0.6.0

Three ways into a pipeline, from the audit's F9: the outside review of 0.4.10 said the tool's real bottleneck was that nobody could adopt it without reading the README, and this is the answer. No check changed.

The action. uses: TomD4vs/prumo@v1 is a composite step that runs the checked-out prumo at that tag, so there is nothing to install and no network call. It annotates the exact line of the pull request and fails the job when something needs review. Inputs path, targets, format, sarif-file and fail-on-findings, output total; every default matches the one-line form in the README. @v1 follows the latest release; pin @v0.6.0 to freeze it.

SARIF. --format sarif prints SARIF 2.1.0 and --sarif FILE writes it beside whatever the run prints, one result per finding with its rule, level, file and line, for GitHub code scanning through upload-sarif or any tool that reads the format.

pre-commit. .pre-commit-hooks.yaml runs the same check before each commit through the pre-commit framework, whenever a staged file is one prumo auto-detects. Its file pattern is guarded by the same test as the hook in the agents page, so a new auto-detected file cannot silently stop triggering it.

The reference has a Continuous integration section with the three, the README and the agents page point at it, and the simulation exercises the SARIF output and both files. Suite 133 to 135, simulation 104 to 108.