v0.0.3-preview

Supply-chain hardening release for both the doctor command and the release surface of this repository itself. Motivated by the September 2025 durabletask PyPI compromise (Shai-Hulud worm).

Highlights

doctor is now a supply-chain defender

• 5 new Tier 1 deterministic checks (no LLM required):
  • lifecycle-scripts — flags forbidden preinstall / postinstall in the project's package.json.
  • unpinned-prod-deps — flags floating version ranges in production deps.
  • missing-lockfile — warns when package-lock.json/yarn.lock/pnpm-lock.yaml is absent.
  • tracked-secret-files — fails when .env / .env.* files are tracked by git (consults git ls-files, not just .gitignore).
  • install-script-deps — warns when production deps run install-time scripts (excludes well-known natives like sharp, bcrypt).
• 2 new Python Tier 1 checks:
  • python-unpinned-requirements — flags requirements.txt entries not pinned with ==.
  • python-missing-lockfile — warns when no Python lockfile or --hash pinning is present.
• 10 new Tier 2 (LLM) checks SC-101..SC-110 (loaded via references/supply-chain-checks.md): module-load side effects, fetch-then-execute droppers, silent error suppression, C2-like URLs, credential collection, persistence install, lateral movement primitives, anti-analysis guards, hardcoded secrets, suspicious version pinning.
• ALL_CHECKS registry grows from 13 → 20.

--deep is now safe to run in CI

• PR-context refusal: --deep refuses to run on pull request workspaces by default (GITHUB_EVENT_NAME=pull_request, Azure DevOps BUILD_REASON=PullRequest, GitLab MR). Pull request code is untrusted and can prompt-inject the agent. Set AZURE_FUNCTIONS_DOCTOR_TRUST_PR=1 in mirror/release pipelines that need to scan post-merge.
• --deep requires explicit --accept-deep-risk.
• All warning text is pure ASCII to avoid mojibake on Windows PowerShell stderr.

Repository release surface hardening

• Removed the obsolete publish.yml workflow. npm publishing is exclusively handled by the downstream Microsoft mirror pipeline; no NPM_TOKEN lives in this repo.
• Added draft-release.yml so a tag push creates a draft Release for review.
• Added CI guardrails: lint-package-scripts.mjs, lint-skill-content.mjs, audit-npm-token.mjs.
• Added Dependabot config for npm + GitHub Actions.

Documentation

• README now features --deep as the primary doctor example, with a GitHub Actions recipe customers can copy into their own repos to gate deploys.
• Extended SECURITY.md and docs/doctor-guide.md with the supply-chain threat model and trust-boundary guidance.

Bug fixes

• Sanitised the durabletask IOC strings in supply-chain-checks.md that were tripping Windows Defender / Azure SDK release-pipeline anti-malware (Trojan:JS/ShaiWorm.DAH!MTB). Lint patterns added so the verbatim IOCs cannot return.

Distribution

• The package is published to npm as @azure/functions-skills through the Microsoft mirror release pipeline, not from this repository. Tags here produce draft GitHub releases for review only; the actual npm publish is downstream.

Full Changelog: v0.0.2-preview...v0.0.3-preview