faf-taf-git 2.3.1 → 2.4.1

package/.github/dependabot.yml

@@ -0,0 +1,10 @@
+version: 2
+updates:
+  # Keeps workflow `uses:` pins current (e.g. Wolfe-Jam/faf-taf-git) so they
+  # don't drift behind new releases. Security alerts don't need this file.
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "monthly"
+    commit-message:
+      prefix: "ci"

package/.github/workflows/ci.yml

@@ -45,7 +45,7 @@ jobs:
       # ── R: RECEIPT ────────────────────────────────
       - name: 'R: Generate TAF Receipt'
         if: (github.event_name == 'push' || github.event_name == 'workflow_dispatch') && github.ref == 'refs/heads/main'
-        uses: Wolfe-Jam/faf-taf-git@v2.3.0
+        uses: Wolfe-Jam/faf-taf-git@v2.3.1
         with:
           test-output-file: test-output.txt
           auto-commit: 'true'

package/.github/workflows/claude-code-review.yml

@@ -6,6 +6,13 @@ on:
 
 jobs:
   claude-review:
+    # A Dependabot PR cannot read this repo's Actions secrets — GitHub withholds
+    # them from bot-authored runs — so the action fails its own env validation
+    # and the PR carries a red that says nothing about the change it proposes.
+    # Receipt (faf-cli, 2026-09-23): the last 8 human PRs all passed this
+    # workflow and both Dependabot PRs failed on that error alone. A dependency
+    # bump is Dependabot's diff to justify, not Claude's.
+    if: github.actor != 'dependabot[bot]'
     runs-on: ubuntu-latest
     permissions:
       contents: read
@@ -23,7 +30,7 @@ jobs:
         id: claude-review
         uses: anthropics/claude-code-action@v1
         with:
-          anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
+          claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
           plugin_marketplaces: 'https://github.com/anthropics/claude-code.git'
           plugins: 'code-review@claude-code-plugins'
           prompt: '/code-review:code-review ${{ github.repository }}/pull/${{ github.event.pull_request.number }}'

package/.github/workflows/claude.yml

@@ -34,6 +34,6 @@ jobs:
         id: claude
         uses: anthropics/claude-code-action@v1
         with:
-          anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
+          claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
           additional_permissions: |
             actions: read

package/CHANGELOG.md

@@ -1,5 +1,5 @@
 <!-- faf: faf-taf-git | TypeScript | cli | A Test Receipt Printer for git -->
-<!-- faf: doc=changelog | latest=v2.3.1 | canonical=project.faf | family=TAF -->
+<!-- faf: doc=changelog | latest=v2.4.1 | canonical=project.faf | family=TAF -->
 
 # Changelog
 
@@ -8,6 +8,30 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [2.4.1] - 2026-10-30
+
+`faf-taf-git --version` answers, and the descriptions say tamper-evident, not "cannot be gamed".
+
+### Fixed
+- **`--version` / `-V`** print the package version and exit 0. Before, `faf-taf-git --version` fell through to "No test output file specified" and exit 1, so a stranger's first check failed (found by a cold install of the published 2.4.0). `-v` is still `--verbose`. `tests/cli-version.test.ts`.
+
+### Changed
+- **Descriptions:** `package.json` (npm) and `action.yml` (GitHub Marketplace) no longer say "cannot be gamed"; they now read "append-only, timestamped, kept in git. Proof over time." The RECEIPT-FORMAT heading is "Tamper-evident, not tamper-proof", matching the README.
+- **project.faf:** rebuilt lean from the repo (267 → 57 lines), Trophy. `.faf-dna` unchanged.
+- **README recipe** pins `@v2.4.1`. The Action itself is unchanged from 2.4.0.
+
+## [2.4.0] - 2026-10-29
+
+JUnit XML parser: TAF now reads the report format most test runners can write, so Python, Rust, Go, Java and .NET projects get receipts with no conversion script.
+
+### Added
+- **JUnit XML parser** (`parseJunitOutput`). Pass a JUnit XML report as `test-output-file`. Handles a `<testsuites>` root with or without totals, a single `<testsuite>`, nested suites (counted once), and suites with no counts (the `<testcase>` elements are counted). Failures and errors count as failed; skipped and disabled count as skipped. Tried first, because a report's captured stdout can hold another runner's summary line. Checked against a real pytest report: 202 passed, 4 skipped, the same as pytest printed.
+- **`skipped` Action output.** The README listed it; the Action now sets it.
+
+### Changed
+- **README rewritten in plain English**, with a recommended workflow: failed runs get a `FAILED` receipt (tests run with `continue-on-error`, then the job fails after the receipt), receipts on `main` only, one test run.
+- CLI `--help` lists JUnit XML among the parsers.
+
 ## [2.3.1] - 2026-09-15
 
 Marketplace metadata — the GitHub Action's description is now under the Marketplace's 125-character limit (it was 153), so the listing can show its current name, **TAF — Testing AI Format**. No code change — same `dist/` as 2.3.0.

package/CLAUDE.md

@@ -1,38 +1,30 @@
 <!-- faf:start -->
-<!-- faf: faf-taf-git | TypeScript | cli | Platform-agnostic CLI + GitHub Action for TAF updates -->
+<!-- faf: faf-taf-git | TypeScript | cli | A Test Receipt Printer for git. Every CI run prints a receipt to .taf: append-only, timestamped, kept in git. Proof over time. -->
 <!-- faf: claim=project.faf | family=FAF -->
 
 # CLAUDE.md — faf-taf-git
 
 ## What This Is
 
-Platform-agnostic CLI + GitHub Action for TAF updates
+A Test Receipt Printer for git. Every CI run prints a receipt to .taf: append-only, timestamped, kept in git. Proof over time.
 
 ## Stack
 
 - **Language:** TypeScript
-- **Runtime:** Node.js
-- **Build:** TypeScript Compiler
-- **Package Manager:** npm
-- **Api Type:** REST
-- **Hosting:** npm Registry
-- **Cicd:** GitHub Actions
-- **TargetUser:** developers
-- **CoreProblem:** understanding project
-- **MissionPurpose:** project documentation
-- **PackageManager:** npm/yarn/pnpm
-- **MainLanguage:** JavaScript/TypeScript
+- **Hosting:** npm registry + GitHub Actions Marketplace
+- **Build:** TypeScript (tsc)
+- **CI/CD:** GitHub Actions
 
 ## Context
 
-- **Who:** Development teams adopting test-receipt provenance — open-source maintainers proving honest test history, regulated industries (SOC 2 / ISO / HIPAA) needing append-only audit trails, supply-chain verifiers proving tests ran before artifacts shipped, AI-agent reviewers verifying agent code passes tests consistently, and FAF-ecosystem projects completing the CAR Framework (Claim → Audit → Receipt).
-- **What:** TAF file updates in CI/CD pipelines
-- **Why:** Improve development efficiency
-- **Where:** Any CI/CD platform (GitHub, GitLab, Bitbucket)
-- **When:** During CI/CD test runs
-- **How:** Test-driven development
+- **Who:** Maintainers and teams who want proof their tests kept passing on main, and the reviewers, auditors and AI agents who check it
+- **What:** A Test Receipt Printer for git. Every CI run prints a receipt to .taf: append-only, timestamped, kept in git. Proof over time.
+- **Why:** Test results vanish when CI logs expire. Receipts stay in git, so anyone can look back and check whether main was green before a release.
+- **Where:** https://github.com/Wolfe-Jam/faf-taf-git
+- **When:** v2.4.1 (2026-10-30), --version fix; v2.4.0 (2026-10-29) JUnit XML parser; live since v1.0.0 (2025-10-27)
+- **How:** Run tests, save the output (or a JUnit XML report), then `uses: Wolfe-Jam/faf-taf-git@v2.4.1` with `target-branch: taf-receipts`. Anywhere else: `npx faf-taf-git --file test-output.txt --commit`. The taf-receipts branch only grows: never rewrite it.
 
 ---
 
-*STATUS: BI-SYNC ACTIVE — 2026-06-17T12:16:31.736Z*
+*STATUS: SYNC ACTIVE — 2026-10-30T04:26:00.762Z*
 <!-- faf:end -->