supercov 1.1.1-aarch64-linux-gnu → 2.0.0-aarch64-linux-gnu

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 42dae24abdff147aad2e18a11472cc00d689f21b147ea7b20bfa9a9652b01aa7
-  data.tar.gz: '0368aba7a781dd7f908f8b55eb7fca527e79ebd93808354cc3aecd85465a43bc'
+  metadata.gz: 3a4fff9a5df7703c490280286fff8231d08a412ceb84dd4d6980bbc020c8063a
+  data.tar.gz: ee00d2c5827b5f1d9cc791f2d5c6a97ca4713296a0481ef0c9ed40810e6b440c
 SHA512:
-  metadata.gz: 8025fafa8840fa5bd5482b575baedffa3a73935bfb0f6a22363a08e77ef821e9c5540a7821991493f20ab7fbe3c5251b40d48f4c227a0425eabd951e4a3c8b50
-  data.tar.gz: 6b8e31f5609fa2a1207030c6afb991370bb2b2431e637bc933ec4d98dc02472ec28066089e4526f1c3afd9e1f81c4c4aa05dcd0fb4569a7d9b5ab7072b0f20a8
+  metadata.gz: 47279cb02b20429e0754c41e67f80e59b28afaefed6572b67841fa60ba5077dd7d472385db1030a8038b0be20eab89c5bdfd317d48c2ceb4e49100dc4ca0ff53
+  data.tar.gz: 7bb569c9e07ae77b8ba278803193e71ee408f7981fe27efce3a2347d5504b36358b640ce2a3b08ea13afef32e7afcad4e17bf259b018d6fb69a614701f97d3b1

data/README.md

@@ -1,8 +1,8 @@
-![Code quality and coverage for coding agents](https://raw.githubusercontent.com/supercorp-ai/supercov/main/supercov.jpg)
+![Coverage, security and code quality for coding agents](https://raw.githubusercontent.com/supercorp-ai/supercov/main/supercov.jpg)
 
-**Code quality and coverage for coding agents**
+**Coverage, security and code quality for coding agents**
 
-**Supercov tells your coding agent what to fix and what to test.** It scores your code quality with [Jev](https://typesafe.ai), runs the test command you already use, and turns uncovered paths into small, actionable queries. Your agent picks a target, writes a focused test or a focused refactor, proves what improved, and keeps going.
+**Supercov tells your coding agent what to fix and what to test.** It scores your code quality and flags security risks with [Jev](https://typesafe.ai), runs the test command you already use, and turns uncovered paths into small, actionable queries. Your agent picks a target, writes a focused test or a focused refactor, proves what improved, and keeps going.
 
 Paste this to your coding agent to start:
 
@@ -56,6 +56,18 @@ Jev charges for what it reads and nothing for what it writes, so a megabyte of
 source costs a little over a cent. Answers are cached by content, so a second
 run pays only for what changed. See [Understanding quality](docs/quality.md).
 
+## Find security risks
+
+```bash
+npx supercov security
+npx supercov security patch   # what a change introduced
+```
+
+Twelve security checks asked of every file with the same key, from injection
+and secrets in source to paths and redirects taken from a request. Nothing is
+averaged: a file is clean, or it names what fired, with the line and the code on
+it where Jev confirms one. See [Security surface](docs/security.md).
+
 ## Start with the suite you already have
 
 ```bash
@@ -102,6 +114,19 @@ npx supercov -- npm test
 npx supercov diff <previous-run-id> latest
 ```
 
+Want to hand the evidence to a person? Generate one private, interactive file:
+
+```bash
+npx supercov report
+```
+
+The report opens in your browser with up to ten recent runs in a visual history.
+Selecting a run compares it with the previous snapshot automatically. It has no
+server, external assets, account, or file picker. It is written to
+`.supercov/reports/`, where the store's own `.gitignore` keeps it out of git.
+You can attach that one file directly to a pull request; a reviewer downloads
+it and double-clicks it.
+
 Use whichever complete test command the repository already trusts:
 
 ```bash
@@ -233,7 +258,7 @@ Java and Kotlin have no registry of their own here, so a JVM project takes the b
 | PHP | Coming soon | — | — |
 | C | Coming soon | — | — |
 
-The `npx` path requires Node.js 22 or newer; the other installs need no Node. Rust support currently uses Rust 1.95; cargo-nextest 0.9.138 and 0.9.140 are supported. Python support requires CPython 3.12 or newer and measures pytest and unittest runs. Ruby support requires Ruby 3.3 or newer (3.4 or newer for full measurement) and measures RSpec, Minitest, test-unit and Cucumber runs. Go support requires Go 1.22 or newer and measures `go test`. Java and Kotlin support requires a JDK 17 or newer with Maven or Gradle, and measures every JUnit Platform engine -- JUnit 5, JUnit 4 through Vintage, Kotest and Spock -- as well as TestNG.
+The `npx` path requires Node.js 22 or newer; the other installs need no Node. Rust support currently uses Rust 1.95; cargo-nextest 0.9.138 and 0.9.140 are supported. Python support requires CPython 3.9 or newer and measures pytest and unittest runs. Ruby support requires Ruby 3.3 or newer (3.4 or newer for full measurement) and measures RSpec, Minitest, test-unit and Cucumber runs. Go support requires Go 1.22 or newer and measures `go test`. Java and Kotlin support requires a JDK 17 or newer with Maven or Gradle, and measures every JUnit Platform engine -- JUnit 5, JUnit 4 through Vintage, Kotest and Spock -- as well as TestNG.
 
 ## Supported operating systems and architectures
 
@@ -245,7 +270,7 @@ The CLI is a single native binary. `npx supercov` selects the build for the mach
 | Linux | arm64, x64 | glibc 2.28 or newer (Debian 10, Ubuntu 18.10, RHEL 8 and later), or musl (Alpine); chosen automatically |
 | Windows | arm64, x64 | Windows 10 or newer |
 
-JavaScript, TypeScript, Python, Ruby, Rust, Go, Java and Kotlin suites are verified on Linux, macOS and Windows -- CPython 3.12, 3.13 and 3.14, Ruby 3.3, 3.4 and 4.0, and Go 1.22, 1.25, 1.26 and 1.27 on every one, and JDK 17 and 21 on every one that has them (Temurin publishes no 17 for arm64 Windows, so that pairing is 21 alone). Containers, VMs, and remote executors run the same Linux builds. Every release publishes the same binaries to npm, PyPI (`supercov-cli`, a wheel per platform) and RubyGems (`supercov`, a gem per platform except arm64 Windows, which Ruby has no platform for), and the source to crates.io (`supercov`).
+JavaScript, TypeScript, Python, Ruby, Rust, Go, Java and Kotlin suites are verified on Linux, macOS and Windows -- CPython 3.9 through 3.14 (on arm64 Windows, 3.9 and 3.10 as the x64 builds, since python.org publishes no arm64 build before 3.11), Ruby 3.3, 3.4 and 4.0, and Go 1.22, 1.25, 1.26 and 1.27 on every one, and JDK 17 and 21 on every one that has them (Temurin publishes no 17 for arm64 Windows, so that pairing is 21 alone). Containers, VMs, and remote executors run the same Linux builds. Every release publishes the same binaries to npm, PyPI (`supercov-cli`, a wheel per platform) and RubyGems (`supercov`, a gem per platform except arm64 Windows, which Ruby has no platform for), and the source to crates.io (`supercov`).
 
 ## Supported test suites
 
@@ -286,6 +311,9 @@ npx supercov runs latest line app/checkout/session.ts:64
 
 # What changed between two runs
 npx supercov diff <previous-run-id> latest
+
+# A portable interactive report for a person
+npx supercov report
 ```
 
 Collections accept `--limit` and `--offset` and print a copyable next-page command. Machine-readable output is available with `--json` when an integration needs it.
@@ -299,9 +327,9 @@ The Supercov CLI does not contact a Supercov service during a coverage run. Pack
 Supercov does not rewrite your source files, tests, imports, reporter list, runner configuration, dependency tree, or normal build output. An existing user-created `supercov/` directory is never adopted.
 
 ```bash
-npx supercov clean --dry-run   # preview cleanup
-npx supercov clean --keep 20   # keep the 20 newest runs
-npx supercov clean             # remove all runs and the build cache
+npx supercov runs clean --dry-run   # preview cleanup
+npx supercov runs clean --keep 20   # keep the 20 newest runs
+npx supercov runs clean             # remove all runs and the build cache
 ```
 
 ## Documentation
@@ -315,6 +343,7 @@ npx supercov clean             # remove all runs and the build cache
 - [Supported languages and test suites](https://supercov.com/docs/supported-suites)
 - [Understanding coverage](https://supercov.com/docs/coverage-model)
 - [Runs and evidence](https://supercov.com/docs/evidence)
+- [Portable HTML reports](https://supercov.com/docs/reports)
 - [Files, privacy, and cleanup](https://supercov.com/docs/workspace-isolation)
 - [Trusting a result](https://supercov.com/docs/verification)
 - [Speed and storage](https://supercov.com/docs/performance)
@@ -326,3 +355,6 @@ npx supercov clean             # remove all runs and the build cache
 ## Contributors
 
 - [@DaVinciTachyon](https://github.com/DaVinciTachyon)
+- [@Uhbif2](https://github.com/Uhbif2)
+- [@maik-intellicoach](https://github.com/maik-intellicoach)
+- [@untitaker](https://github.com/untitaker)

data/lib/supercov.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Supercov
-  VERSION = "1.1.1"
+  VERSION = "2.0.0"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: supercov
 version: !ruby/object:Gem::Version
-  version: 1.1.1
+  version: 2.0.0
 platform: aarch64-linux-gnu
 authors:
 - Supercorp
@@ -44,5 +44,5 @@ required_rubygems_version: !ruby/object:Gem::Requirement
 requirements: []
 rubygems_version: 3.6.9
 specification_version: 4
-summary: Code quality and coverage for coding agents
+summary: Coverage, security and code quality for coding agents
 test_files: []