@clear-capabilities/agentic-security-scanner 0.194.1 → 0.195.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
package/CHANGELOG.md
CHANGED
|
@@ -9,6 +9,28 @@
|
|
|
9
9
|
> make the history less accurate, not more.
|
|
10
10
|
|
|
11
11
|
|
|
12
|
+
## 0.195.1 - Hosted CI split so its slowest blocking job is about four minutes, not twelve
|
|
13
|
+
|
|
14
|
+
Why: the requirement is a release in under 10 minutes once the code is committed. Measured on the 0.195.0 pull request, the slowest blocking hosted job was `language-suites` at 12.1 min, then `language-tools-ghc` 10 min, the test shards 6 to 8 min, `bench-gates` 6.4 min and `proof-container` 5.3 min, and the release workflow after the tag is about 4.8 min (75 s waiting for a runner, 145 s for the `rest` gate leg, 66 s to publish). CI then the release workflow in series cannot fit 10 minutes unless the longest CI job is cut to about 4.
|
|
15
|
+
|
|
16
|
+
- **The test suite runs in eight shards instead of four** (`test-shard (1/8)` to `(8/8)`; the aggregator `test` keeps its name). A shard took 4.7 to 6.9 min of test time.
|
|
17
|
+
- **`language-suites` is four jobs.** The CLI-driven suites (`language-slow`, 242 s), the benchmark gates (`language-gates`, 132 s) and the stress run (`language-stress`, 235 s) moved to their own jobs; `language-suites` keeps the Haskell, Nix, language and registry steps (about 100 s). All four are blocking.
|
|
18
|
+
- **`bench-gates` is two jobs** (`bench-gates`: self-scan; `bench-gates-b`: mutation, fix verification, layer recall, Haskell precision).
|
|
19
|
+
- **`language-tools-ghc` restores the cabal store** from `actions/cache` (the package build was 499 s of its 10 min). The first run on a given key is cold, and a cache saved on a pull request is not readable by other branches, so the first warm run is after this lands on `main`.
|
|
20
|
+
- **`proof-container` pulls its five images side by side** instead of one after another (the pull step was 64 s).
|
|
21
|
+
- **Not measured end to end at the time of writing.** The next two `TIMINGS` lines are the measurement: this release (cold cache) and the one after it (warm). Not changed: the release workflow, the npm registry's own delay before a new version is listed (about 5 min after a successful publish on 0.194.1 and 0.195.0), and the pre-push gate. Whether the whole path fits 10 minutes is a result of the next release, not a claim made here.
|
|
22
|
+
|
|
23
|
+
## 0.195.0 - A release is cut from one command, and a release-only ship
|
|
24
|
+
|
|
25
|
+
Why: the 0.194.1 release (dependency bumps only) took 1 h 49 min end to end. A clean run is about 41 minutes (push 1062 s, hosted checks 963 s, release workflow 316 s, the rest seconds); the other 68 minutes were two failed attempts, each found 15 minutes in, because the hand-made version bump missed two generated files that record the version (`inventory.json`, `captured.json`). `scripts/release-prepare.mjs` already existed to regenerate them and was not used.
|
|
26
|
+
|
|
27
|
+
- **`release-prepare.mjs --bump patch|minor|major`** computes the next version, so one command bumps and regenerates. Covered by `nextVersion` tests.
|
|
28
|
+
- **`ship` preflight names a stale generated file.** `captured.json`, `inventory.json` and `scorecard.json` must record the version being shipped, or the run stops before the push with the file and the command that fixes it (`staleVersionArtifacts`).
|
|
29
|
+
- **A dependency version bump no longer forces the whole local suite on push.** `onlyVersionOrDependencyBumps` accepts a dependency moving to another version (and its lock lines) as a version-only change; adding or removing a dependency still runs everything. The full suite is a blocking hosted check, so a miss is a red pull request.
|
|
30
|
+
- **`ship --release-only`** releases `main` without pushing, opening a pull request, waiting for checks or merging. It refuses unless `HEAD` is `origin/main` and the hosted `ci` workflow is green on it, runs eight publish blockers locally and leaves the full gate to the hosted release workflow. Not measured end to end at the time of writing: the next `TIMINGS` line is the measurement.
|
|
31
|
+
|
|
32
|
+
Not done: the 5 to 10 minute target needs the change itself to have landed through a pull request already; a release that must also push and verify its own change is still bounded by the hosted checks (about 16 minutes) plus the release workflow (about 5).
|
|
33
|
+
|
|
12
34
|
## 0.194.1 - Dependencies brought current
|
|
13
35
|
|
|
14
36
|
- **`@babel/core` 8.0.10, `z3-solver` 5.3.3, `@types/node` 26.6.6** (scanner), and **`@types/node` 26.6.6** (VS Code extension). Newly published versions made the `dependency-currency` release check fail on the 0.194.0 tree. The scanner bundle is rebuilt because `@babel/core` is embedded in it. No source change.
|
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@clear-capabilities/agentic-security-scanner",
|
|
3
|
-
"version": "0.
|
|
3
|
+
"version": "0.195.1",
|
|
4
4
|
"description": "Scanner engine for the agentic-security Claude Code plugin: SAST, SCA with reachability and CISA KEV, secrets, IaC, Haskell and Nix/NixOS, prompt-injection, MCP/agent-tool audit, authZ analysis, SBOM, compliance attestation, and more.",
|
|
5
5
|
"type": "module",
|
|
6
6
|
"main": "src/index.js",
|