v0.2.0

Changelog

• 766cae0 Add .greenlight.yml config for the code scan
• 5e1099a Add Codex-native Greenlight skill package
• 903e039 Add GoReleaser release pipeline + Homebrew tap automation
• ab0e5c3 Add HIGH severity tier, honest 3-state verdict, and --exit-code
• afbc262 Add SARIF 2.1.0 output (--format sarif) for codescan + preflight
• 3bfafe5 Add UIWebView-removed CRITICAL + encryption export-compliance check
• 809813a Add greenlight verify: runtime flow validation via Revyl CLI
• 20a7f1d Add preflight tests for HIGH counting, dedup, and --exit-code
• 14fd173 Add runtime-tier --artifact upload and --open live session
• 2cac372 Address Copilot 3rd pass: finalized-report verdict + input validation
• 440c0e1 Address Copilot 4th pass: clean JSON output + smaller robustness fixes
• e6a4b65 Address Copilot 5th pass: redact secrets, gate onboarding, fix comment
• 934565e Address Copilot 6th pass: dry-run secret redaction + smaller fixes
• 59df00c Address Copilot re-review: clearer errors + accurate README
• d71b693 Address PR review (Copilot + code review): correctness + robustness
• 07320cb Address code review: don't go silent when icons are in Assets.car
• c39436b Address code review: fix inline-ignore over-suppression
• 2a4f72f Address code review: narrow ipv4 and platform-reference ignore patterns
• 20ca2e4 Address code review: tighten UIWebView pattern, fix Expo-config detection
• b0290fc CI: gofmt gate, race detector, macOS matrix
• 921c0df Fail --exit-code on an incomplete scan (code review)
• 6f5ae81 Fix UIWebView CRITICAL firing on string/comment text (code review)
• ed56c8b Fix scanner false positives/negatives + harden temp creds
• 7fcf71d Fix swapped plugin.json and marketplace.json manifests (#16)
• de2a85d Format entire repo with gofmt
• e668ec3 Keep the static scanner separate: drop the auto upsell from preflight
• 327f381 Merge pull request #1 from olsenbudanur/fix/reduce-false-positives
• 07c4d0a Merge pull request #2 from daeshawnballard/codex/add-codex-native-skill
• f61861c Merge pull request #5 from ethanzhoucool/feat/revyl-runtime-verify
• de1caab Merge remote-tracking branch 'revyl/feat/config-file' into integration/merge-all
• 6f914f2 Merge remote-tracking branch 'revyl/feat/coverage-rule-pack' into integration/merge-all
• 7522c76 Merge remote-tracking branch 'revyl/feat/goreleaser' into integration/merge-all
• 339b0f8 Merge remote-tracking branch 'revyl/feat/ipa-binary-plist' into integration/merge-all
• 2c25db9 Merge remote-tracking branch 'revyl/feat/sarif-output' into integration/merge-all
• 5d65eb9 Merge remote-tracking branch 'revyl/fix/tier1-qol' into integration/merge-all
• f112d33 Parse IPA plists for real (binary + XML) instead of string-matching
• 55b185c Point static users to --verify; say "cloud device", not "real device"
• d833730 Polish: unify --version wording, document ignore-directive matching
• f1a9dfa QOL: build-info version fallback, UTF-8 length checks, inline ignore
• d400171 Reduce false positives in codescan and privacy scanner
• 4f3a1b7 Tag greenlight signup CTA link with UTM params (#13)
• db0ec50 chore(release): prep v0.2.0, the first release with Google Play support (#25)
• 775bcbc codescan: cut false positives in the §2.1 and §5.1.1 rules
• 8cf3422 feat(codescan): detect crypto apps and flag Guideline 3.1.5(b) obligations (#14)
• 7223ea2 feat(playscan): scan Android projects against Google Play policies (#17)
• d0b675f fix(playscan): close Android scanning gaps from review, and tag Revyl links for attribution (#21)
• ec41b7c fix(playscan): close the Android scanning gaps from review (#22)
• 80a5702 fix(playscan): correct the foregroundServiceType resource ID (#19)
• 4d41b5e fix(playscan): drop redundant clause from the Play Billing fix line (#18)
• 5af7309 fix(playscan): match Android XR by namespace instead of invented feature names (#24)
• f0eb893 preflight --verify: chain static checks into Revyl runtime validation
• 12dbf46 verify: Revyl sign-up funnel when the user has no account
• c5b4b4d verify: associate the test with its app id (fix builds never installing)
• 5c42005 verify: don't report a setup/launch failure as a broken flow
• fbe2b73 verify: parse real Revyl report schema for failure evidence
• 3f4f3c6 verify: poll until the report settles; count steps from the step array
• 0d32fc7 verify: unique test name per build (fix silent cross-app rebinding)