QuickstartProof v1.1.0 — bounded discovery and native mismatch annotations

QuickstartProof v1.1.0 reduces setup friction while preserving the Action's read-only, zero-secret boundary.

Added

• Opt-in discover-paths: "true" for an omitted quickstart path, OpenAPI path, or both.
• Conservative discovery of exactly one canonical quickstart name (quickstart or getting-started) and one OpenAPI name (openapi or swagger).
• Native GitHub workflow warnings for located, high-confidence mismatches on the existing quickstart source line.

Safety and compatibility

• Exact paths remain the default, retain precedence, and bypass discovery.
• Discovery never follows symlinks and rejects symlinked candidates.
• It fails closed on missing or multiple candidates and on depth, entry, file-count, or selected-file size limits.
• Directory enumeration stops incrementally at the 10,000-entry cap instead of first materializing an unbounded directory.
• Repeated whitespace in valid repository paths is preserved in result metadata and warning annotations.
• Actual traversal remains rejected while legitimate in-repository components such as ..docs remain supported.
• Workflow-command properties and data are escaped; UNKNOWN evidence remains summary-only and never becomes a warning.
• The Action still makes no network request, executes no checked content, reads no secret, modifies no repository file, and posts no comment.

This remains a static consistency check, not proof of API correctness, availability, security, privacy, compliance, performance, or commercial results.

QuickstartProof v1.0.0 — static cURL/OpenAPI consistency checks

QuickstartProof v1.0.0 introduces a read-only, dependency-free GitHub Action that compares copy-paste cURL examples in one Markdown or MDX quickstart with one same-repository OpenAPI 3.0–3.2 document.

Highlights

• Checks HTTP method, path, server, parameters, required fields, and supported literal JSON examples.
• Produces source-linked annotations, a compact job summary, and bounded JSON output.
• Returns one honest state: aligned-on-static-checks, changes-found, or insufficient-public-input.
• Uses Node.js 24 with no runtime dependencies.

Safety boundary

QuickstartProof never executes cURL or repository code, calls the documented API, reads secrets, installs packages, or uploads source content. Ambiguous or unsupported evidence fails closed as insufficient-public-input. An aligned result is not certification of runtime correctness, security, availability, or compliance.

Verification

• 29/29 Action tests passed in GitHub Actions.
• 12/12 synthetic fixture repositories produced their exact expected states.
• The committed bundle is 55,294 bytes.
• Bundle SHA-256: 76EF7559527A3AE7CED573CBA12E0EC61DC20EA422C09E0189785668B35095AD
• Release commit: a21ebbf

Security-conscious consumers can pin the full release commit: a21ebbf