ai-rulez 5.7.0 → 5.8.0

package/README.md

@@ -409,7 +409,7 @@ Add to `.pre-commit-config.yaml`:
 ```yaml
 repos:
   - repo: https://github.com/Goldziher/ai-rulez
-    rev: v5.7.0
+    rev: v5.8.0
     hooks:
       - id: ai-rulez-recursive   # generate: write outputs for every nested .ai-rulez/ root
       - id: ai-rulez-validate    # validate --recursive: content, security and link checks
@@ -440,7 +440,7 @@ repository needs:
 [[hooks.sources]]
 id = "ai-rulez"
 git = "https://github.com/Goldziher/ai-rulez.git"
-revision = "v5.7.0"
+revision = "v5.8.0"
 hooks = ["ai-rulez-recursive", "ai-rulez-plugin-verify"]
 ```
 
@@ -493,14 +493,16 @@ the release's `checksums.txt`, caches it (keyed by OS, arch and the resolved ver
 toolchain, Node or Python needed in the job. It reuses the same `scripts/pre-commit/run-ai-rulez.sh`
 download-and-verify logic the pre-commit hooks above use, so the two stay in sync.
 
-Use `Goldziher/ai-rulez@v5` for compatible action updates: publishing a stable v5 release advances
-this floating tag after all distribution jobs succeed. Pin a full release tag or commit SHA to fix
-the action code. The action ref and installed CLI version are independent: set `version` as well
-to pin the binary; its default `latest` can eventually select a newer major release.
+Use `Goldziher/ai-rulez@v5` for compatible action updates: publishing a stable v5 release moves
+this annotated floating tag after all distribution jobs succeed. `uses: Goldziher/ai-rulez@v5` with
+`version: latest` keeps a workflow on the newest 5.x action and the newest released CLI with no
+per-release edits. Pin a full release tag or commit SHA to fix the action code. The action ref and
+installed CLI version are independent: set `version` as well to pin the binary; its default
+`latest` can eventually select a newer major release.
 
 | | |
 | --- | --- |
-| **Input** `version` | `X.Y.Z`, `vX.Y.Z`, or `latest` (default). Optional — omit it to always use the newest release. |
+| **Input** `version` | `X.Y.Z`, `vX.Y.Z`, `X.Y.Z-rc.N` or `latest` (default: the newest stable GitHub release). Optional — omit it to always use the newest release. |
 | **Inputs** `llm-*` | Optional provider, model, gateway, credential variable name, network opt-in, budgets and other LLM settings exported to later steps. [Full reference](docs/github-actions.md#llm-configuration-inputs). |
 | **Output** `version` | The resolved version, without the leading `v`. |
 | **Output** `path` | Absolute path to the installed `ai-rulez` binary. |
@@ -521,7 +523,7 @@ jobs:
       - uses: actions/checkout@v7
       - uses: Goldziher/ai-rulez@v5
         with:
-          version: 5.7.0   # pin the CLI independently of the floating action ref
+          version: 5.8.0   # pin the CLI independently of the floating action ref
       - run: ai-rulez generate --check   # the committed output matches the sources
       - run: ai-rulez validate --strict  # content and security checks, warnings fail
       - run: ai-rulez lock --check        # pins were updated when the sources were
@@ -529,6 +531,15 @@ jobs:
 
 </details>
 
+`uses: Goldziher/ai-rulez/check@v5` installs the CLI the same way and runs the whole governance gate per
+configuration root: `migrate okf --check`, `validate --strict --no-local`, `lock --check`, `generate` then
+`generate --check`, optionally `verify --plugin` and `tokens --budget`, then a clean `git diff HEAD` with no new
+untracked files. `expected-config-count` fails a run that finds a different number of roots, and a job summary lists
+every command. See [the check sub-action](docs/github-actions.md#governance-gate-check).
+`uses: Goldziher/ai-rulez/update@v5` on a schedule runs `ai-rulez update` when `lock --outdated` reports an allowed
+update, regenerates, re-pins the content and opens a pull request with the outdated table (or pushes directly with
+`direct: true`). See [scheduled pin updates](docs/github-actions.md#scheduled-pin-updates-update).
+
 For model-backed reviews, configure `llm-model`, `llm-allow-network: 'true'` and spend limits,
 pass provider credentials through `env:` on the command step or job, and run `ai-rulez judge
 --allow-llm`. Installation itself makes no model requests. See the [action guide](docs/github-actions.md)

package/THIRD_PARTY_NOTICES.md

@@ -47,9 +47,6 @@ after it, and describe the changes on the second line.
 // See THIRD_PARTY_NOTICES.md.
 ```
 
-`scripts/transcode-skillspector-tests.py` writes this header for the tables it generates; the output is a fragment to
-merge into a file that already carries the header once.
-
 ## Neo23x0 signature-base
 
 SkillSpector's YARA rules state that they are based on [Neo23x0/signature-base](https://github.com/Neo23x0/signature-base),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ai-rulez",
-  "version": "5.7.0",
+  "version": "5.8.0",
   "description": "Author, generate, validate and govern AI agent rules, skills, plugins and MCP configuration across 52 coding assistants. Review with verified model evidence, evaluate skills, lock and sign dependencies, and publish bundles. CLI, MCP server and Go API.",
   "keywords": [
     "agent-plugins",