chore(ci): harden distribution and rewrite the docs - #113
Merged
Merged
Conversation
pixincreate
force-pushed
the
feat/pre-push-range-scan
branch
from
September 14, 2026 16:14
e2748e2 to
0e6c802
Compare
pixincreate
force-pushed
the
chore/ci-distribution-docs
branch
from
September 14, 2026 16:14
788ac2c to
e63cf5b
Compare
pixincreate
force-pushed
the
feat/pre-push-range-scan
branch
from
September 14, 2026 16:17
0e6c802 to
03eac20
Compare
pixincreate
force-pushed
the
chore/ci-distribution-docs
branch
from
September 14, 2026 16:17
e63cf5b to
d73ce53
Compare
pixincreate
force-pushed
the
feat/pre-push-range-scan
branch
from
September 14, 2026 16:19
03eac20 to
dbbd9ee
Compare
pixincreate
force-pushed
the
chore/ci-distribution-docs
branch
from
September 14, 2026 16:19
d73ce53 to
29fd148
Compare
pixincreate
force-pushed
the
feat/pre-push-range-scan
branch
from
September 14, 2026 16:22
dbbd9ee to
38ad3d3
Compare
pixincreate
force-pushed
the
chore/ci-distribution-docs
branch
from
September 14, 2026 16:22
29fd148 to
6476efa
Compare
pixincreate
force-pushed
the
feat/pre-push-range-scan
branch
from
September 14, 2026 16:29
38ad3d3 to
fb1ea4f
Compare
pixincreate
force-pushed
the
chore/ci-distribution-docs
branch
from
September 14, 2026 16:29
6476efa to
5c313d6
Compare
pixincreate
changed the base branch from
feat/pre-push-range-scan
to
master
September 14, 2026 16:32
Workflows: - ci.yml runs with contents: read; it was the only workflow without a permissions block. - docker-publish gates the image build on the test suite, so a tag whose release preflight failed can no longer ship a container and move the latest tag. - update-baseline routes the ref name through env instead of interpolating it into the script. - release.yml drops the dead aarch64 target step (the toolchain step already installs the matrix target) and adds a major-tag job that moves the moving major tag (v2) to each stable release, the same way official actions maintain theirs. Prerelease tags are skipped. Action: - On a missing or malformed report the published exit-code output is the effective failing status instead of a stale 0, and findings-count stays numeric (-1 when unknown). Distribution and tooling: - The container image sets WORKDIR /workspace so the documented mount works without --workdir. - just check runs clippy with -D warnings to match CI; the bench recipe is dropped (no benches exist). - release.sh calls the validated function directly instead of eval, collapses an if/else with identical branches, and matches CHANGELOG versions as anchored fixed strings. Docs: - README rewritten: usage is split into command-line scanning and git hooks, options are tables, and the wording is plain. - CHANGELOG documents the unreleased behavior changes, the baseline upgrade notes, and the keep-a-changelog section structure is fixed. - The committed baseline is pruned, which also folds pre-anchoring path spellings into repository-root-relative entries. Assisted-by: Claude Fable 5 Signed-off-by: PiX <69745008+pixincreate@users.noreply.github.com>
pixincreate
force-pushed
the
chore/ci-distribution-docs
branch
from
September 14, 2026 16:33
5c313d6 to
a76565d
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Stacked PR 5 of 5 (base:
feat/pre-push-range-scan).Workflows: least-privilege permissions on ci.yml, the docker publish gated on the test suite, the ref name routed through env in update-baseline, a dead build step removed from release.yml, and a major-tag job that moves
v2to each stable release the way official actions maintain their major tags.Action: on a missing or malformed report the
exit-codeoutput carries the effective failing status instead of a stale 0, andfindings-countstays numeric.Tooling: the container image gains
WORKDIR /workspace,just checkmatches CI's clippy strictness, and release.sh drops anevaland an identical if/else.Docs: the README is rewritten in plain language with usage split into command-line scanning and git hooks; the CHANGELOG documents the unreleased changes and upgrade notes. The committed baseline is pruned.