First public release.\n\n- Detects Tailscale auth keys and OAuth secrets in GitHub Action workflows without printing values\n- Validates complete OIDC inputs and effective id-token permissions\n- Fails closed on malformed, ambiguous, dynamic, non-UTF-8, or structurally unsupported workflows\n- Supports repository roots and workflow subtrees with deterministic human or JSON output\n\nVerified on Python 3.9 and 3.11; 26 tests pass. Exact release HEAD received a clean Claude Code review.