chore: prepare v1.50.0 release

CHANGELOG.md

@@ -4,6 +4,20 @@ All notable changes to `codex-plugin-doctor` are documented here.
 
 This changelog groups the shipped work into product-level release blocks instead of repeating every low-level git diff in isolation.
 
+## [1.50.0] - 2026-07-21
+
+### Added
+
+- added GitHub Action inputs for private corpus metrics manifests, retained baselines, and opt-in regression failure gates
+- added public-safe `corpus-metrics.json` and `corpus-metrics-diff.json` artifact outputs and Action output paths
+- added corpus metrics and regression report entries to the generated GitHub Action artifact manifest
+
+### Security
+
+- pass corpus metrics paths through step environment variables instead of interpolating them into the shell script
+- keep snapshots, manifest contents, local paths, source material, evidence, and review notes out of uploaded quality reports
+- reject incomplete corpus quality gate input combinations with exit `2`
+
 ## [1.49.0] - 2026-07-19
 
 ### Added

README.md

@@ -427,9 +427,9 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v5
-      - uses: Esquetta/CodexPluginDoctor@v1.49.0
+      - uses: Esquetta/CodexPluginDoctor@v1.50.0
         with:
-          version: "1.49.0"
+          version: "1.50.0"
           path: .
           runtime: "true"
           policy: codex-publish

docs/guides/github-action.md

@@ -22,9 +22,9 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v5
-      - uses: Esquetta/CodexPluginDoctor@v1.49.0
+      - uses: Esquetta/CodexPluginDoctor@v1.50.0
         with:
-          version: "1.49.0"
+          version: "1.50.0"
           path: .
           runtime: "true"
           policy: codex-publish
@@ -51,9 +51,9 @@ Every action run also writes `codex-plugin-doctor-action-manifest.json`. The man
 Use SARIF when repository security tooling should ingest validation findings.
 
 ```yaml
-- uses: Esquetta/CodexPluginDoctor@v1.49.0
+- uses: Esquetta/CodexPluginDoctor@v1.50.0
   with:
-    version: "1.49.0"
+    version: "1.50.0"
     path: .
     sarif: "true"
 ```
@@ -65,9 +65,9 @@ The action writes `codex-plugin-doctor.sarif` into `output-dir`. Uploading it to
 Use artifact and summary controls when the workflow needs custom retention or wants to disable generated report uploads.
 
 ```yaml
-- uses: Esquetta/CodexPluginDoctor@v1.49.0
+- uses: Esquetta/CodexPluginDoctor@v1.50.0
   with:
-    version: "1.49.0"
+    version: "1.50.0"
     path: .
     output-dir: doctor-ci-reports
     artifact-name: codex-plugin-doctor-reports
@@ -102,11 +102,11 @@ The action also exposes these workflow outputs for follow-up steps:
 Use review bundle artifacts when a pull request or release workflow should preserve signed runtime approval, runtime policy, attestation, and release evidence handoff files.
 
 ```yaml
-- uses: Esquetta/CodexPluginDoctor@v1.49.0
+- uses: Esquetta/CodexPluginDoctor@v1.50.0
   env:
     CODEX_PLUGIN_DOCTOR_SIGNING_KEY: ${{ secrets.CODEX_PLUGIN_DOCTOR_SIGNING_KEY }}
   with:
-    version: "1.49.0"
+    version: "1.50.0"
     path: .
     review-bundle: "true"
     review-bundle-verify: "true"
@@ -137,19 +137,19 @@ The CLI can produce badge output for release notes, README automation, or a stat
 Use a private corpus metrics manifest to measure reviewed precision, recall, and false-positive share in CI. The action writes only the public-safe metrics report into its artifact directory; snapshots, manifest contents, local paths, and review notes are not copied.
 
 ```yaml
-- uses: Esquetta/CodexPluginDoctor@v1.49.0
+- uses: Esquetta/CodexPluginDoctor@v1.50.0
   with:
-    version: "1.49.0"
+    version: "1.50.0"
     path: .
     corpus-metrics-manifest: ../private-corpus/metrics.json
 ```
 
 This writes `corpus-metrics.json`. To compare the result with a retained report and fail the job on regression:
 
 ```yaml
-- uses: Esquetta/CodexPluginDoctor@v1.49.0
+- uses: Esquetta/CodexPluginDoctor@v1.50.0
   with:
-    version: "1.49.0"
+    version: "1.50.0"
     path: .
     corpus-metrics-manifest: ../private-corpus/metrics.json
     corpus-metrics-baseline: .doctor-baselines/corpus-metrics.json
@@ -178,9 +178,9 @@ The history file is newline-delimited JSON. Store it as an artifact, cache, or r
 The composite action can also append history directly:
 
 ```yaml
-- uses: Esquetta/CodexPluginDoctor@v1.49.0
+- uses: Esquetta/CodexPluginDoctor@v1.50.0
   with:
-    version: "1.49.0"
+    version: "1.50.0"
     path: .
     runtime: "true"
     history: validation-history.jsonl
@@ -200,9 +200,9 @@ Use profiles when a consuming workflow needs a named validation policy instead o
 The composite action can pass profiles directly:
 
 ```yaml
-- uses: Esquetta/CodexPluginDoctor@v1.49.0
+- uses: Esquetta/CodexPluginDoctor@v1.50.0
   with:
-    version: "1.49.0"
+    version: "1.50.0"
     path: .
     profile: publish
 ```
@@ -212,9 +212,9 @@ The composite action can pass profiles directly:
 Use policy presets when a workflow should apply one of the opinionated release gates without adding a local `.codex-doctor.json`.
 
 ```yaml
-- uses: Esquetta/CodexPluginDoctor@v1.49.0
+- uses: Esquetta/CodexPluginDoctor@v1.50.0
   with:
-    version: "1.49.0"
+    version: "1.50.0"
     path: .
     policy: codex-publish
 ```
@@ -226,9 +226,9 @@ Supported policy values are `codex-publish`, `mcp-strict`, and `security`. The C
 Use installed-cache mode only in environments where Codex plugins are already available on the runner.
 
 ```yaml
-- uses: Esquetta/CodexPluginDoctor@v1.49.0
+- uses: Esquetta/CodexPluginDoctor@v1.50.0
   with:
-    version: "1.49.0"
+    version: "1.50.0"
     installed: "true"
     filter: github
     runtime: "false"
@@ -239,9 +239,9 @@ Use installed-cache mode only in environments where Codex plugins are already av
 Pin both the action ref and npm package version for reproducible CI:
 
 ```yaml
-- uses: Esquetta/CodexPluginDoctor@v1.49.0
+- uses: Esquetta/CodexPluginDoctor@v1.50.0
   with:
-    version: "1.49.0"
+    version: "1.50.0"
 ```
 
 Use `version: "latest"` only when the consuming repository intentionally wants automatic CLI upgrades.

package.json

@@ -1,6 +1,6 @@
 {
   "name": "codex-plugin-doctor",
-  "version": "1.49.0",
+  "version": "1.50.0",
   "description": "CLI-first validator for Codex plugins, skills, and MCP package surfaces with runtime MCP protocol validation.",
   "type": "module",
   "main": "./dist/index.js",