added `--fail-on-regression` so CI can block precision or recall decreases and false-positive share increases
- added stable `corpusDigest` identities and a public `doctor.validation.corpus.metrics.diff` output contract

### Security

- reject incomplete, oversized, internally inconsistent, malformed, and different-corpus report pairs with exit `2`
- recompute comparisons from integer finding counts instead of trusting rounded display metrics
- keep input report paths, private corpus paths, source contents, evidence, and reviewer notes out of diff reports

## [1.48.0] - 2026-07-17

### Added
Expand Down
4 changes: 2 additions & 2 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -427,9 +427,9 @@ jobs:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v5
- uses: Esquetta/CodexPluginDoctor@v1.48.0
- uses: Esquetta/CodexPluginDoctor@v1.49.0
with:
version: "1.48.0"
version: "1.49.0"
path: .
runtime: "true"
policy: codex-publish
Expand Down
2 changes: 1 addition & 1 deletion docs/architecture/corpus-metrics-regression-diff.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@

## Status

Planned for `v1.49.0` as an additive comparison layer over the corpus quality metrics shipped in `v1.48.0`.
Shipped in `v1.49.0` as an additive comparison layer over the corpus quality metrics shipped in `v1.48.0`.

## Purpose

Expand Down
36 changes: 18 additions & 18 deletions docs/guides/github-action.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,9 +22,9 @@ jobs:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v5
- uses: Esquetta/CodexPluginDoctor@v1.48.0
- uses: Esquetta/CodexPluginDoctor@v1.49.0
with:
version: "1.48.0"
version: "1.49.0"
path: .
runtime: "true"
policy: codex-publish
Expand All @@ -51,9 +51,9 @@ Every action run also writes `codex-plugin-doctor-action-manifest.json`. The man
Use SARIF when repository security tooling should ingest validation findings.

```yaml
- uses: Esquetta/CodexPluginDoctor@v1.48.0
- uses: Esquetta/CodexPluginDoctor@v1.49.0
with:
version: "1.48.0"
version: "1.49.0"
path: .
sarif: "true"
```
Expand All @@ -65,9 +65,9 @@ The action writes `codex-plugin-doctor.sarif` into `output-dir`. Uploading it to
Use artifact and summary controls when the workflow needs custom retention or wants to disable generated report uploads.

```yaml
- uses: Esquetta/CodexPluginDoctor@v1.48.0
- uses: Esquetta/CodexPluginDoctor@v1.49.0
with:
version: "1.48.0"
version: "1.49.0"
path: .
output-dir: doctor-ci-reports
artifact-name: codex-plugin-doctor-reports
Expand Down Expand Up @@ -100,11 +100,11 @@ The action also exposes these workflow outputs for follow-up steps:
Use review bundle artifacts when a pull request or release workflow should preserve signed runtime approval, runtime policy, attestation, and release evidence handoff files.

```yaml
- uses: Esquetta/CodexPluginDoctor@v1.48.0
- uses: Esquetta/CodexPluginDoctor@v1.49.0
env:
CODEX_PLUGIN_DOCTOR_SIGNING_KEY: ${{ secrets.CODEX_PLUGIN_DOCTOR_SIGNING_KEY }}
with:
version: "1.48.0"
version: "1.49.0"
path: .
review-bundle: "true"
review-bundle-verify: "true"
Expand Down Expand Up @@ -150,9 +150,9 @@ The history file is newline-delimited JSON. Store it as an artifact, cache, or r
The composite action can also append history directly:

```yaml
- uses: Esquetta/CodexPluginDoctor@v1.48.0
- uses: Esquetta/CodexPluginDoctor@v1.49.0
with:
version: "1.48.0"
version: "1.49.0"
path: .
runtime: "true"
history: validation-history.jsonl
Expand All @@ -172,9 +172,9 @@ Use profiles when a consuming workflow needs a named validation policy instead o
The composite action can pass profiles directly:

```yaml
- uses: Esquetta/CodexPluginDoctor@v1.48.0
- uses: Esquetta/CodexPluginDoctor@v1.49.0
with:
version: "1.48.0"
version: "1.49.0"
path: .
profile: publish
```
Expand All @@ -184,9 +184,9 @@ The composite action can pass profiles directly:
Use policy presets when a workflow should apply one of the opinionated release gates without adding a local `.codex-doctor.json`.

```yaml
- uses: Esquetta/CodexPluginDoctor@v1.48.0
- uses: Esquetta/CodexPluginDoctor@v1.49.0
with:
version: "1.48.0"
version: "1.49.0"
path: .
policy: codex-publish
```
Expand All @@ -198,9 +198,9 @@ Supported policy values are `codex-publish`, `mcp-strict`, and `security`. The C
Use installed-cache mode only in environments where Codex plugins are already available on the runner.

```yaml
- uses: Esquetta/CodexPluginDoctor@v1.48.0
- uses: Esquetta/CodexPluginDoctor@v1.49.0
with:
version: "1.48.0"
version: "1.49.0"
installed: "true"
filter: github
runtime: "false"
Expand All @@ -211,9 +211,9 @@ Use installed-cache mode only in environments where Codex plugins are already av
Pin both the action ref and npm package version for reproducible CI:

```yaml
- uses: Esquetta/CodexPluginDoctor@v1.48.0
- uses: Esquetta/CodexPluginDoctor@v1.49.0
with:
version: "1.48.0"
version: "1.49.0"
```

Use `version: "latest"` only when the consuming repository intentionally wants automatic CLI upgrades.
4 changes: 2 additions & 2 deletions package-lock.json
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

2 changes: 1 addition & 1 deletion package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
{
"name": "codex-plugin-doctor",
"version": "1.48.0",
"version": "1.49.0",
"description": "CLI-first validator for Codex plugins, skills, and MCP package surfaces with runtime MCP protocol validation.",
"type": "module",
"main": "./dist/index.js",
Expand Down