0.2.2

Fixes the npm publish: the workflow now clears NODE_AUTH_TOKEN for the publish step.

actions/setup-node writes an _authToken line into .npmrc and exports a placeholder token whenever registry-url is set. npm 11 preferred that placeholder over the OIDC trusted-publishing flow, and the registry answered 404 Not Found - PUT — which reads like a permissions problem and is not one.

0.2.1 was a GitHub release only; npm never received it. This release carries the same changes:

• The Action is named Zhiliang agentgate for the GitHub Marketplace.
• The scan-execution coverage record: every index record says which scanners ran, and a record with an unmeasured required component can never be clean.
• The inventory report shows, per tool, which scanners actually ran.

npm note: 0.2.2 did not reach npm either. Clearing the token exposed the second problem: the trusted-publisher binding was stale because the repository had been deleted and recreated, so the OIDC token exchange answered package not found. Deleting and re-adding the binding fixed it, and 0.2.3 is the version npm has.

Full notes: CHANGELOG.md