moult 0.1.0 → 0.3.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 26e4c98c7cb6b20201d221d79e1fd186ca2a263b927bdd920c20e79cc93f1d25
-  data.tar.gz: 8a8be94ede4c3f6e76b2e70cdcefc054756d58567d84af93e6d27906206f4d5a
+  metadata.gz: 5da8cf8ae9bf6dae1b9a05494fdf1280d1b3c62742cd8700e24a60ca9fc66eeb
+  data.tar.gz: f487eadae0717dc3f221612234699ea175c005a0b3c1801af57f71b34aa9cfc1
 SHA512:
-  metadata.gz: e58d63bcc230e5cbd39cc6a61a4f5addc0e979ef0f3f314b014e9376d2adf55b8027762ca04eb14b7e184af5f82e328c803188166062ddc80a46965f4a61defe
-  data.tar.gz: 53c7e7b6c1f0055133cd5f135acc6accdc073fcbd7c28e2c2f1b7064eaacfac64b1dcc8a44b547121c3f2b3db5981aa7e7d312c863c0c7cb57348520d93cea7d
+  metadata.gz: 136f27d5540be7e6fb4d2174b198703ec44dbab7c3bff8735f8f6cfb40217af2df230fd48e70965a4680740c3fdf8f2325c9c3c31b589b88a56939d2bfcf5b06
+  data.tar.gz: 677b2b5fdbb133f49046baa84e4a4a286e587c9da8904e44397a01d6ef116f5d7e4480bba88b73cfbaae45a37318e36b02d1981dc8ec6d6c44be912bcea20329

data/CHANGELOG.md

@@ -11,6 +11,11 @@ follow [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 ## [Unreleased]
 
+## [0.3.0] - 2026-07-02
+
+(v0.2.0 was tagged in git but never published as a gem — its changes are
+included here.)
+
 ### Added
 - `Moult::CloudUpload.projection` — the sanitised payload builder for the
   `moult-action` → Moult Cloud upload (allow-lists top-level keys; normalises
@@ -19,12 +24,41 @@ follow [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
   CI and uploads the projected result with keyless GitHub OIDC auth.
 - Open-source release setup: Apache-2.0 license, Trusted Publishing release
   workflow, `SECURITY.md`, `CONTRIBUTING.md`, `CODE_OF_CONDUCT.md`.
+- `.ruby-version` (3.3), read by `ruby/setup-ruby` in CI and in the action.
 
 ### Changed
 - License changed from MIT to **Apache-2.0** (adds an explicit patent grant;
   the chosen open-core core license).
+- `moult-action` installs moult from the action checkout instead of running
+  `bundle exec` against the caller's bundle — consuming repos no longer need
+  moult in their Gemfile (or a Gemfile at all).
+- `moult-action`'s `moult-cloud-url` input now defaults to
+  `https://moultrb.com`, so a bare `- uses: moult-rb/moult-rb@v1` step works
+  with no `with:` block; the input remains overridable for self-hosted
+  instances.
+- Release workflow only triggers on full-semver tags (`vX.Y.Z`), so the
+  floating `v1` major tag can be re-pointed without triggering a gem publish.
+- The gem publishes as `moult` again (reverting the brief `moult-rb` rename):
+  `moult` 0.1.0 is already the published package, and `gem install moult`
+  should keep resolving to current releases. The repository and action stay
+  `moult-rb/moult-rb`.
+
+### Fixed
+- `moult-action` fails with an actionable message — instead of a raw Ruby
+  `KeyError` backtrace — when the workflow is missing
+  `permissions: id-token: write`, and cleanly skips the upload (verdict still
+  enforced) on pull requests from forks, which GitHub never grants an OIDC
+  identity. Non-2xx responses from GitHub's token endpoint are now reported
+  with their status and body.
+- `moult-action`'s `base-sha` now defaults to the pull request's base branch
+  (or the merge queue's base SHA), falling back to the repository's default
+  branch — previously a hardcoded `origin/main` broke PR scans in any
+  repository whose base branch isn't `main`.
+- `moult-action` auto mode maps `merge_group` events to `pr` scans (diffed
+  against the queue's base SHA) and rejects `pull_request_target`, which
+  checks out the base branch and would silently gate an empty diff as a pass.
 
-## [0.1.0] - unreleased
+## [0.1.0] - 2026-06-30
 
 Initial development version. The static + runtime analysis suite:
 
@@ -40,5 +74,6 @@ Initial development version. The static + runtime analysis suite:
 - `moult health` — composite, confidence-graded health score.
 - `moult gate` — diff-aware PR risk gate (the only verdict layer).
 
-[Unreleased]: https://github.com/moult-rb/moult-rb/compare/v0.1.0...HEAD
+[Unreleased]: https://github.com/moult-rb/moult-rb/compare/v0.3.0...HEAD
+[0.3.0]: https://github.com/moult-rb/moult-rb/compare/v0.1.0...v0.3.0
 [0.1.0]: https://github.com/moult-rb/moult-rb/releases/tag/v0.1.0

data/README.md

@@ -4,16 +4,43 @@ Codebase intelligence for Ruby and Rails. Moult sheds dead code.
 
 ## moult-action (GitHub Action)
 
-Add the gate to your CI and upload results to Moult Cloud:
+Add the gate to your CI and upload results to Moult Cloud. Create
+`.github/workflows/moult.yml` with:
 
 ```yaml
-- uses: moult-rb/moult-rb@v1
-  with:
-    base-sha: ${{ github.event.pull_request.base.sha }}
-    moult-cloud-url: https://app.moult.dev
+name: Moult
+on:
+  push:
+    branches: [main]   # seeds/advances the baseline on merge
+  pull_request:
+
+permissions:
+  contents: read
+  id-token: write      # keyless OIDC auth to Moult Cloud
+
+jobs:
+  moult:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: moult-rb/moult-rb@v1
 ```
 
-Your workflow needs `permissions: id-token: write` for OIDC authentication.
+That's the whole file. The action checks out your code (full history),
+installs moult itself, runs the gate, and uploads the result — your repo does
+not need moult in its Gemfile. Three prerequisites:
+
+1. Install the [Moult Cloud GitHub App](https://github.com/apps/moult-cloud)
+   on the repository.
+2. `permissions: id-token: write` on the workflow or job (shown above) — it
+   lets the action mint the GitHub OIDC token that authenticates the upload.
+   Pull requests from forks never receive an OIDC identity, so they are
+   gated in CI but their results are not uploaded.
+3. A `.ruby-version` or `.tool-versions` file in the repository (read by
+   `ruby/setup-ruby`; Ruby 3.3+).
+
+Results appear on your dashboard at [moultrb.com](https://moultrb.com). The
+`moult-cloud-url` input only needs setting for self-hosted Moult Cloud
+instances.
 
 Three commands today:
 
@@ -52,7 +79,9 @@ Or install directly:
 gem install moult
 ```
 
-Requires Ruby 3.3+.
+
+The gem is published as `moult`; the command and library are still `moult`
+(`require "moult"`, `moult hotspots`, …). Requires Ruby 3.3+.
 
 ## Usage
 
@@ -316,9 +345,10 @@ Outside a git repository churn is `0`, so files rank by complexity alone.
 
 The `moult` gem — the CLI and every analysis in it — is free and open source
 under [Apache-2.0](LICENSE.txt). **Moult Cloud** is a separate commercial
-product: a hosted GitHub App that turns `moult gate` into an enforced,
-team-visible PR check with history, trends, and dashboards. The gem stands on
-its own; the cloud is optional.
+product: a hosted [GitHub App](https://github.com/apps/moult-cloud) that turns
+`moult gate` into an enforced, team-visible PR check with history, trends, and
+dashboards at [moultrb.com](https://moultrb.com). The gem stands on its own;
+the cloud is optional.
 
 ## Contributing
 

data/lib/moult/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Moult
-  VERSION = "0.1.0"
+  VERSION = "0.3.0"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: moult
 version: !ruby/object:Gem::Version
-  version: 0.1.0
+  version: 0.3.0
 platform: ruby
 authors:
 - The Moult authors
 autorequire:
 bindir: exe
 cert_chain: []
-date: 2026-06-30 00:00:00.000000000 Z
+date: 2026-07-02 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: prism