v0.1.1

An installable package with a verifiable build trail.

• Package tarball and SHA-256 checksums.
• SPDX inventory of the locked production dependencies used for this release.
• GitHub build-provenance and SBOM attestations tied to the package digest.
• Public OpenSSF Scorecard workflow and immutable action references.
• A complete sample report generated from the checked-in fixture.

See the verification commands.

The scanner's behavior is unchanged. The package is distributed through this
GitHub release; it is not published to the npm registry.

Infra Starter Pack v0.1.0

First tested source release.

Highlights:

• Read-only repository scanner for languages, frameworks, OpenAPI contracts, and routes
• Composite GitHub Action that adds an evidence-based report to the job summary
• Mintlify documentation and credential-free secret-scan generation
• Replay QA runtime testing with private reports and safe retry behavior
• 12 tests across Node.js 20 and 22 with 96% line coverage

Run directly from GitHub:

npx github:hamedrabah/infra-starter-pack scan .

The npm package is not published yet.