@theonly1me/vigilante 0.2.1 → 0.3.0

package/README.md

@@ -1,5 +1,5 @@
 <div align="center">
-  <img src="https://raw.githubusercontent.com/theonly1me/vigilante/v0.2.1/assets/vigilante-wordmark-white-bg.webp" alt="Vigilante" width="360">
+  <img src="https://raw.githubusercontent.com/theonly1me/vigilante/v0.3.0/assets/vigilante-wordmark-white-bg.webp" alt="Vigilante" width="360">
   <p><b>See what a pull request lets your code, your CI, and your AI agents do, before you merge it.</b></p>
   <p>
     <a href="https://github.com/theonly1me/vigilante/actions/workflows/ci.yml"><img src="https://img.shields.io/github/actions/workflow/status/theonly1me/vigilante/ci.yml?branch=main&amp;label=CI&amp;logo=github" alt="CI"></a>
@@ -16,7 +16,7 @@ Vigilante reads a pull request and lists the new powers that the pull request ad
 
 Your security team approves powers in a `vigilante.lock` file. If a pull request adds a power that is not in the lock, the check fails.
 
-By default, Vigilante does not run code from the repository that it checks. It reads the files and resolves calls by type. It uses [Capslock](https://github.com/google/capslock) for Go, the TypeScript type checker for JavaScript and TypeScript, and Pyright for Python. These tools read code, and they do not run it. Vigilante also downloads the locked packages from their public registries and reads them. If you set `[engines] rust = "typed"`, Vigilante builds the Rust code in a Docker container that has no network access ([docs/dependencies.md](https://github.com/theonly1me/vigilante/blob/v0.2.1/docs/dependencies.md#calls-resolved-by-type)).
+By default, Vigilante does not run code from the repository that it checks. It reads the files and resolves calls by type. It uses [Capslock](https://github.com/google/capslock) for Go, the TypeScript type checker for JavaScript and TypeScript, and Pyright for Python. These tools read code, and they do not run it. Vigilante also downloads the locked packages from their public registries and reads them. If you set `[engines] rust = "typed"`, Vigilante builds the Rust code in a Docker container that has no network access ([docs/dependencies.md](https://github.com/theonly1me/vigilante/blob/v0.3.0/docs/dependencies.md#calls-resolved-by-type)).
 
 ## Why
 
@@ -56,7 +56,7 @@ The same pull request also added a second network call to `services/billing`, th
 | AI agents | `.claude/settings.json`, Claude Code skills and commands, `.mcp.json`, `.cursor/mcp.json`, `.vscode/mcp.json`, `.codex/config.toml`, `.gemini/settings.json` | `tool_allow`, `hook`, `mcp_server`, `skip_permissions` |
 | Build | `package.json` install scripts, `build.rs`, `setup.py`, `.husky/`, `.pre-commit-config.yaml` | `install_hook`, `git_hook` |
 
-Vigilante reports a power the first time that it appears in a scope. After that, it reports each changed risk. Some risks block until `vigilante.lock` approves them. Examples are a call with untrusted input, and a workflow script that reads the title of a pull request. See [docs/risks.md](https://github.com/theonly1me/vigilante/blob/v0.2.1/docs/risks.md). For code, a scope is the nearest package root. For Go, a scope is the Go package. Vigilante skips vendored code. It reports tests and fixtures as test code, apart from the findings. See [docs/powers.md](https://github.com/theonly1me/vigilante/blob/v0.2.1/docs/powers.md) for each power and for the rules that keep the report short.
+Vigilante reports a power the first time that it appears in a scope. After that, it reports each changed risk. Some risks block until `vigilante.lock` approves them. Examples are a call with untrusted input, and a workflow script that reads the title of a pull request. See [docs/risks.md](https://github.com/theonly1me/vigilante/blob/v0.3.0/docs/risks.md). For code, a scope is the nearest package root. For Go, a scope is the Go package. Vigilante skips vendored code. It reports tests and fixtures as test code, apart from the findings. See [docs/powers.md](https://github.com/theonly1me/vigilante/blob/v0.3.0/docs/powers.md) for each power and for the rules that keep the report short.
 
 A finding is `exec`, `network`, or `native` that your package reaches through its own code. This rule is the same in each language. All other results are notes:
 
@@ -64,7 +64,7 @@ A finding is `exec`, `network`, or `native` that your package reaches through it
 - a power that your package reaches only through a dependency, or through another package of the same repository;
 - a new package on a call path to a power.
 
-Notes do not make the check fail, unless a `deny` rule matches their power. For example, a new dependency that reaches the network is a note. [docs/dependencies.md](https://github.com/theonly1me/vigilante/blob/v0.2.1/docs/dependencies.md) tells you how Vigilante reads packages.
+Notes do not make the check fail, unless a `deny` rule matches their power. For example, a new dependency that reaches the network is a note. [docs/dependencies.md](https://github.com/theonly1me/vigilante/blob/v0.3.0/docs/dependencies.md) tells you how Vigilante reads packages.
 
 ## Install
 
@@ -127,7 +127,7 @@ jobs:
         with:
           fetch-depth: 0
           persist-credentials: false
-      - uses: theonly1me/vigilante@v0.2.1
+      - uses: theonly1me/vigilante@v0.3.0
 ```
 <!-- x-release-please-end -->
 
@@ -141,7 +141,7 @@ vigilante.toml      @your-org/security
 .github/            @your-org/security
 ```
 
-After this change, each pull request that adds a power must change `vigilante.lock`. The security team must approve that change. Run `vigilante doctor` to make sure that GitHub enforces these rules. [docs/github-action.md](https://github.com/theonly1me/vigilante/blob/v0.2.1/docs/github-action.md) gives the full setup. It also tells you how to protect the check and how to use Vigilante in other CI systems.
+After this change, each pull request that adds a power must change `vigilante.lock`. The security team must approve that change. Run `vigilante doctor` to make sure that GitHub enforces these rules. [docs/github-action.md](https://github.com/theonly1me/vigilante/blob/v0.3.0/docs/github-action.md) gives the full setup. It also tells you how to protect the check and how to use Vigilante in other CI systems.
 
 ## Use it with AI agents
 
@@ -162,7 +162,7 @@ deny = [{ scope = "services/**", capability = "exec" }]
 trusted_owners = ["your-org"]
 ```
 
-In a pull request, Vigilante reads `vigilante.toml` from the merge base. So a pull request cannot change the rules that check it. [docs/configuration.md](https://github.com/theonly1me/vigilante/blob/v0.2.1/docs/configuration.md) lists each key and the lock format. It also tells you how to add rules for your own wrappers.
+In a pull request, Vigilante reads `vigilante.toml` from the merge base. So a pull request cannot change the rules that check it. [docs/configuration.md](https://github.com/theonly1me/vigilante/blob/v0.3.0/docs/configuration.md) lists each key and the lock format. It also tells you how to add rules for your own wrappers.
 
 ## What Vigilante is not
 
@@ -173,8 +173,8 @@ In a pull request, Vigilante reads `vigilante.toml` from the merge base. So a pu
 
 ## Contribute
 
-Read [CONTRIBUTING.md](https://github.com/theonly1me/vigilante/blob/v0.2.1/CONTRIBUTING.md). To report a security problem, read [SECURITY.md](https://github.com/theonly1me/vigilante/blob/v0.2.1/SECURITY.md). [docs/README.md](https://github.com/theonly1me/vigilante/blob/v0.2.1/docs/README.md) lists all the documentation.
+Read [CONTRIBUTING.md](https://github.com/theonly1me/vigilante/blob/v0.3.0/CONTRIBUTING.md). To report a security problem, read [SECURITY.md](https://github.com/theonly1me/vigilante/blob/v0.3.0/SECURITY.md). [docs/README.md](https://github.com/theonly1me/vigilante/blob/v0.3.0/docs/README.md) lists all the documentation.
 
 ## License
 
-You can use Vigilante under the [Apache License 2.0](https://github.com/theonly1me/vigilante/blob/v0.2.1/LICENSE-APACHE) or the [MIT license](https://github.com/theonly1me/vigilante/blob/v0.2.1/LICENSE-MIT).
+You can use Vigilante under the [Apache License 2.0](https://github.com/theonly1me/vigilante/blob/v0.3.0/LICENSE-APACHE) or the [MIT license](https://github.com/theonly1me/vigilante/blob/v0.3.0/LICENSE-MIT).

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@theonly1me/vigilante",
-  "version": "0.2.1",
+  "version": "0.3.0",
   "description": "Shows the new powers that a pull request gives to code, CI, build, and AI agents",
   "keywords": [
     "security",
@@ -27,9 +27,9 @@
     "node": ">=18"
   },
   "optionalDependencies": {
-    "@theonly1me/vigilante-darwin-arm64": "0.2.1",
-    "@theonly1me/vigilante-darwin-x64": "0.2.1",
-    "@theonly1me/vigilante-linux-arm64": "0.2.1",
-    "@theonly1me/vigilante-linux-x64": "0.2.1"
+    "@theonly1me/vigilante-darwin-arm64": "0.3.0",
+    "@theonly1me/vigilante-darwin-x64": "0.3.0",
+    "@theonly1me/vigilante-linux-arm64": "0.3.0",
+    "@theonly1me/vigilante-linux-x64": "0.3.0"
   }
 }