Action v1.9.0: SARIF output + baseline ratchet

What's new

SARIF v2.1.0 output (sarif-output input)

The GitHub Action now emits a SARIF v2.1.0 file so design-contract findings appear in GitHub's native Code Scanning dashboard alongside CodeQL and Dependabot alerts.

• Each of the 40 checks becomes a SARIF rule (with id, name, shortDescription, defaultConfiguration.level, tags, precision, help/remediation)
• Each FAIL check becomes an error-level result; each WARN becomes a warning-level result
• The scored URL is the artifact location (design checks inspect live pages, not source files)
• Stable partialFingerprints prevent duplicate alerts across runs

Upload the SARIF file to GitHub code-scanning with github/codeql-action/upload-sarif@v4. Design-contract findings appear in the same Security > Code Scanning dashboard as CodeQL and Dependabot alerts — the first design system to integrate with GitHub's native alerting infrastructure.

- uses: LE-VAI/designesy-org@v1
  with:
    url: https://your-app.vercel.app
    sarif-output: designesy-results.sarif
- uses: github/codeql-action/upload-sarif@v4
  with:
    sarif-file: designesy-results.sarif
    category: designesy

Baseline ratchet (baseline input)

Commit a .designesy-baseline.json file to track your design score floor. The action fails when the score regresses below the baseline, and writes an updated baseline on improvement — so the floor only ratchets up.

- uses: LE-VAI/designesy-org@v1
  with:
    url: https://your-app.vercel.app
    baseline: .designesy-baseline.json

Also fixed

• Removed 6 phantom tools_exposed entries from server.json (registry advertised 17 tools, package ships 11)

Backward compatible

Both new inputs default to empty (disabled). Existing workflows are unaffected.