faf-taf-git 2.3.1 → 2.4.0

package/.github/dependabot.yml

@@ -0,0 +1,10 @@
+version: 2
+updates:
+  # Keeps workflow `uses:` pins current (e.g. Wolfe-Jam/faf-taf-git) so they
+  # don't drift behind new releases. Security alerts don't need this file.
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "monthly"
+    commit-message:
+      prefix: "ci"

package/.github/workflows/ci.yml

@@ -45,7 +45,7 @@ jobs:
       # ── R: RECEIPT ────────────────────────────────
       - name: 'R: Generate TAF Receipt'
         if: (github.event_name == 'push' || github.event_name == 'workflow_dispatch') && github.ref == 'refs/heads/main'
-        uses: Wolfe-Jam/faf-taf-git@v2.3.0
+        uses: Wolfe-Jam/faf-taf-git@v2.3.1
         with:
           test-output-file: test-output.txt
           auto-commit: 'true'

package/.github/workflows/claude-code-review.yml

@@ -6,6 +6,13 @@ on:
 
 jobs:
   claude-review:
+    # A Dependabot PR cannot read this repo's Actions secrets — GitHub withholds
+    # them from bot-authored runs — so the action fails its own env validation
+    # and the PR carries a red that says nothing about the change it proposes.
+    # Receipt (faf-cli, 2026-09-23): the last 8 human PRs all passed this
+    # workflow and both Dependabot PRs failed on that error alone. A dependency
+    # bump is Dependabot's diff to justify, not Claude's.
+    if: github.actor != 'dependabot[bot]'
     runs-on: ubuntu-latest
     permissions:
       contents: read
@@ -23,7 +30,7 @@ jobs:
         id: claude-review
         uses: anthropics/claude-code-action@v1
         with:
-          anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
+          claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
           plugin_marketplaces: 'https://github.com/anthropics/claude-code.git'
           plugins: 'code-review@claude-code-plugins'
           prompt: '/code-review:code-review ${{ github.repository }}/pull/${{ github.event.pull_request.number }}'

package/.github/workflows/claude.yml

@@ -34,6 +34,6 @@ jobs:
         id: claude
         uses: anthropics/claude-code-action@v1
         with:
-          anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
+          claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
           additional_permissions: |
             actions: read

package/CHANGELOG.md

@@ -1,5 +1,5 @@
 <!-- faf: faf-taf-git | TypeScript | cli | A Test Receipt Printer for git -->
-<!-- faf: doc=changelog | latest=v2.3.1 | canonical=project.faf | family=TAF -->
+<!-- faf: doc=changelog | latest=v2.4.0 | canonical=project.faf | family=TAF -->
 
 # Changelog
 
@@ -8,6 +8,18 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [2.4.0] - 2026-10-29
+
+JUnit XML parser: TAF now reads the report format most test runners can write, so Python, Rust, Go, Java and .NET projects get receipts with no conversion script.
+
+### Added
+- **JUnit XML parser** (`parseJunitOutput`). Pass a JUnit XML report as `test-output-file`. Handles a `<testsuites>` root with or without totals, a single `<testsuite>`, nested suites (counted once), and suites with no counts (the `<testcase>` elements are counted). Failures and errors count as failed; skipped and disabled count as skipped. Tried first, because a report's captured stdout can hold another runner's summary line. Checked against a real pytest report: 202 passed, 4 skipped, the same as pytest printed.
+- **`skipped` Action output.** The README listed it; the Action now sets it.
+
+### Changed
+- **README rewritten in plain English**, with a recommended workflow: failed runs get a `FAILED` receipt (tests run with `continue-on-error`, then the job fails after the receipt), receipts on `main` only, one test run.
+- CLI `--help` lists JUnit XML among the parsers.
+
 ## [2.3.1] - 2026-09-15
 
 Marketplace metadata — the GitHub Action's description is now under the Marketplace's 125-character limit (it was 153), so the listing can show its current name, **TAF — Testing AI Format**. No code change — same `dist/` as 2.3.0.

package/CLAUDE.md

@@ -14,9 +14,9 @@ Platform-agnostic CLI + GitHub Action for TAF updates
 - **Runtime:** Node.js
 - **Build:** TypeScript Compiler
 - **Package Manager:** npm
-- **Api Type:** REST
+- **API:** REST
 - **Hosting:** npm Registry
-- **Cicd:** GitHub Actions
+- **CI/CD:** GitHub Actions
 - **TargetUser:** developers
 - **CoreProblem:** understanding project
 - **MissionPurpose:** project documentation
@@ -34,5 +34,5 @@ Platform-agnostic CLI + GitHub Action for TAF updates
 
 ---
 
-*STATUS: BI-SYNC ACTIVE — 2026-06-17T12:16:31.736Z*
+*STATUS: SYNC ACTIVE — 2026-10-29T21:20:15.784Z*
 <!-- faf:end -->