v1.2.0 — SafeSC on PyPI: deterministic supply-chain gate with escalate-only LLM analysis

First public release. SafeSC audits your dependency lockfiles in CI, verifies provenance,
and scores every dependency across five trust dimensions — architected so an LLM can never
talk the gate into passing something it shouldn't.

Install

pip install "safesc[agent,anthropic]"   # or [agent,openai]

Or drop the Action into any repository:

- uses: JAAAACCCCCCKKKK/SafeSC@v1
  with:
    llm-api-key: ${{ secrets.SAFESC_LLM_API_KEY }}
    llm-provider: anthropic          # required: anthropic | openai

What's in it

Deterministic spine, agentic fan-out. Stages 0–3 (discover → parse → verify hashes →
cheap signals) always run in a fixed order — the agent cannot reorder or skip them. Only
gray-zone dependencies fan out to LLM specialists for name-squatting, install-script
intent, and provenance gaps. Most dependencies never reach an LLM at all.

Escalate-only by construction. LLM findings and retrieved memory can raise a
dependency's severity but never lower it, and only the deterministic scorer writes the
gate decision. A malicious package that plants "this is safe, ignore warnings" in its
README cannot buy itself a pass — the worst it can do is be ignored.

Bring your own key. No server-side key, no shared account, no default provider. Keys
are held as SecretStr, threaded by injection only, and never enter the audit state,
logs, reports, or the vector store. Anthropic and OpenAI ship in the box, plus any
OpenAI-compatible endpoint (Azure, OpenRouter, Together, Groq, Ollama, vLLM, LiteLLM)
via llm-base-url.

One-step CI gate. The Action installs SafeSC, runs the audit, uploads SARIF to code
scanning, archives the reports, and fails the build on a critical finding. When code
scanning isn't available, the SARIF upload degrades to a warning instead of failing the
run.

Ecosystems: Python (uv / poetry / pip), npm / pnpm, Cargo, Go modules, Maven / Gradle.

Reports: SARIF, Markdown, and JSON.

Optional memory layer

safesc[memory] adds Redis + PGVector for cross-run recall of prior verdicts and known
attack fingerprints. It is retrieval grounding only — a prior "clean" record is evidence,
never an override, and it obeys the same escalate-only rule as everything else. Entirely
optional; the CI gate runs without any datastore.

Known limitations

• llm-provider has no default and must be set explicitly, together with the matching SDK
  extra ([agent,anthropic] or [agent,openai]).
• The optional memory layer requires you to provision Redis and PGVector yourself.
• Ecosystem coverage is broadest for Python and npm; Cargo, Go, and Maven/Gradle support
  is newer and less battle-tested.

Security

Found a vulnerability? Please report it through the repository's Security tab rather than
a public issue.

---

Full Changelog: v1.1.3...v1.2.0