v1.2.0 — Web Dashboard, 11 Languages, CI/CD Suite

What's new in v1.2.0

🌐 Web Dashboard

• --serve — Opens a live interactive browser dashboard with health gauge, donut chart, filterable/sortable findings, category bar chart, and Export JSON button

🌍 4 New Languages (11 total)

• Ruby — complexity, God classes, SQL injection, eval, frozen_string_literal
• PHP — complexity, SQL injection, MD5 passwords, system(), strict_types
• Swift — complexity, force-unwrap overuse, callback pyramid, mixed concurrency
• Kotlin — complexity, !! overuse, GlobalScope, runBlocking

🔄 CI/CD Suite

• --junit / --junit-file — JUnit XML for Jenkins, GitLab CI, Bitbucket Pipelines
• --sarif / --sarif-file — SARIF for GitHub Code Scanning
• --pr-comment — Post report as GitHub PR comment
• --init-ci — Generate .github/workflows/roast.yml in one command
• --fail-on-regression — Fail CI if health score dropped vs last snapshot
• --install-hooks — Git pre-commit hook installer

⚡ Performance

• 3-5x faster — All core scanners now run in parallel with Promise.all

🔌 Plugin System

• Plugins now actually run on every scan
• --list-plugins — Show configured plugins with load status
• --init-plugin <name> — Scaffold a new plugin package

📦 Monorepo Support

• --monorepo — Scan each workspace package separately (npm/yarn/pnpm/lerna/nx)

🗂 More Features

• --init — Interactive wizard to generate .roastrc.json
• --hotmap — ASCII directory tree with issue density per folder
• .roastignore — Exclude files/folders from all scans
• --incremental / --since <ref> — Only scan changed files
• --html-file — Standalone HTML report with charts
• Dependency health scanner — npm audit CVEs + npm outdated stale packages

🔒 Security

• Path traversal fix in --init-plugin
• Symlink loop protection (followSymbolicLinks: false) across all scanners
• Markdown injection prevention in PR comments
• Package name validation in auto-fix uninstall
• Dependabot configured for weekly dependency updates

Full changelog

See commit history for details.