From 7e170b1bd97748528840245b948500388b817be3 Mon Sep 17 00:00:00 2001 From: Furkan Date: Tue, 21 Jul 2026 10:33:57 +0300 Subject: [PATCH] chore: prepare v1.50.0 release --- CHANGELOG.md | 14 ++++++++++++ README.md | 4 ++-- docs/guides/github-action.md | 44 ++++++++++++++++++------------------ package-lock.json | 4 ++-- package.json | 2 +- 5 files changed, 41 insertions(+), 27 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 68c5589..243fcaa 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -4,6 +4,20 @@ All notable changes to `codex-plugin-doctor` are documented here. This changelog groups the shipped work into product-level release blocks instead of repeating every low-level git diff in isolation. +## [1.50.0] - 2026-07-21 + +### Added + +- added GitHub Action inputs for private corpus metrics manifests, retained baselines, and opt-in regression failure gates +- added public-safe `corpus-metrics.json` and `corpus-metrics-diff.json` artifact outputs and Action output paths +- added corpus metrics and regression report entries to the generated GitHub Action artifact manifest + +### Security + +- pass corpus metrics paths through step environment variables instead of interpolating them into the shell script +- keep snapshots, manifest contents, local paths, source material, evidence, and review notes out of uploaded quality reports +- reject incomplete corpus quality gate input combinations with exit `2` + ## [1.49.0] - 2026-07-19 ### Added diff --git a/README.md b/README.md index 5fa5546..ae737eb 100644 --- a/README.md +++ b/README.md @@ -427,9 +427,9 @@ jobs: runs-on: ubuntu-latest steps: - uses: actions/checkout@v5 - - uses: Esquetta/CodexPluginDoctor@v1.49.0 + - uses: Esquetta/CodexPluginDoctor@v1.50.0 with: - version: "1.49.0" + version: "1.50.0" path: . runtime: "true" policy: codex-publish diff --git a/docs/guides/github-action.md b/docs/guides/github-action.md index ef55808..dc2a9c1 100644 --- a/docs/guides/github-action.md +++ b/docs/guides/github-action.md @@ -22,9 +22,9 @@ jobs: runs-on: ubuntu-latest steps: - uses: actions/checkout@v5 - - uses: Esquetta/CodexPluginDoctor@v1.49.0 + - uses: Esquetta/CodexPluginDoctor@v1.50.0 with: - version: "1.49.0" + version: "1.50.0" path: . runtime: "true" policy: codex-publish @@ -51,9 +51,9 @@ Every action run also writes `codex-plugin-doctor-action-manifest.json`. The man Use SARIF when repository security tooling should ingest validation findings. ```yaml -- uses: Esquetta/CodexPluginDoctor@v1.49.0 +- uses: Esquetta/CodexPluginDoctor@v1.50.0 with: - version: "1.49.0" + version: "1.50.0" path: . sarif: "true" ``` @@ -65,9 +65,9 @@ The action writes `codex-plugin-doctor.sarif` into `output-dir`. Uploading it to Use artifact and summary controls when the workflow needs custom retention or wants to disable generated report uploads. ```yaml -- uses: Esquetta/CodexPluginDoctor@v1.49.0 +- uses: Esquetta/CodexPluginDoctor@v1.50.0 with: - version: "1.49.0" + version: "1.50.0" path: . output-dir: doctor-ci-reports artifact-name: codex-plugin-doctor-reports @@ -102,11 +102,11 @@ The action also exposes these workflow outputs for follow-up steps: Use review bundle artifacts when a pull request or release workflow should preserve signed runtime approval, runtime policy, attestation, and release evidence handoff files. ```yaml -- uses: Esquetta/CodexPluginDoctor@v1.49.0 +- uses: Esquetta/CodexPluginDoctor@v1.50.0 env: CODEX_PLUGIN_DOCTOR_SIGNING_KEY: ${{ secrets.CODEX_PLUGIN_DOCTOR_SIGNING_KEY }} with: - version: "1.49.0" + version: "1.50.0" path: . review-bundle: "true" review-bundle-verify: "true" @@ -137,9 +137,9 @@ The CLI can produce badge output for release notes, README automation, or a stat Use a private corpus metrics manifest to measure reviewed precision, recall, and false-positive share in CI. The action writes only the public-safe metrics report into its artifact directory; snapshots, manifest contents, local paths, and review notes are not copied. ```yaml -- uses: Esquetta/CodexPluginDoctor@v1.49.0 +- uses: Esquetta/CodexPluginDoctor@v1.50.0 with: - version: "1.49.0" + version: "1.50.0" path: . corpus-metrics-manifest: ../private-corpus/metrics.json ``` @@ -147,9 +147,9 @@ Use a private corpus metrics manifest to measure reviewed precision, recall, and This writes `corpus-metrics.json`. To compare the result with a retained report and fail the job on regression: ```yaml -- uses: Esquetta/CodexPluginDoctor@v1.49.0 +- uses: Esquetta/CodexPluginDoctor@v1.50.0 with: - version: "1.49.0" + version: "1.50.0" path: . corpus-metrics-manifest: ../private-corpus/metrics.json corpus-metrics-baseline: .doctor-baselines/corpus-metrics.json @@ -178,9 +178,9 @@ The history file is newline-delimited JSON. Store it as an artifact, cache, or r The composite action can also append history directly: ```yaml -- uses: Esquetta/CodexPluginDoctor@v1.49.0 +- uses: Esquetta/CodexPluginDoctor@v1.50.0 with: - version: "1.49.0" + version: "1.50.0" path: . runtime: "true" history: validation-history.jsonl @@ -200,9 +200,9 @@ Use profiles when a consuming workflow needs a named validation policy instead o The composite action can pass profiles directly: ```yaml -- uses: Esquetta/CodexPluginDoctor@v1.49.0 +- uses: Esquetta/CodexPluginDoctor@v1.50.0 with: - version: "1.49.0" + version: "1.50.0" path: . profile: publish ``` @@ -212,9 +212,9 @@ The composite action can pass profiles directly: Use policy presets when a workflow should apply one of the opinionated release gates without adding a local `.codex-doctor.json`. ```yaml -- uses: Esquetta/CodexPluginDoctor@v1.49.0 +- uses: Esquetta/CodexPluginDoctor@v1.50.0 with: - version: "1.49.0" + version: "1.50.0" path: . policy: codex-publish ``` @@ -226,9 +226,9 @@ Supported policy values are `codex-publish`, `mcp-strict`, and `security`. The C Use installed-cache mode only in environments where Codex plugins are already available on the runner. ```yaml -- uses: Esquetta/CodexPluginDoctor@v1.49.0 +- uses: Esquetta/CodexPluginDoctor@v1.50.0 with: - version: "1.49.0" + version: "1.50.0" installed: "true" filter: github runtime: "false" @@ -239,9 +239,9 @@ Use installed-cache mode only in environments where Codex plugins are already av Pin both the action ref and npm package version for reproducible CI: ```yaml -- uses: Esquetta/CodexPluginDoctor@v1.49.0 +- uses: Esquetta/CodexPluginDoctor@v1.50.0 with: - version: "1.49.0" + version: "1.50.0" ``` Use `version: "latest"` only when the consuming repository intentionally wants automatic CLI upgrades. diff --git a/package-lock.json b/package-lock.json index c29d9f3..2ff4e04 100644 --- a/package-lock.json +++ b/package-lock.json @@ -1,12 +1,12 @@ { "name": "codex-plugin-doctor", - "version": "1.49.0", + "version": "1.50.0", "lockfileVersion": 3, "requires": true, "packages": { "": { "name": "codex-plugin-doctor", - "version": "1.49.0", + "version": "1.50.0", "license": "MIT", "bin": { "codex-plugin-doctor": "dist/cli.js" diff --git a/package.json b/package.json index 1d785a0..1f1bd17 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "codex-plugin-doctor", - "version": "1.49.0", + "version": "1.50.0", "description": "CLI-first validator for Codex plugins, skills, and MCP package surfaces with runtime MCP protocol validation.", "type": "module", "main": "./dist/index.js",