cleartoship 0.13.0 → 0.13.1

package/README.md

@@ -256,14 +256,6 @@ A copyable workflow is in [`examples/security-cli.yml`](examples/security-cli.ym
 
 ### GitHub Action
 
-> **Not usable from other repositories yet.** The action lives in *this*
-> repository, which is currently private, so `uses: murtazaozdemir/cleartoship@…`
-> resolves for nobody but its owner — GitHub answers `Unable to resolve action`
-> — and it cannot be listed on the Marketplace. Nothing about it is broken; it
-> simply needs the repository to be public, and it works the day that happens.
-> Until then, use the CLI recipe above. The npm package itself is public and
-> unaffected.
-
 Posts a summary comment on every pull request, blocks the merge on critical
 findings, and optionally uploads to the Security tab. Copy
 [`examples/security.yml`](examples/security.yml) into `.github/workflows/`:
@@ -279,7 +271,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v7
-      - uses: murtazaozdemir/cleartoship@v0.13.0
+      - uses: murtazaozdemir/cleartoship@v0.13.1
         with:
           fail-on: critical
           comment: true
@@ -301,7 +293,7 @@ above `fail-on`) for use in later steps. The comment is *sticky* — re-runs edi
 the same comment instead of piling up.
 
 By default the action runs the scanner version its own ref declares, so
-`@v0.13.0` runs `cleartoship@0.13.0` and pinning the ref pins the behaviour. If
+`@v0.13.1` runs `cleartoship@0.13.1` and pinning the ref pins the behaviour. If
 that version is not on the registry, it builds from its own checkout instead, so
 `uses: …@ref` works against an unpublished commit.
 

package/action.yml

@@ -1,5 +1,5 @@
 name: ClearToShip
-description: Pre-flight security check for AI-built & vibe-coded apps. Blocks PRs on missing Server Action auth, Supabase RLS holes, hallucinated packages and leaked keys.
+description: Pre-flight security check for AI-built apps, agents included. Blocks PRs on ungated agent tools, model output in a shell, missing Server Action auth, Supabase RLS holes, hallucinated packages and leaked keys.
 author: ClearToShip
 branding:
   icon: shield
@@ -29,7 +29,7 @@ inputs:
   version:
     description: >-
       Version of the cleartoship npm package to run. Defaults to the version this
-      action's own ref declares, so `uses: …@v0.13.0` runs cleartoship@0.13.0. Set
+      action's own ref declares, so `uses: …@v0.13.1` runs cleartoship@0.13.1. Set
       `latest` to always track the newest release, or `local` to build from the checkout.
     required: false
     default: ''
@@ -76,7 +76,7 @@ runs:
       run: |
         # With no version pinned, run the exact version this action's checkout
         # declares. That keeps the action ref and the scanner in lockstep:
-        # `uses: <owner>/cleartoship@v0.13.0` runs cleartoship@0.13.0 instead of
+        # `uses: <owner>/cleartoship@v0.13.1` runs cleartoship@0.13.1 instead of
         # whatever npm happens to tag `latest` at the time.
         ver="$INPUT_VERSION"
         if [ -z "$ver" ]; then

package/examples/security.yml

@@ -22,7 +22,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v7
-      - uses: murtazaozdemir/cleartoship@v0.13.0
+      - uses: murtazaozdemir/cleartoship@v0.13.1
         with:
           fail-on: critical   # block the PR only on criticals
           comment: true        # post a summary comment on the PR

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cleartoship",
-  "version": "0.13.0",
+  "version": "0.13.1",
   "description": "The 30-second pre-launch security clearance for AI-built apps. Statically checks the agent surface no runtime scanner sees before deploy — ungated tools, model output in a shell, prompts in the client bundle — plus missing Server Action auth, Supabase RLS holes, hallucinated npm packages and leaked keys. Free while in beta.",
   "keywords": [
     "security",