v1.10.0 — Trust and packaging hardening

Codex Guard 1.10.0 focuses on trust: reports no longer re-leak the secrets they detect, observe mode is genuinely non-blocking, and the Action now ships as a reproducible bundle with clean runtime dependencies.

Highlights

• Redacts secret-shaped values from every exported source context, including findings-json and TODO report lines.
• Makes soft-fail produce a neutral check-run with honest observe-mode wording.
• Paginates commit inspection beyond 100 commits.
• Handles large local diffs safely and passes git refs without shell interpolation.
• Replaces committed node_modules with a checked-in dist/ bundle that CI verifies against source.
• Updates the GitHub Actions runtime dependencies and removes all known production audit findings.
• Adds an npm OIDC trusted-publishing workflow for future releases.
• Updates first-party workflows to actions/checkout@v7 and actions/setup-node@v7.

Install or upgrade

- uses: Akimiya-z/codex-guard@v1

Pin this exact release with Akimiya-z/codex-guard@v1.10.0, or run the CLI without installing it:

npx --yes codex-guard@1.10.0 --git --commits

The v1 major tag points to this release. npm users receive 1.10.0 from the latest dist-tag.