Develra v0.2.0

Develra v0.2.0

Develra v0.2.0 adds an explicit, privacy-bounded public registry check while
keeping every default scan and check offline.

Added

• Run develra check --registry https://www.develra.dev/api to compare the
  providers and operations detected locally with Develra's public change feed.
• Validate remote responses, pagination, duplicate records, redirects, timeouts,
  and decompressed response size before using registry data.
• Report relevant upstream changes and official source provenance in console,
  JSON, Markdown, and SARIF output.
• Distinguish optional registry failures with exit code 4; remote findings stay
  informational and do not replace local inventory policy.

Privacy and scope

The CLI sends only detected provider IDs. It does not send source code,
lockfile contents, repository names, evidence paths, credentials, environment
values, or authorization headers. The registry is never contacted without the
explicit --registry option.

The first public feed is deliberately small and manually curated from official
provider sources. It has no accounts, authentication, database, inventory
upload, background polling, or AI classification and should not be treated as a
comprehensive monitoring service.

Verify the release

npx develra@0.2.0 --version
npx develra@0.2.0 check --registry https://www.develra.dev/api

Use the compatible Action channel in GitHub workflows:

- uses: develra-dev/develra@v0
  with:
    command: check

Full documentation and source: https://github.com/develra-dev/develra