chore(release): 0.14.0 - #82
Merged
Merged
Conversation
svyatov
added a commit
that referenced
this pull request
Aug 11, 2026
## What changed Code scanning moves from CodeQL default setup to advanced setup, at `.github/workflows/codeql.yml`. Default setup is already turned off, so this workflow is what analyzes the repository from here. The `main` ruleset's `code_quality` rule is removed. `gh api repos/svyatov/oss-kit/code-quality/setup` answers `404 Code quality is not available for this repository`, so the rule required a tool that can never report. `AGENTS.md` is corrected in both places that described the old arrangement. ## Why this way Release pull request #82 passed all six required checks and could not merge. CodeQL returned `neutral` with `Code scanning cannot determine the alerts introduced by this pull request, because 1 configuration present on refs/heads/main was not found`, because the release touches only JSON and Markdown and there was nothing for `javascript-typescript` to compare. The ruleset's `code_scanning` rule blocks on that verdict. Every future release would have hit the same wall, since a release only ever touches three plugin manifests and the changelog. The workflow carries no path filter, so a verdict always arrives. Default setup also excludes fork pull requests, and every external contribution here arrives from a fork, which is the R-SEC-09 gap `AGENTS.md` already recorded as open. Advanced setup is what the `oss-harden` skill names for that case. The matrix names `actions` and `javascript-typescript` where default setup reported four languages. `javascript-typescript` is the identifier that covers both JavaScript and TypeScript, so the other two analyzed the same tree again. `code_quality` is removed rather than kept for later because `skills/oss-harden/references/github.md` already tells a reader not to add that rule where Code Quality is off, on the grounds that a rule requiring a tool that never reports blocks every merge. This repository had done the thing its own skill warns against. ## Verification The ruleset was backed up before the edit and read back after it. `target`, `enforcement`, `conditions`, and `bypass_actors` are unchanged, and the six remaining rules are identical to their previous values. `bypass_actors` is still `[]` and `current_user_can_bypass` is still `never`, so nothing here exempts anybody from anything. `github/codeql-action` is pinned to a full commit SHA resolved through `skills/oss-harden/scripts/resolve-pin.mjs`, and the job sets `timeout-minutes`, so the workflow meets R-SEC-01 and R-CI-05. `bun test` reports 328 passing and `scripts/prose.mjs` reports no finding on `AGENTS.md`. ## Known gaps Whether advanced setup delivers a CodeQL verdict on a pull request from a fork is not verified here, because this branch is not one. R-SEC-09 stays recorded as open on that path until a fork pull request demonstrates it. The `CodeQL` context is not in the ruleset's required status checks and is not added. The `code_scanning` rule is what gates on the analysis, and it gates on what the analysis found rather than on whether it ran. ## Affects | Rule or skill | Change | | --- | --- | | R-SEC-09 | implementation moves to a workflow file, requirement unchanged |
svyatov
force-pushed
the
chore/release-0.14.0
branch
from
August 11, 2026 16:53
49fe9d9 to
ab34c69
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What changed
Folds the accumulated
Unreleasedsection into## [0.14.0] - 2026-08-11, adds its compare link, and bumpsversionin the three plugin manifests.Why this way
MINOR applies because the release adds to the public API without tightening anything in it.
.claude-plugin/plugin.jsonnow enumerates the nine skills, which is a manifest path a host reads, andoss-auditgains a statement about the trust boundary around its collector output. No rule ID changed what it requires, no skill was renamed or removed, and the threeoss-hardenfixes correct guidance rather than requirements, so a repository that passed 0.13.0 still passes 0.14.0.Verification
bun run typecheckbun test, 328 tests passedbun run validate, 0 errors and 0 warningsbash tests/test-check-drift.sh, 12 tests passedbash scripts/check-drift.shbun scripts/check-ecosystems.mjs, 11 ecosystems x 7 skills presentnode skills/oss-writing/scripts/prose.mjs CHANGELOG.md, 0 findingsKnown gaps
The
Oss Kitgroup label and the picker's lost search box ship as they are. Both are the installer's decisions, and neither is worth a plugin rename.The Snyk W011 rating on
oss-auditmay not move, because the behaviour it names is still present. Disputing the code upstream stays the remaining option.