v0.4.0

[cassiodeveloper]

Added

• M.A.R.I.A submissions integration for CI/CD results publishing:
  • New CLI flags: --maria-url, --maria-token, --maria-repository-id, --maria-strict
  • Submission metadata flags: --maria-submission-key, --maria-commit-sha, --maria-branch-name,
    --maria-pipeline-name, --maria-pipeline-run-id, --maria-pull-request-id,
    --maria-started-at-utc, --maria-tool-name, --maria-cli-version
  • Automatic metadata fallback from CI environment and git when values are not provided.
• GitHub Action support for M.A.R.I.A submission fields via new action inputs:
  token, maria-url, maria-token, maria-repository-id, maria-pull-request-id.
• New adapter module secscore.adapters.maria_provider to isolate outbound submission logic.
• Automated tests for M.A.R.I.A payload mapping and strict-mode failure behavior.

Changed

• M.A.R.I.A payload now sends explicit Score and Decision plus severity Summary
  (Critical, High, Medium, Low) for submission endpoints.
• Package metadata now declares all runtime dependencies used by the CLI (pyyaml, requests, rich).

Fixed

• Package runtime metadata mismatch where rich was used by CLI but not declared in pyproject.toml.

---

This discussion was created from the release v0.4.0.