openqodex 0.3.0 → 0.4.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +4 -1
- package/dist/bin.js +1180 -349
- package/docs/cli.md +38 -4
- package/docs/github-action.md +1 -1
- package/docs/quickstart.md +9 -0
- package/docs/scanners.md +6 -0
- package/docs/security.md +2 -1
- package/package.json +1 -1
- package/skills/openqodex/SKILL.md +20 -9
package/README.md
CHANGED
|
@@ -42,6 +42,8 @@ Four commands: `init`, `review`, `update` and `trust`. The commands hooks and ag
|
|
|
42
42
|
- `openqodex review --agent` writes a review brief for your agent: the scanner findings to verify, review patterns that fit the change, and the diff.
|
|
43
43
|
- `openqodex review --finalize` checks the agent's findings without a model and writes `report.md`, `report.json` and `report.sarif`.
|
|
44
44
|
- `openqodex review` with neither flag runs the scanners only and prints their report. Git hooks, pre-commit and CI run the same check as `openqodex scan`.
|
|
45
|
+
- `openqodex review <branch>` and `openqodex review '#42'` review a branch or a pull request that is not your current work. OpenQodex fetches it, checks it out in a temporary folder and reviews what it added since it left its base.
|
|
46
|
+
- A change that only deletes code, such as a removed check, can still carry a finding: the lines next to a deletion count as changed.
|
|
45
47
|
- Thirteen built-in scanners. Every downloaded scanner is pinned to one version. Each runs only when the change holds a file it reads.
|
|
46
48
|
- Any scanner by its GitHub link, after you approve it with `openqodex trust`.
|
|
47
49
|
- A push gate for Claude Code and Codex. It warns by default. It blocks only when `.openqodex.yaml` sets `review.block_on_severity`.
|
|
@@ -116,9 +118,10 @@ npx openqodex trust
|
|
|
116
118
|
- When the change holds a lockfile, osv-scanner sends dependency names and versions to osv.dev. It never sends code.
|
|
117
119
|
|
|
118
120
|
- `openqodex trust` reads the custom scanner's release from the GitHub API and downloads it.
|
|
121
|
+
- `openqodex review <branch>` or `review '#<number>'` fetches that branch or pull request from your remote with git, and asks `gh` for the pull request's base when `gh` is installed.
|
|
119
122
|
- For an install made with `init`, a version check at most once a day: the openqodex release list from registry.npmjs.org, and for a newer release its tarball and signed build record. It sends no code and nothing about you.
|
|
120
123
|
|
|
121
|
-
`--offline` skips osv-scanner and semgrep and turns scanner downloads
|
|
124
|
+
`--offline` skips osv-scanner and semgrep and turns scanner downloads, the version check, and the fetch and `gh` call of a branch or pull request review off.
|
|
122
125
|
|
|
123
126
|
The built-in scanners send no code anywhere. Your agent's model sees what your agent reads, as always. A custom scanner you approved does whatever its own command does. [docs/security.md](docs/security.md) gives the full list.
|
|
124
127
|
|