v0.6.2 — repairs the v0.6.1 Docker registry regression

Fixed

• v0.6.1 regressed detection of agents run as container images from a
  registry named without a dot: its registry-stripping expression required a
  dot in the host, so docker://registry:5000/all-hands-ai/openhands:0.9,
  docker://localhost:5000/…, and docker://localhost/… were no longer
  recognized (v0.6.0 recognized them). Found by the 2026-09-09 follow-up
  review's live comparison of the two published tarballs. The registry
  component now follows Docker's rule — the first path segment is a registry
  when it contains a dot or a colon or is localhost — and owner identity
  stays exact behind any registry form. Tests in tests/precision.test.ts.
  Frozen benchmark: 0 of 152 cases changed (no snapshot uses a docker://
  agent image).

Changed

• scripts/benchmark/report-behavior.mjs records the SHA-256 of the
  dist/cli.js that scanned, in each report's metadata and in the
  comparison header, so a report identifies the implementation even when the
  working tree was dirty (the Day 8 report had recorded a commit plus 21
  uncommitted changes).

Verified artifact

The attached agentci-guard-0.6.2.tgz is the tarball pnpm package:smoke verified at commit 7defcb51817ef5cd3471052e17a1c2a6e045d330 (10 checks from the extracted tarball without node_modules, including an npm install -g into a temporary prefix and a scan through the resulting bin shim). SHA-256:

ca28b0e2f6ac02324817564c860fa571cede8e70413cf56f860b22e3447cbcf2  agentci-guard-0.6.2.tgz

Install exactly this candidate: npm install -g https://github.com/David-Wu1119/agentci-guard/releases/download/v0.6.2/agentci-guard-0.6.2.tgz then agentci --version (prints 0.6.2). npm registry publication is pending (a separate, human-authorized step; the registry serves 0.1.0). Action route: uses: David-Wu1119/agentci-guard@v0.6.2. The floating v0 moves here only after the published-tag consumer smoke passes. Detector changed relative to v0.6.1 (registry parsing), so this is a new candidate identity; no frozen benchmark case moved.

v0.6.1 — precision patch: exact action owner identity

Fixed

• Action owner identity is exact. Every entry in AI_AGENT_ACTION_PATTERNS
  that began with \b accepted a prefixed owner, because a hyphen is a word
  boundary: not-google-github-actions/run-gemini-cli,
  fake-openai/codex-action, and not-anthropics/claude-code-action all
  matched, and the follow-up review's fixture with the first of these produced
  a critical finding. looksLikeAiAction now requires the vendor match at the
  start of the uses: reference, for every vendor, after reducing a
  docker://registry/owner/image reference to owner/image so an agent
  shipped as a container image keeps matching. Tags, SHAs, subpaths, and
  leading whitespace still match. Tests: tests/precision.test.ts ("action
  owner identity is exact"), tests/agent-gemini.test.ts; corpus case
  lookalike-prefixed-owner (41 cases). Frozen benchmark and corpus contain
  no uses: value where a pattern matched anywhere but the start, so 0 of 152
  cases changed. Detector precision changed, so this is a new candidate
  identity.

Verified artifact

The attached agentci-guard-0.6.1.tgz is the tarball pnpm package:smoke verified at commit da03115c14e9835d02c18a6c730032d6aee9894a (10 checks from the extracted tarball without node_modules, including an npm install -g into a temporary prefix and a scan through the resulting bin shim). SHA-256:

2a54e4222ada56dde128a21e852b15c2d5c96ec3c3e599a381d53c74a91a5f81  agentci-guard-0.6.1.tgz

Install exactly this candidate: npm install -g https://github.com/David-Wu1119/agentci-guard/releases/download/v0.6.1/agentci-guard-0.6.1.tgz then agentci --version (prints 0.6.1). npm registry publication is pending (a separate, human-authorized step; the registry serves 0.1.0). Action route: uses: David-Wu1119/agentci-guard@v0.6.1. The floating v0 moves here only after the published-tag consumer smoke passes. Detector precision changed (owner matching), so this is a new candidate identity relative to v0.6.0; no frozen benchmark case moved.

v0.6.0 — corrective release for the 2026-09-05 external review

Corrective release for the three findings of the 2026-09-05 external review.
The detector changes (Gemini), so this is a new candidate identity; the Day 5
spot-check case u-06 is development material from this version on.

Added

• google-github-actions/run-gemini-cli and its archived predecessor
  google-gemini/gemini-cli-action are recognized as agent actions (review
  finding 3). Before, a workflow handing github.event.comment.body to Gemini
  in a job with contents: write scanned as no agent, no findings, analysis
  complete. Exact repository names only: the vendor's auth, setup-gcloud,
  and deploy-* actions stay silent (pinned by the new gemini-lookalike
  corpus case). Semantics were read from the action's action.yml: its
  github_issue_number/github_pr_number inputs default to the triggering
  event's payload and settings configures MCP servers, so it is treated like
  the other agent actions — presumed to operate on the event, no documented
  write-access gate. tests/agent-gemini.test.ts covers the risky shape with
  and without interpolation, the schedule/dispatch shape (no privileged-agent
  finding), read-only, pull_request_target, and five lookalikes. Corpus grows
  to 40 cases (gemini-write, gemini-lookalike); no existing expectation
  changed. Frozen benchmark: no snapshot references either action, so 0 of 152
  cases changed.
• Organization scans record a repository that could not be fetched as an
  error diagnostic agentci/org-fetch-failed naming the repository and the
  reason, so exported SARIF carries it as a notification instead of an
  unexplained executionSuccessful: false (review finding 2). Archived and
  fork exclusions remain skips, not diagnostics.

Fixed

• agentci org exits 1 when any fetched workflow fails to parse, at every
  --fail-on value, matching scan and the Action (review finding 1). It
  previously checked only fetch failures and finding thresholds, so a malformed
  workflow yielded exit 0 with analysis_complete: false. Error outranks the
  finding threshold; the Markdown and SARIF reports are still written.

Verified artifact

The attached agentci-guard-0.6.0.tgz is the tarball pnpm package:smoke verified at commit 8af758a9779a46e04b3da8e557f067cb6e9d9b3b (10 checks from the extracted tarball without node_modules, including an npm install -g into a temporary prefix and a scan through the resulting bin shim). SHA-256:

e1d56ca2026655b40a05acfaf9f764c49bf55ded447937b05aefd52d0399d23e  agentci-guard-0.6.0.tgz

Install exactly this candidate: npm install -g https://github.com/David-Wu1119/agentci-guard/releases/download/v0.6.0/agentci-guard-0.6.0.tgz then agentci --version (prints 0.6.0). npm registry publication is pending (a separate, human-authorized step; the registry serves 0.1.0). Action route: uses: David-Wu1119/agentci-guard@v0.6.0. The floating v0 moves here only after the published-tag consumer smoke passes. The detector changed (Gemini CLI action), so this is a new candidate identity relative to v0.5.x.

v0.5.1 — packaging patch (CLI ran as a no-op through symlinks)

Fixed

• The CLI ran as a no-op when invoked through a symlink. dist/cli.js
  decided whether it was the main script by comparing import.meta.url, which
  Node resolves through symlinks, with process.argv[1], which it does not;
  on mismatch the module loaded, did nothing, and exited 0. Every npm install -g bin entry is a symlink, so agentci --version and agentci scan
  from a global install printed nothing and exited 0 at v0.5.0 (and earlier
  versions with the same guard). Found on 2026-09-05 when the Day 5 spot check
  ran the release tarball from macOS /tmp, itself a symlink. The comparison
  now resolves the argv path with realpathSync first (isInvokedAsScript,
  unit-tested with a symlinked file and against the committed bundle through a
  symlink), and pnpm package:smoke installs the tarball with npm install -g
  into a temporary prefix and runs the bin shim. scripts/audit-dependencies.mjs
  had the same guard and gets the same fix. Detection code is unchanged; the
  detector remains the one frozen at v0.5.0 for the spot check.

Verified artifact

The attached agentci-guard-0.5.1.tgz is the tarball pnpm package:smoke verified at commit 69613119330324346ed215148db7d672b4e2fd69 (10 checks from the extracted tarball without node_modules, including an npm install -g into a temporary prefix and a scan through the resulting bin shim). SHA-256:

498ad03b588c6a88bed282873bdb9274e7f4e64275f35cb0ce5d8956a6aba3f9  agentci-guard-0.5.1.tgz

Install exactly this candidate: npm install -g https://github.com/David-Wu1119/agentci-guard/releases/download/v0.5.1/agentci-guard-0.5.1.tgz then agentci --version (prints 0.5.1). npm registry publication is pending (a separate, human-authorized step). Action route: uses: David-Wu1119/agentci-guard@v0.5.1. The floating v0 moves here only after the published-tag consumer smoke passes. Detector and rule contract are identical to v0.5.0 — this release fixes packaging only.

v0.5.0 — sprint candidate

Added

• SARIF output now describes the whole scan, not only its findings. When
  toSarif is given a scan result, the run carries an invocation whose
  executionSuccessful is the scan's analysis_complete and whose
  toolExecutionNotifications are the diagnostics (one per diagnostic, with
  the diagnostic code as descriptor, its severity as level, and its file and
  line as location), plus agentci/analysisComplete and
  agentci/diagnosticCount run properties. The CLI (scan and org) and the
  Action write this form. A consumer that only counts results can therefore
  no longer mistake an incomplete zero-finding scan for a clean one. Both forms
  validate against the vendored OASIS SARIF 2.1.0 schema. A bare findings
  array is still accepted and then makes no claim about completeness.
• The Action prints a ::warning:: annotation and appends a note to the step
  summary when the analysis is incomplete, naming the diagnostic codes. Exit
  codes are unchanged: warnings do not fail the step; error diagnostics still
  exit 1 and findings at or above fail-on still exit 2.
• Organization results carry diagnostics (files prefixed by repository, like
  findings) and categories: every scanned repository is in exactly one of
  complete-with-findings, complete-no-findings, incomplete-with-findings,
  incomplete-no-findings, or no-workflows, and the five sum to
  scanned_count. Skipped repositories stay outside all five.

Changed

• The organization report's summary table replaces the single "Repositories
  clean" row, which counted incomplete zero-finding repositories as clean,
  with the five categories above and an explicit note that only
  "Complete, no findings" means the analyzer read everything and reported
  nothing.
• The text report says Analysis: incomplete (N diagnostic(s)) instead of
  partial, matching the analysis_complete field and the organization
  report's vocabulary.

Fixed

• agentci/pull-request-target-ai now honors a recognized actor/provenance
  gate on the agent step, not only on the job, matching the documented gate
  contract. An agent step guarded by github.actor == github.repository_owner
  on pull_request_target was reported critical at v0.4.0. Counterexamples
  pinned by tests/prt-step-gate.test.ts: an unguarded step, a job-level gate,
  the step-level gate, a job mixing a gated and an ungated agent (still
  critical), an || condition that admits untrusted actors (still critical), a
  runtime-output condition the analyzer cannot prove (still critical), an unsafe
  checkout in an earlier unguarded step (still reported; the agent's gate does
  not cover it), and a read-only job with an unguarded agent (still critical —
  pull_request_target exposes secrets regardless of token scope). Frozen
  benchmark: 0 of 152 cases changed; no benchmark workflow places an actor gate
  on an agent step under pull_request_target.

Verified artifact

The attached agentci-guard-0.5.0.tgz is the tarball that pnpm package:smoke verified at commit 38aae8895538a1a511256853c09e208f38a27d3a (8 checks from the extracted tarball without node_modules, including the two behavior changes above). SHA-256:

f2d0495666318ece50c9512eea1343630447f554ba2edc53d9e0bd70b7220f36  agentci-guard-0.5.0.tgz

Install exactly this candidate: npm install -g https://github.com/David-Wu1119/agentci-guard/releases/download/v0.5.0/agentci-guard-0.5.0.tgz. npm registry publication is pending (a separate, human-authorized step); the registry may serve an older version. The Action route is uses: David-Wu1119/agentci-guard@v0.5.0. The floating v0 is moved to this commit only after the published-tag consumer smoke passes.

AgentCI Guard v0.4.0

AgentCI Guard v0.4.0 is a severity-contract release. It adds agentci/gated-ai-write-token (high): the untrusted-trigger, agent, write-token pattern is reported one level below critical when the agent is anthropics/claude-code-action with its documented default write-access gate intact — no allowed_non_write_users or allowed_bots, an event the action's security docs list as checked, and no untrusted text expanded into a run: step. Every bypass, pull_request_target, discussion events, claude-code-base-action, and every other agent stay critical.

The decision was made by the project owner on 2026-09-05 after review of the action's documentation, and is recorded in docs/analysis-model.md, RULES.md, and the adversarial corpus (frozen case local-reusable updated with its rationale; new cases gated-write and gated-write-bypass pin the boundary from both sides).

On the frozen 152-workflow benchmark: critical 30 → 6 across 4 repositories, high 44 → 68, medium and total unchanged. The four repositories that remain critical are exactly the four a full hand-read of every critical finding had identified as genuine exposures. The accuracy boundary is otherwise unchanged — experimental scanner, unmeasured under the labeling protocol.

Install

- uses: David-Wu1119/agentci-guard@v0.4.0

agentci explain agentci/gated-ai-write-token prints the rule's rationale and fixes. Also: agentci org <login> for a whole-organization audit · docker build -t agentci-guard . · pre-commit hook at rev: v0.4.0. npm agentci-guard@0.4.0 is published separately; until then npx agentci-guard resolves to 0.1.0.

Changes

Changed

• New rule agentci/gated-ai-write-token (high). When the untrusted-trigger,
  agent, write-token pattern is present but every ingesting step is
  anthropics/claude-code-action with its default write-access gate intact —
  no allowed_non_write_users or allowed_bots, an event the action's docs
  list as checked, and no untrusted text expanded into a run: step — the
  finding is reported at high instead of untrusted-ai-write-token at
  critical. claude-code-base-action, pull_request_target, discussion
  events, any bypass value, and any other agent keep critical. This is a
  severity contract set by the project owner on 2026-09-05 after review of the
  action's security documentation. Frozen benchmark: critical 30 → 6 across
  4 repositories (each carries a bypass, runs on pull_request_target, or uses
  an unverified agent — the same four a full hand-read had identified), high
  44 → 68, medium unchanged, total unchanged. The adversarial case
  local-reusable is updated to the new contract with its rationale recorded,
  and two cases, gated-write and gated-write-bypass, pin the boundary from
  both sides.

Release gate

docs/release-v0.4.0.md. The floating v0 tag is moved to this release only after published-tag-smoke.yml passes against the immutable tag.

AgentCI Guard v0.3.0

AgentCI Guard v0.3.0 adds one capability on top of v0.2.0: agentci org <login> scans every repository in a GitHub organization or user account without cloning and emits one report — the unit an organization audit delivers.

Detection is unchanged from v0.2.0. The filesystem and organization scanners now share one analysis entry point, and all 152 frozen benchmark cases produce identical results before and after that extraction.

The accuracy boundary is unchanged and still governs every claim: an experimental scanner with unmeasured accuracy under its labeling protocol; one non-blind reader's 86% precision on the critical rule; and claude-code-action's default write-access gate is not modeled (see the README's "What it cannot see"). An organization report inherits all of that — findings are review hypotheses across more repositories, not a stronger claim.

Install

- uses: David-Wu1119/agentci-guard@v0.3.0

export GITHUB_TOKEN=ghp_...
agentci org my-org --markdown org-report.md --sarif org.sarif --fail-on none

Also: docker build -t agentci-guard . · pre-commit hook agentci-guard at rev: v0.3.0. npm agentci-guard@0.3.0 is published separately; until then npx agentci-guard resolves to 0.1.0.

Changes

Added

• agentci org <login> scans every repository in a GitHub organization or user
  account without cloning: repositories are listed through the API, each one's
  workflow files are fetched through the contents API, and the same analysis
  scan performs runs per repository. Output is one Markdown report — totals, a
  severity-sorted repository table, per-repository findings, skipped
  repositories with reasons, incomplete analyses — plus optional JSON and SARIF
  with files prefixed by repository. Archived repositories and forks are skipped
  unless --include-archived / --include-forks; a repository that cannot be
  fetched is reported as skipped and exits 1 so a report with gaps never reads
  as clean. Rate-limit exhaustion is reported with the reset time and a pointer
  to GITHUB_TOKEN. Local reusable workflows resolve exactly as on disk through
  a virtual repository root. The filesystem scanner and the organization scanner
  now share one analysis entry point, scanWorkflowFiles, so a fetched workflow
  is analyzed identically to a checked-out one; the frozen benchmark's per-case
  results are unchanged.

Release gate

docs/release-v0.3.0.md. The floating v0 tag is moved to this release only after published-tag-smoke.yml passes against the immutable tag.

AgentCI Guard v0.2.0

AgentCI Guard v0.2.0 is a detection-correctness and distribution release.

It remains an experimental scanner with unmeasured accuracy under its benchmark's labeling protocol. The one accuracy figure — 86% precision on the critical rule across all 31 critical findings on the frozen 152-workflow benchmark (24 of 28 after this release's fixes) — was produced by a single non-blind reader and is recorded as exactly that. Nineteen of those 24 are further mitigated by anthropics/claude-code-action's default write-access gate, which this release does not model; see the README's "What it cannot see." Do not describe this tool as calibrated or as a production security gate.

Measured against the frozen benchmark at this commit: critical 30 findings / 28 repositories · high 44 · medium 184 · 36-case adversarial corpus unchanged. 168 tests behind an enforced 90/90/90/80 coverage floor.

Install

- uses: David-Wu1119/agentci-guard@v0.2.0

Also: docker build -t agentci-guard . · pre-commit hook agentci-guard at rev: v0.2.0. npm agentci-guard@0.2.0 is published separately; until then npx agentci-guard resolves to 0.1.0.

Changes

Added

• A Dockerfile that packages the committed bundle on node:24-alpine, runs
  as the unprivileged node user, and needs no install step or network access
  at build time. Verified against both example repositories with the CLI's
  exit-code contract intact.
• A .pre-commit-hooks.yaml so the scanner runs on changes under
  .github/workflows/ and fails the commit at high or above.
• docs/OPERATIONS.md, a handbook for running, releasing, and extending the
  tool without the original author: what may truthfully be claimed, the full
  verification gate, how to measure a change against the frozen benchmark, the
  release and v0-tag sequence, and how to add a rule or an agent pattern.
• The README was rewritten around the current state: the honest status
  paragraph now records the four defects found and fixed by hand-reading the
  benchmark, the zizmor comparison on identical inputs, and the TaintAWI prior
  art; a rule table replaces the feature list; container and pre-commit
  quickstarts were added; and a "what it cannot see" section names the
  coverage floor and the chosen false positives.
• Agent detection now anchors the OpenHands organization and leaves the
  repository open, covering the rename from All-Hands-AI and agents published
  under extensions and software-agent-sdk. The previous pattern required
  both a legacy org and a repository named openhands, so
  OpenHands/extensions/plugins/pr-review@main matched nothing: corpus case
  openhands-003 (cloudera/cybersec) produced zero observations on a
  pull_request-triggered review agent holding pull-requests: write and
  issues: write. Eval corpus effect: critical 32 to 33, medium 181 to 184,
  confined to that one case.
• Agent detection now recognizes hosted agent-dispatch HTTP endpoints, a shape
  that uses no action and no local binary. Found by running the frozen
  benchmark's 16 held-out agent-diversity workflows, where two cases invoked a
  coding agent purely over HTTP and produced zero observations, leaving every
  rule inert. Plain inference endpoints are deliberately excluded: a
  chat/completions or messages call returns text and holds no tools, so it
  cannot reach the repository the way the threat model requires. Eval corpus
  effect: high 38 to 44 and medium 179 to 181, confined entirely to the two
  recovered cases, with critical unchanged.

Changed

• The CLI now exposes an in-process run(argv, io, env) entry that returns the
  exit code instead of setting it, so the command surface is exercised and
  measured by the unit suite rather than only through a spawned dist/cli.js.
  Behavior is unchanged: exit 0 clean, 2 at or above threshold, 1 on parse
  errors, bad inputs, or unknown rules. The version string now comes from
  package.json instead of a hard-coded literal.
• pnpm check now enforces a coverage floor (90% lines, statements, and
  functions; 80% branches) as a ratchet. Tests were added for every product
  surface that had none: the Markdown report, config validation and discovery,
  the reusable-workflow permission ceiling, Action input aliasing and
  validation, and the actor-guard expression parser's quoting and
  parenthesization. 112 tests became 150.

Fixed

• Actor-gate recognition now accepts a literal login — github.actor == 'maintainer', the same on sender.login and comment.user.login, and a
  contains(fromJSON([...]), github.actor) allowlist. GitHub resolves the actor
  before the job starts and a stranger cannot be that user, so this is exactly
  as sound as comparing against github.repository_owner. Anthropic's workflow
  template ships this shape with the maintainer's own login filled in, and three
  benchmark repositories using it were reported critical, including
  marktext/marktext (~61k stars). Inequality (!= 'dependabot[bot]') and empty
  allowlists are not accepted. Eval corpus effect: critical 33 to 30, confined
  to those three cases. All 31 critical findings on the benchmark were read by
  hand for this change: 24 are confirmed, these 3 were this class, and 4 are the
  documented runtime-gate limit — 77% precision on the critical rule before
  this fix, 86% after, as measured by a single non-blind reader, not by the
  benchmark's labeling protocol.
• Event reachability now treats a condition made only of always(),
  success(), failure(), and cancelled() as complete and non-narrowing.
  These depend on prior step status, never on the trigger, so they cannot
  exclude an event; the analyzer previously reported them as uninterpretable.
  They are not substituted with true, which would make !cancelled() empty
  the event set. Mixed conditions stay conservative. No finding changes on the
  frozen benchmark; the effect is confined to diagnostics and the
  analysis_complete flag.
• agentci/untrusted-ai-write-token now recognizes agent actions that read
  event content through their own token instead of through a ${{ }}
  expansion. The rule previously required interpolation, which missed the
  dominant real-world shape: an agent action on issue_comment or issues
  holding a write scope, gated only on a trigger phrase any stranger can type.
  Measured against the frozen 152-workflow benchmark, critical findings rise
  from 3 to 32 across 30 repositories, with no change to the 74 flagged
  repositories or the 78 clean ones — existing findings were escalated rather
  than new noise introduced. Three of the recovered cases were hand-verified
  against the upstream workflows. Agent CLI invocations still require
  interpolation, since a run: step receives only what the shell passes it.
• Event reachability now recognizes actor and provenance guards, so a job
  restricted to the repository owner, to same-repository pull requests, or to a
  trusted author_association no longer raises untrusted-reachability
  findings. Recognition is an implication check: A && B is gated when either
  operand is gated, a disjunction only when every operand is. Gates computed by
  workflow code at runtime remain untrusted by design. Measured against the
  frozen 152-workflow benchmark, this removes 2 of 5 critical and 2 of 40 high
  findings, all of them on workflows that were correctly hardened; the 36-case
  adversarial corpus is unchanged.

Release gate

docs/release-v0.2.0.md. The floating v0 tag is moved to this release only after published-tag-smoke.yml passes against the immutable tag.

AgentCI Guard v0.1.1

AgentCI Guard v0.1.1 is a functional-correctness release for the broken v0.1.0 JavaScript Action entrypoint.

What changed:

• the Action now runs through a dedicated bundled Node.js entrypoint and receives manifest inputs;
• real manifest-based CI verifies vulnerable, hardened, and threshold behavior;
• invalid scan roots fail instead of returning a false clean result;
• CLI SARIF and Markdown outputs create missing parent directories;
• workflow semantics, diagnostics, packaging, and reproducibility checks were expanded.

Accuracy remains unmeasured. Human labels, precision, recall, and error analysis are still pending. AgentCI Guard remains an experimental scanner; findings are review hypotheses, not proof of exploitability and not a production security gate.

npm package 0.1.1 is not published by this release.

AgentCI Guard v0.1.0

First tagged release of AgentCI Guard — a CLI and GitHub Action that flags unsafe AI coding-agent usage in CI/CD workflows (prompt-injection exposure when untrusted event content reaches an agent with secrets, write permissions, or shell access).

Highlights

• Precise detection keyed on real agent signals (known actions, CLIs, provider keys, model ids) — low false positives on ordinary CI.
• Eight rules with why + fix, SARIF output for the GitHub Security tab.
• Suppression via inline # agentci-ignore directives or agentci.config.json.
• GitHub Action on the node24 runtime with declared outputs and Marketplace branding.
• Validated on 75 public repos that run AI agents in CI — see docs/real-world-findings.md.

Use

- uses: David-Wu1119/agentci-guard@v0
  with:
    fail-on: high

Feedback on false positives especially welcome — that is the hard part of this class of tool.

What's Changed

• fix: detect AI usage from specific signals, not generic words by @David-Wu1119 in #1
• feat: suppress findings via inline directives and config file by @David-Wu1119 in #6
• fix: stop over-firing on safe AI-agent setups (validated on 75 real repos) by @David-Wu1119 in #3
• feat: action runtime node24, outputs, and Marketplace branding by @David-Wu1119 in #4
• docs: README demo card (SVG) + vhs tape for the GIF by @David-Wu1119 in #5
• chore: pin Action examples to @v0 by @David-Wu1119 in #7

Full Changelog: https://github.com/David-Wu1119/agentci-guard/commits/v0.1.0