Skip to content

v0.5.0 — committed audit manifest

Choose a tag to compare

View all tags
@Booyaka101 Booyaka101 released this 23 Jul 12:38
v0.5.0
e0ca50e

A committable behavior receipt whose git diff is the approval-surface change — the feature @raju_dandigam requested on the launch article (#1).

npx npm-script-lens manifest --write   # writes script-lens.json next to the lockfile
npx npm-script-lens manifest --check   # CI: exit 1 if install-time behavior drifted
  • Stable, sorted, behavior-only map: name@version → { risk, capabilities }. Commit it next to your lockfile and reviewers see capability changes in the normal PR diff — no tooling required.
  • Excludes all trust data (downloads, age, OSV), so the file changes when a package's behavior changes, not when its popularity does. Live malware/trust checks stay in audit.
  • --check prints a human-readable +/-/~ drift diff; a bump in the version field flags that the detector itself changed and results are worth re-reviewing.
  • Action gains manifest-check / manifest-file inputs; drift is written to the PR job summary. This repo's own self-audit workflow now enforces its (empty — we ship no install scripts) manifest.

55 tests green. Full notes in CHANGELOG.md.

Assets 2
Loading