infraweaver 0.1.0 → 0.3.0

package/README.md

@@ -2,7 +2,7 @@
 
 [![License: AGPL v3](https://img.shields.io/badge/License-AGPL%20v3-blue.svg)](LICENSE)
 [![CI](https://github.com/infraweaver-io/infraweaver-action/actions/workflows/test.yml/badge.svg?branch=main)](https://github.com/infraweaver-io/infraweaver-action/actions/workflows/test.yml)
-[![Version](https://img.shields.io/badge/version-0.1.0-blue.svg)](package.json)
+[![Version](https://img.shields.io/badge/version-0.3.0)](package.json) <!-- x-release-please-version -->
 
 **Infraweaver brings your Terraform up to best practice — automatically, as reviewable pull requests.**
 
@@ -57,7 +57,7 @@ jobs:
       - run: pipx install checkov
 
       - name: Run Infraweaver
-        uses: infraweaver-io/infraweaver-action@main
+        uses: infraweaver-io/infraweaver-action@v0.2
         with:
           mode: remediate
           severity_threshold: medium # only act on medium+ concerns
@@ -227,11 +227,40 @@ pnpm test
 ```
 
 All contributions are accepted under the [Contributor License Agreement](CLA.md) (enforced by the CLA
-Assistant on your first PR). There are no tagged releases — consumers reference the action at
-`@main`, and [Conventional Commits](https://www.conventionalcommits.org) prefixes keep the history
-readable. See
+Assistant on your first PR). Releases are cut automatically from
+[Conventional Commits](https://www.conventionalcommits.org) prefixes, so the prefix on your PR title
+decides both the changelog section and the version bump. See
 [`CONTRIBUTING.md`](CONTRIBUTING.md) for the full development, commit, and action-pinning conventions.
 
+## Versioning and pinning
+
+Reference the action at a **tag**, never at `@main`. `main` is the development branch: it moves with every merge, is not release-gated, and can contain changes that were never published.
+
+```yaml
+- uses: infraweaver-io/infraweaver-action@v0.2 # recommended
+```
+
+Three tags are published for every release, and which one you pick is a real trade-off:
+
+| Pin        | Example                | Picks up                          | Use when                                        |
+| ---------- | ---------------------- | --------------------------------- | ----------------------------------------------- |
+| Minor      | `@v0.2`                | patches only (0.2.0 → 0.2.1)      | **Default.** Fixes without surprises.           |
+| Major      | `@v0`                  | every 0.x release                 | After 1.0. See the pre-1.0 warning below.       |
+| Exact      | `@v0.2.0`              | nothing — frozen                  | You bump deliberately, without a bot.           |
+| Commit SHA | `@a1b2c3d… # v0.2.0`   | nothing — frozen, tamper-evident  | Strictest supply-chain policy.                  |
+
+```yaml
+- uses: infraweaver-io/infraweaver-action@a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0 # v0.2.0
+```
+
+Dependabot and Renovate both understand this form and will raise a PR that rewrites the SHA and the
+comment together — so a SHA pin costs you nothing in upkeep but does mean you receive fixes only when
+you merge that PR.
+
+Every release is published to npm with [trusted publishing](https://docs.npmjs.com/trusted-publishers)
+and ships a signed CycloneDX SBOM as a release asset. See [`SECURITY.md`](SECURITY.md) for verification
+steps and the supported-version window.
+
 ## Security
 
 Infraweaver runs AI coding agents with write access to repositories and CI secrets, and is positioned for

package/dist/cli.mjs

@@ -177523,7 +177523,7 @@ var import_semver2 = __toESM(require_semver2(), 1);
 // package.json
 var package_default = {
   name: "infraweaver",
-  version: "0.1.0",
+  version: "0.3.0",
   description: "GitHub Action that remediates Terraform to best practices and opens one scoped pull request per concern.",
   keywords: [
     "ai-coding-agent",
@@ -247441,7 +247441,7 @@ function buildLocalTools(ctx) {
   ];
 }
 function cliVersion() {
-  const raw2 = "0.1.0";
+  const raw2 = "0.3.0";
   if (raw2 !== void 0 && /^\d+\.\d+\.\d+$/.test(raw2)) {
     return raw2;
   }
@@ -247636,7 +247636,7 @@ async function runVerifyEvidenceCli(params) {
 }
 
 // src/cli.ts
-var VERSION10 = "0.1.0";
+var VERSION10 = "0.3.0";
 var bin = basename4(process.argv[1] || "");
 var PROG = bin === "pf" || bin === PRODUCT_SLUG ? bin : PRODUCT_SLUG;
 var rawArgs = process.argv.slice(2);

package/dist/index.js

@@ -177287,7 +177287,7 @@ var import_semver2 = __toESM(require_semver2(), 1);
 // package.json
 var package_default = {
   name: "infraweaver",
-  version: "0.1.0",
+  version: "0.3.0",
   description: "GitHub Action that remediates Terraform to best practices and opens one scoped pull request per concern.",
   keywords: [
     "ai-coding-agent",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "infraweaver",
-  "version": "0.1.0",
+  "version": "0.3.0",
   "description": "GitHub Action that remediates Terraform to best practices and opens one scoped pull request per concern.",
   "keywords": [
     "ai-coding-agent",

package/src/mcp/__snapshots__/checkout.test.ts.snap

@@ -21,11 +21,11 @@ diff --git a/src/format.ts b/src/format.ts
 |      |    4 | + |     currency,
 |      |    5 | + |   }).format(amount);
 |    3 |    6 |   | }
-|    4 |    7 |   |
+|    4 |    7 |   | 
 |    5 |    8 |   | export function formatPercent(value: number) {
 |    6 |    9 |   |   return \`\${(value * 100).toFixed(1)}%\`;
 |    7 |   10 |   | }
-|      |   11 | + |
+|      |   11 | + | 
 |      |   12 | + | export function formatNumber(value: number, decimals = 2) {
 |      |   13 | + |   return new Intl.NumberFormat("en-US", {
 |      |   14 | + |     minimumFractionDigits: decimals,
@@ -38,17 +38,17 @@ diff --git a/src/math.ts b/src/math.ts
 +++ b/src/math.ts
 @@ -3,13 +3,16 @@ export function add(a: number, b: number) {
 |    3 |    3 |   | }
-|    4 |    4 |   |
+|    4 |    4 |   | 
 |    5 |    5 |   | export function subtract(a: number, b: number) {
 |    6 |      | - |   return a + b; // bug: should be a - b
 |      |    6 | + |   return a - b;
 |    7 |    7 |   | }
-|    8 |    8 |   |
+|    8 |    8 |   | 
 |    9 |    9 |   | export function multiply(a: number, b: number) {
 |   10 |      | - |   return a * b + 1; // bug: off by one
 |      |   10 | + |   return a * b;
 |   11 |   11 |   | }
-|   12 |   12 |   |
+|   12 |   12 |   | 
 |   13 |   13 |   | export function divide(a: number, b: number) {
 |      |   14 | + |   if (b === 0) {
 |      |   15 | + |     throw new Error("division by zero");
@@ -72,11 +72,11 @@ diff --git a/src/validate.ts b/src/validate.ts
 |      |    1 | + | export function isPositive(n: number) {
 |      |    2 | + |   return n > 0;
 |      |    3 | + | }
-|      |    4 | + |
+|      |    4 | + | 
 |      |    5 | + | export function isInRange(value: number, min: number, max: number) {
 |      |    6 | + |   return value >= min && value <= max;
 |      |    7 | + | }
-|      |    8 | + |
+|      |    8 | + | 
 |      |    9 | + | export function isInteger(n: number) {
 |      |   10 | + |   return Number.isInteger(n);
 |      |   11 | + | }
@@ -88,7 +88,7 @@ diff --git a/test/math.test.ts b/test/math.test.ts
 |   17 |   17 |   |   it("divides", () => {
 |   18 |   18 |   |     expect(divide(10, 2)).toBe(5);
 |   19 |   19 |   |   });
-|      |   20 | + |
+|      |   20 | + | 
 |      |   21 | + |   it("throws on division by zero", () => {
 |      |   22 | + |     expect(() => divide(1, 0)).toThrow("division by zero");
 |      |   23 | + |   });

package/src/utils/github.ts

@@ -447,7 +447,7 @@ export async function ensureGitHubToken(): Promise<void> {
   // when OIDC is available, always mint a fresh token scoped to
   // GITHUB_REPOSITORY. the inherited GITHUB_TOKEN may be scoped to a
   // different repo (e.g., runner token for infraweaver/app when tests
-  // target infraweaver/test-repo).
+  // target infraweaver-io/test-repo).
   if (isOIDCAvailable()) {
     const token = await acquireNewToken();
     process.env.GITHUB_TOKEN = token;