chore(main): release 0.1.0

.release-please-manifest.json

@@ -1,3 +1,3 @@
 {
-  ".": "0.0.0"
+  ".": "0.1.0"
 }

CHANGELOG.md

@@ -0,0 +1,64 @@
+# Changelog
+
+## 0.1.0 (2026-09-07)
+
+
+### Features
+
+* **action:** M6 — first-class GitHub Action ([#51](https://github.com/Tom409114/scriptspect/issues/51)) ([24a5bf8](https://github.com/Tom409114/scriptspect/commit/24a5bf8ebcae7ead125dc4d50ddfd0e95d53fa9f))
+* **corpus:** M8 — read-only corpus scanner + validation methodology ([#52](https://github.com/Tom409114/scriptspect/issues/52)) ([3285d58](https://github.com/Tom409114/scriptspect/commit/3285d58415ebfea0d2acb9ce85af283eeb3bc961))
+* **fixer:** M4 — safe fixes with dry-run and idempotency ([#49](https://github.com/Tom409114/scriptspect/issues/49)) ([a91723b](https://github.com/Tom409114/scriptspect/commit/a91723b5c24a0ba514c06755fb7bf08c78b1e2ea))
+* harden ScriptSpect v0.1 and redesign the homepage ([5e85cb4](https://github.com/Tom409114/scriptspect/commit/5e85cb4c8f7ad1637dbc1779d3ba7d247379a864))
+* make corpus scans immutable and source-free ([b58ba1a](https://github.com/Tom409114/scriptspect/commit/b58ba1ae8e49b9c882e851bd83dd5e564e185d59))
+* **parser:** quote/escape/operator-aware lexer + command IR (M1) ([#44](https://github.com/Tom409114/scriptspect/issues/44)) ([4292fe3](https://github.com/Tom409114/scriptspect/commit/4292fe3f16ada6291f223f1a6be8a1ac7174587f))
+* polish generated terminal demo ([eb3e06e](https://github.com/Tom409114/scriptspect/commit/eb3e06ea6685e93abd3558d647857f0199bafbdb))
+* publish generated schema contracts ([48a9bbe](https://github.com/Tom409114/scriptspect/commit/48a9bbedd0e7d42b07cd612ee14628beee9c1b89))
+* **release:** M7 — SHA-256 checksums, release assets, published-tarball verification ([#53](https://github.com/Tom409114/scriptspect/issues/53)) ([2b339db](https://github.com/Tom409114/scriptspect/commit/2b339dbeba6086fe3e4229f396afbf737badc75e))
+* **reporter,cli,config:** M3 — one command to actionable findings ([#48](https://github.com/Tom409114/scriptspect/issues/48)) ([ece45da](https://github.com/Tom409114/scriptspect/commit/ece45da3c3b70235ba43f498f4dbc64f1660cc91))
+* **rules:** POSIX command + syntax rules PS010-PS026 (M2 part 2) ([#46](https://github.com/Tom409114/scriptspect/issues/46)) ([125fdaa](https://github.com/Tom409114/scriptspect/commit/125fdaa578b947764684e31d5a8fd9474a9117e8))
+* **rules:** PS040, PS041, PS050 — v0.1 rule set complete (M2 part 3) ([#47](https://github.com/Tom409114/scriptspect/issues/47)) ([8e23d25](https://github.com/Tom409114/scriptspect/commit/8e23d25eaf2ac20a889685e315004de3f1416049))
+* **rules:** rule engine + PS001-PS003, PS030-PS032 (M2 part 1) ([#45](https://github.com/Tom409114/scriptspect/issues/45)) ([5b877da](https://github.com/Tom409114/scriptspect/commit/5b877da4445c62bedc97de04b6451ddcad108e59))
+* ship a self-contained GitHub Action ([39a9201](https://github.com/Tom409114/scriptspect/commit/39a920157b48ad07a5f8bcf1481aab6add9868a1))
+* upgrade homepage and harden release evidence ([#78](https://github.com/Tom409114/scriptspect/issues/78)) ([e98b418](https://github.com/Tom409114/scriptspect/commit/e98b418db1d7d7dfd897a489e1fe7f295b46f206))
+* **workspaces:** M5 — monorepo discovery + workspace-bin-aware PS040 ([#50](https://github.com/Tom409114/scriptspect/issues/50)) ([cc67eee](https://github.com/Tom409114/scriptspect/commit/cc67eee39bee126cc1c5228211b88ca80e7ce33e))
+
+
+### Bug Fixes
+
+* **action:** honor scriptspect.config.json when target/severity inputs are unset ([#63](https://github.com/Tom409114/scriptspect/issues/63)) ([1a393e5](https://github.com/Tom409114/scriptspect/commit/1a393e539cbd4122dfeabb8778fb55e5544f97c6))
+* **ci:** checksums job tarball path, npm version derivation, and clean v0.1.0 tag ([#61](https://github.com/Tom409114/scriptspect/issues/61)) ([4fc54ab](https://github.com/Tom409114/scriptspect/commit/4fc54ab28900d78fdba14a116e5ad5b95fca6eaf))
+* **ci:** configure release-please via config file for initial-version 0.1.0 ([#59](https://github.com/Tom409114/scriptspect/issues/59)) ([33fc062](https://github.com/Tom409114/scriptspect/commit/33fc062d74c4c5cd6864668bbb86fe476a4321f5))
+* **ci:** job-level hashFiles broke workflow validation ([#5](https://github.com/Tom409114/scriptspect/issues/5)) ([25839b4](https://github.com/Tom409114/scriptspect/commit/25839b493c9cd08b0d196b30c14387b723d62e08))
+* **ci:** load release gate from current main ([#75](https://github.com/Tom409114/scriptspect/issues/75)) ([670945f](https://github.com/Tom409114/scriptspect/commit/670945fab061210a99cb4d9bdef4a5946843411b))
+* **ci:** release-please first release is v0.1.0, not 1.0.0 ([#57](https://github.com/Tom409114/scriptspect/issues/57)) ([20a9b12](https://github.com/Tom409114/scriptspect/commit/20a9b123f6a950d42f299bc89d32953001221ce7))
+* close final spec audit gaps ([#80](https://github.com/Tom409114/scriptspect/issues/80)) ([c9c671c](https://github.com/Tom409114/scriptspect/commit/c9c671c8e150705d78d9169d4c5a8f22cb37fad0))
+* close hosted CI regressions ([1be4049](https://github.com/Tom409114/scriptspect/commit/1be40498788de46c32df84b03a53fc15ce95778a))
+* contain configuration within project root ([a138b13](https://github.com/Tom409114/scriptspect/commit/a138b13f84f17aede1d716ed19f984f5f5485a0a))
+* **corpus:** make hosted evidence reproducible ([#77](https://github.com/Tom409114/scriptspect/issues/77)) ([bf37b41](https://github.com/Tom409114/scriptspect/commit/bf37b4132508c685a91cc16a9c0a3058c252502e))
+* dispatch publishing after durable staging ([b9ab682](https://github.com/Tom409114/scriptspect/commit/b9ab682e66f35b953866e126ce0c6d866cc6efaa))
+* enforce workspace boundaries and bin visibility ([7d69edb](https://github.com/Tom409114/scriptspect/commit/7d69edbbcb39d07bd60f2ee43e9bf25f0b995473))
+* fail closed on invalid workspace manifests ([#73](https://github.com/Tom409114/scriptspect/issues/73)) ([fbcd988](https://github.com/Tom409114/scriptspect/commit/fbcd9881366990f8f4c952a654f1d4a052f4dce2))
+* fail closed on unsafe command rewrites ([#76](https://github.com/Tom409114/scriptspect/issues/76)) ([3fe958e](https://github.com/Tom409114/scriptspect/commit/3fe958e5a2e133cad8fdff646f13bc73c4168b25))
+* fail closed when intent discovery times out ([c02d0c9](https://github.com/Tom409114/scriptspect/commit/c02d0c9338850ec2313c7609b76d39ea91787420))
+* fully encode scoped package purls ([#79](https://github.com/Tom409114/scriptspect/issues/79)) ([50d02d4](https://github.com/Tom409114/scriptspect/commit/50d02d44abdbfb3489516f39f4251481dfec1548))
+* gate release approval on exact intent ([8034e1f](https://github.com/Tom409114/scriptspect/commit/8034e1f48062172c0d42b05121f46a87a674c109))
+* honor reviewed npm integrity modes ([ff0827a](https://github.com/Tom409114/scriptspect/commit/ff0827ab8b3b983b6a7b79f00328c2c49983c3ed))
+* iterate hosted Action annotations ([98f13a1](https://github.com/Tom409114/scriptspect/commit/98f13a16bbbeda036cfea7dce25f1193328f4680))
+* keep first release changelog canonical ([#69](https://github.com/Tom409114/scriptspect/issues/69)) ([4d34f86](https://github.com/Tom409114/scriptspect/commit/4d34f86827dbb7a13b1300e317083aae64002ef2))
+* keep release cancellation effective ([c6f54c8](https://github.com/Tom409114/scriptspect/commit/c6f54c8b3385aaac19d2b731ed5d41f8a47ce18c))
+* keep release changelog sections unique ([#67](https://github.com/Tom409114/scriptspect/issues/67)) ([e9e754b](https://github.com/Tom409114/scriptspect/commit/e9e754bd3058c569ddf1e386c414a0d6a23db3ec))
+* make fixer writes recoverable and race-safe ([0efb7a1](https://github.com/Tom409114/scriptspect/commit/0efb7a1788ed57e3602489ded54c8cdd6937763b))
+* make hosted validation portable ([13dfcfc](https://github.com/Tom409114/scriptspect/commit/13dfcfcec3f50c3dd786a1f9b2a4225391ded0e5))
+* make release recovery monotonic ([bfd2d47](https://github.com/Tom409114/scriptspect/commit/bfd2d472ab7fe2568d53a88cd1d7775910e4ee12))
+* make releases recoverable and tag-bound ([069a9a7](https://github.com/Tom409114/scriptspect/commit/069a9a7ffec7c844eebf89777456fb6723253fe5))
+* match the generated Action summary ([dde44ea](https://github.com/Tom409114/scriptspect/commit/dde44ea0e3459a2fe770a1701eb3bbc6146321a7))
+* model shell-specific script structure ([3ea5940](https://github.com/Tom409114/scriptspect/commit/3ea5940b9f2dd1db41e126111d6a19055d837fe5))
+* patch esbuild development advisory ([#68](https://github.com/Tom409114/scriptspect/issues/68)) ([78c5006](https://github.com/Tom409114/scriptspect/commit/78c500684eab4425213a83662982de4952386c95))
+* reject unsafe config and manifest inputs ([0497337](https://github.com/Tom409114/scriptspect/commit/0497337b2920ae9eb6e8926d7abfa2c9f219b23e))
+* **release:** accept the CLI version banner in bootstrap checks ([#83](https://github.com/Tom409114/scriptspect/issues/83)) ([51cc781](https://github.com/Tom409114/scriptspect/commit/51cc7812528d519d094b3ec8953ef07852135993))
+* **release:** handle npm's initial latest assignment ([#84](https://github.com/Tom409114/scriptspect/issues/84)) ([6a0aeb3](https://github.com/Tom409114/scriptspect/commit/6a0aeb3449c45449f684732108ee3ca9aef39e4d))
+* require provable executable dependencies ([28aeb9a](https://github.com/Tom409114/scriptspect/commit/28aeb9a9e23a7a1869aa1f3182887a238d3cbef9))
+* retain hosted Action summary evidence ([9b3ec77](https://github.com/Tom409114/scriptspect/commit/9b3ec77dcd1c4ce12a60d3bbbb86e0cdc182a070))
+* route script rewrites through verified transactions ([3244af8](https://github.com/Tom409114/scriptspect/commit/3244af818193e7cf432c4611583f7d4fa9fd858c))
+* target root scripts during rewrites ([dbed173](https://github.com/Tom409114/scriptspect/commit/dbed1733fc2aad710f9de5974a5197d56bed3701))
+* validate manifest bytes and ambiguous scripts ([deeb45e](https://github.com/Tom409114/scriptspect/commit/deeb45e926bebf5e035130188e390c90a384f6ec))

package.json

@@ -1,6 +1,6 @@
 {
   "name": "scriptspect",
-  "version": "0.0.0",
+  "version": "0.1.0",
   "description": "Static analyzer for package.json scripts - catches shell-specific commands before they break Windows, macOS, or Linux builds.",
   "type": "module",
   "license": "MIT",