v1.0.0

First release.

Runs pkgtruth against package.json on pull requests, posts one sticky comment with the evidence (updated in place on later pushes), writes the same table to the job summary, and fails the check when a dependency is HALLUCINATED or DANGER.

Verified on a real pull request: a fixture seeded with crossenv (purged for malware), supabase-js (purged), and imageprocessor-lite (does not exist) was blocked and the comment was posted; the repository's own manifest passed.

- uses: hxckya/pkgtruth-action@v1

Inputs: path, fail-on (danger|caution), comment, version, node-version. Needs pull-requests: write for the comment.