v1.0.1

Retries the pkgtruth fetch when a release has not replicated yet.

Publishing pkgtruth 0.2.0 showed a window of about three minutes in which the registry listed the version but its tarball returned 404, so workflows on @latest failed with E404. The scan step now retries fetch errors up to four times, thirty seconds apart, before reporting a failure. Verdict failures are unaffected.

Also inherits pkgtruth 0.2.0: scan now covers requirements*.txt and pyproject.toml alongside package.json, so Python dependencies in the same repository are gated too.

v1.0.0

First release.

Runs pkgtruth against package.json on pull requests, posts one sticky comment with the evidence (updated in place on later pushes), writes the same table to the job summary, and fails the check when a dependency is HALLUCINATED or DANGER.

Verified on a real pull request: a fixture seeded with crossenv (purged for malware), supabase-js (purged), and imageprocessor-lite (does not exist) was blocked and the comment was posted; the repository's own manifest passed.

- uses: hxckya/pkgtruth-action@v1

Inputs: path, fail-on (danger|caution), comment, version, node-version. Needs pull-requests: write for the comment.