oss-signal 0.6.0 → 0.6.3

package/CHANGELOG.md

@@ -2,6 +2,21 @@
 
 ## Unreleased
 
+## 0.6.3
+
+- Updated the release workflow to use Node 24 and npm 11.16 for npm Trusted Publishing support.
+- Published through GitHub Actions without an npm OTP.
+
+## 0.6.2
+
+- Switched the release workflow from token-gated publishing to npm Trusted Publishing with provenance.
+- Removed the repository-variable gate so tag releases can publish through GitHub Actions OIDC without npm OTP.
+
+## 0.6.1
+
+- Added GitHub Release creation to the tag-triggered release workflow.
+- Published the repository inventory release with a GitHub Release page and npm package verification path.
+
 ## 0.6.0
 
 - Added repository inventory mode for auditing newline-delimited lists of local paths, GitHub URLs, and `owner/repo` shorthands.

package/README.md

@@ -17,8 +17,8 @@ It checks the files and automation that reduce maintainer load: README, license,
 
 Public evidence for the maintainer workflow is collected in [docs/reviewer-evidence.md](docs/reviewer-evidence.md) and [docs/adoption-evidence.md](docs/adoption-evidence.md).
 
-- Published package: [`oss-signal@0.6.0`](https://www.npmjs.com/package/oss-signal), with `latest` pointing at `0.6.0`.
-- Published GitHub Action: [`SalmonPlays/oss-signal@v0.6.0`](https://github.com/SalmonPlays/oss-signal/tree/v0.6.0).
+- Published package: [`oss-signal@0.6.3`](https://www.npmjs.com/package/oss-signal), with `latest` pointing at `0.6.3`.
+- Published GitHub Action: [`SalmonPlays/oss-signal@v0.6.3`](https://github.com/SalmonPlays/oss-signal/tree/v0.6.3).
 - Public checks: CI, Repository health, and CodeQL are passing on `main`.
 - Self-audit: this repository scores **100/100 (A)** locally and through GitHub URL mode.
 - Field use: four public maintainer-readiness audits have been turned into four issues and four focused follow-up PRs.
@@ -142,7 +142,7 @@ Summary:
 
 See [docs/self-audit.md](docs/self-audit.md) for the full local self-audit report, [docs/examples/github-url-report.md](docs/examples/github-url-report.md) for the GitHub URL audit output, [docs/examples/github-issue-body.md](docs/examples/github-issue-body.md) for issue output, and [docs/examples/self-audit.sarif](docs/examples/self-audit.sarif) for SARIF output.
 
-The [Repository health workflow](.github/workflows/repository-health.yml) runs `SalmonPlays/oss-signal@v0.6.0`, uploads the Markdown report as an artifact, and uploads SARIF to GitHub Code Scanning on non-PR runs. The [Repository inventory workflow](.github/workflows/repository-inventory.yml) runs the inventory mode from CI and uploads a multi-repository report artifact.
+The [Repository health workflow](.github/workflows/repository-health.yml) runs `SalmonPlays/oss-signal@v0.6.3`, uploads the Markdown report as an artifact, and uploads SARIF to GitHub Code Scanning on non-PR runs. The [Repository inventory workflow](.github/workflows/repository-inventory.yml) runs the inventory mode from CI and uploads a multi-repository report artifact.
 
 ## Field Audits
 
@@ -186,7 +186,7 @@ oss-signal . --fail-under 80
 Add `oss-signal` directly to a GitHub Actions workflow:
 
 ```yaml
-- uses: SalmonPlays/oss-signal@v0.6.0
+- uses: SalmonPlays/oss-signal@v0.6.3
   id: oss-signal
   with:
     fail-under: "80"
@@ -202,7 +202,7 @@ The Action writes a concise GitHub Actions step summary by default, so reviewers
 Run an inventory from CI:
 
 ```yaml
-- uses: SalmonPlays/oss-signal@v0.6.0
+- uses: SalmonPlays/oss-signal@v0.6.3
   env:
     GITHUB_TOKEN: ${{ github.token }}
   with:
@@ -214,7 +214,7 @@ Run an inventory from CI:
 Generate an editable Issue body from CI:
 
 ```yaml
-- uses: SalmonPlays/oss-signal@v0.6.0
+- uses: SalmonPlays/oss-signal@v0.6.3
   with:
     format: issue
     output: maintainer-follow-up.md
@@ -236,7 +236,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
-      - uses: SalmonPlays/oss-signal@v0.6.0
+      - uses: SalmonPlays/oss-signal@v0.6.3
         id: oss-signal
         with:
           fail-under: "80"
@@ -259,7 +259,7 @@ permissions:
 
 steps:
   - uses: actions/checkout@v4
-  - uses: SalmonPlays/oss-signal@v0.6.0
+  - uses: SalmonPlays/oss-signal@v0.6.3
     with:
       format: sarif
       output: oss-signal.sarif
@@ -269,7 +269,7 @@ steps:
       sarif_file: oss-signal.sarif
 ```
 
-This repository dogfoods the public Action tag in [Repository health](.github/workflows/repository-health.yml), which runs `SalmonPlays/oss-signal@v0.6.0` against the repository, uploads the Markdown report artifact, and publishes SARIF to Code Scanning on non-PR runs.
+This repository dogfoods the public Action tag in [Repository health](.github/workflows/repository-health.yml), which runs `SalmonPlays/oss-signal@v0.6.3` against the repository, uploads the Markdown report artifact, and publishes SARIF to Code Scanning on non-PR runs.
 
 You can also run the CLI directly in CI:
 
@@ -292,7 +292,7 @@ You can also run the CLI directly in CI:
 
 ## Release Process
 
-Releases use the checklist in [docs/release-process.md](docs/release-process.md). The repository also includes a tag-triggered [release workflow](.github/workflows/release.yml) that verifies the package, runs `npm publish --dry-run`, and can publish to npm with provenance when `NPM_TOKEN` is configured.
+Releases use the checklist in [docs/release-process.md](docs/release-process.md). The repository also includes a tag-triggered [release workflow](.github/workflows/release.yml) that verifies the package, creates a GitHub Release, and publishes to npm with Trusted Publishing provenance.
 
 ## Contributing
 

package/docs/adoption-evidence.md

@@ -2,14 +2,14 @@
 
 This page collects the public evidence that `oss-signal` is built for real open-source maintainer workflows.
 
-Last verified: 2026-06-03T12:45:11Z
+Last verified: 2026-06-04T02:42:51Z
 
 ## Project Links
 
 - Repository: https://github.com/SalmonPlays/oss-signal
-- npm package: https://www.npmjs.com/package/oss-signal (`0.6.0` latest)
-- GitHub Release: https://github.com/SalmonPlays/oss-signal/releases/tag/v0.6.0
-- GitHub Action tag: https://github.com/SalmonPlays/oss-signal/tree/v0.6.0
+- npm package: https://www.npmjs.com/package/oss-signal (`0.6.3` latest)
+- GitHub Release: https://github.com/SalmonPlays/oss-signal/releases/tag/v0.6.3
+- GitHub Action tag: https://github.com/SalmonPlays/oss-signal/tree/v0.6.3
 - GitHub Action metadata: [action.yml](../action.yml)
 - Public dogfood workflow: [.github/workflows/repository-health.yml](../.github/workflows/repository-health.yml)
 - Public inventory workflow: [.github/workflows/repository-inventory.yml](../.github/workflows/repository-inventory.yml)
@@ -44,15 +44,15 @@ The [maintainer playbook](maintainer-playbook.md) documents the end-to-end workf
 
 ## Published Package Verification
 
-The npm package is publicly available as `oss-signal@0.6.0` with `latest` pointing at `0.6.0`.
+The npm package is publicly available as `oss-signal@0.6.3` with `latest` pointing at `0.6.3`.
 
-The npm downloads API returned 356 downloads for both last-week and last-month windows on 2026-06-03. Download counts can lag publication, so this is treated as supporting evidence rather than proof of broad adoption.
+The npm downloads API returned 356 downloads for both last-week and last-month windows on 2026-06-04. Download counts can lag publication, so this is treated as supporting evidence rather than proof of broad adoption.
 
 Clean-directory execution against the public GitHub repository returned:
 
 ```json
 {
-  "version": "0.6.0",
+  "version": "0.6.3",
   "score": 100,
   "grade": "A",
   "source": "github"
@@ -67,7 +67,7 @@ Current public workflow status:
 - Release: passing
 - Separate public workflow demo: passing
 
-The npm registry returned `0.6.0` for both the package version and `latest` dist-tag on 2026-06-03T12:45:11Z. The same check returned 356 downloads for the last-week and last-month windows.
+The npm registry returned `0.6.3` for both the package version and `latest` dist-tag on 2026-06-04T02:42:51Z. The same check returned 356 downloads for the last-week and last-month windows.
 
 ## Separate Public Workflow Evidence
 
@@ -92,7 +92,7 @@ The tool has been used to generate maintainer-readiness reports for public repos
 
 These issues and pull requests are evidence of the intended maintainer workflow: run a deterministic audit, explain the missing signals, and give maintainers a small set of actionable improvements. Each PR is intentionally limited to documentation or GitHub templates.
 
-All four follow-up PRs were still open when checked from GitHub on 2026-06-03T12:33:45Z. They are not claimed as accepted adoption unless a maintainer merges or otherwise endorses them.
+All four follow-up PRs were still open when checked from GitHub on 2026-06-04T02:42:51Z. They are not claimed as accepted adoption unless a maintainer merges or otherwise endorses them.
 
 ## Verification Commands
 
@@ -104,10 +104,10 @@ npm run audit:github
 node src/cli.js . --format sarif --output docs/examples/self-audit.sarif
 node src/cli.js --inventory docs/examples/inventory-targets.txt --format markdown --output docs/examples/inventory-report.md
 node src/cli.js platformatic/massimo --format json
-npm exec --yes --package=oss-signal@0.6.0 -- oss-signal SalmonPlays/oss-signal --format json
+npm exec --yes --package=oss-signal@0.6.3 -- oss-signal SalmonPlays/oss-signal --format json
 ```
 
-The current repository self-audit score is 100/100, the GitHub community profile health score is 100, and CI verifies the local GitHub Action wrapper. The public `v0.6.0` Action tag is used by the repository health workflow for Markdown and SARIF output. The published npm `0.6.0` package has also been executed from a clean temporary directory against the public GitHub repository, returning 100/100 (A).
+The current repository self-audit score is 100/100, the GitHub community profile health score is 100, and CI verifies the local GitHub Action wrapper. The public `v0.6.3` Action tag is used by the repository health workflow for Markdown and SARIF output. The published npm `0.6.3` package has also been executed from a clean temporary directory against the public GitHub repository, returning 100/100 (A).
 
 Public CI evidence:
 

package/docs/codex-for-oss-application.md

@@ -1,6 +1,6 @@
 # Codex for Open Source Application Brief
 
-Snapshot: 2026-06-03T12:45:11Z
+Snapshot: 2026-06-04T02:42:51Z
 
 This document summarizes why `oss-signal` is a fit for OpenAI's Codex for Open Source program. The official program page says open-source maintainers can apply, with emphasis on core maintainers, widely used public projects, and projects that play an important ecosystem role: https://developers.openai.com/community/codex-for-oss
 
@@ -8,8 +8,8 @@ This document summarizes why `oss-signal` is a fit for OpenAI's Codex for Open S
 
 - Repository: https://github.com/SalmonPlays/oss-signal
 - npm package: https://www.npmjs.com/package/oss-signal
-- GitHub Release: https://github.com/SalmonPlays/oss-signal/releases/tag/v0.6.0
-- GitHub Action tag: https://github.com/SalmonPlays/oss-signal/tree/v0.6.0
+- GitHub Release: https://github.com/SalmonPlays/oss-signal/releases/tag/v0.6.3
+- GitHub Action tag: https://github.com/SalmonPlays/oss-signal/tree/v0.6.3
 - CI workflow: https://github.com/SalmonPlays/oss-signal/actions/workflows/ci.yml
 - Repository health workflow: https://github.com/SalmonPlays/oss-signal/actions/workflows/repository-health.yml
 - Repository inventory workflow: https://github.com/SalmonPlays/oss-signal/actions/workflows/repository-inventory.yml
@@ -47,22 +47,22 @@ This project is designed around repeatable maintainer workflows where Codex is u
 
 The repository currently has:
 
-- A published npm package with `0.6.0` as the latest release.
-- npm download API evidence showing 356 last-week and last-month downloads on 2026-06-03.
-- A published GitHub Release for v0.6.0 with repository inventory release notes and CI usage guidance.
+- A published npm package with `0.6.3` as the latest release.
+- npm download API evidence showing 356 last-week and last-month downloads on 2026-06-04.
+- A published GitHub Release for v0.6.3 with repository inventory release notes and CI usage guidance.
 - A reusable GitHub Action with `score`, `grade`, `failed`, and `report-path` outputs.
 - A repository inventory mode for organization-level maintainer-readiness triage, available in both CLI and GitHub Action form.
-- A clean npm smoke test of `oss-signal@0.6.0` returning version `0.6.0`, score `100`, grade `A`, and source `github`.
+- A clean npm smoke test of `oss-signal@0.6.3` returning version `0.6.3`, score `100`, grade `A`, and source `github`.
 - SARIF output for GitHub Code Scanning integration.
-- A v0.6.0 GitHub Action tag with step summary, SARIF support, inventory support, and Issue-ready output.
-- A public dogfood workflow that runs `SalmonPlays/oss-signal@v0.6.0` against the repository, uploads the Markdown report artifact, and uploads SARIF to GitHub Code Scanning on non-PR runs.
-- A public dogfood inventory workflow that runs `SalmonPlays/oss-signal@v0.6.0` against a repository target list and uploads an inventory artifact.
+- A v0.6.3 GitHub Action tag with step summary, SARIF support, inventory support, and Issue-ready output.
+- A public dogfood workflow that runs `SalmonPlays/oss-signal@v0.6.3` against the repository, uploads the Markdown report artifact, and uploads SARIF to GitHub Code Scanning on non-PR runs.
+- A public dogfood inventory workflow that runs `SalmonPlays/oss-signal@v0.6.3` against a repository target list and uploads an inventory artifact.
 - A separate public workflow demo that runs `SalmonPlays/oss-signal@v0.5.1` from another repository and uploads Markdown, SARIF, and Issue-ready report artifacts.
 - A maintainer playbook that documents audit, triage, issue, PR, CI, and SARIF workflows.
 - A release process and tag-triggered release workflow that verify package contents and support npm provenance publishing when repository secrets are configured.
 - CI, Repository health, CodeQL, and Release workflows passing publicly.
 - A local self-audit score of 100/100.
-- A clean-directory smoke test of `npm exec --yes --package=oss-signal@0.6.0 -- oss-signal SalmonPlays/oss-signal --format json`, returning 100/100 (A).
+- A clean-directory smoke test of `npm exec --yes --package=oss-signal@0.6.3 -- oss-signal SalmonPlays/oss-signal --format json`, returning 100/100 (A).
 - Public reports, issues, and PRs created from real repository audits, including four posted field-audit issues and four follow-up PRs.
 
 ## Separate Workflow Demo
@@ -99,5 +99,5 @@ Prepared official form answers are in [codex-for-oss-form-answers.md](codex-for-
 ## Next Evidence To Collect
 
 - One or more merged external PRs.
-- A public workflow run in an independent maintainer-owned repository using `SalmonPlays/oss-signal@v0.6.0`, ideally with SARIF or inventory upload enabled.
+- A public workflow run in an independent maintainer-owned repository using `SalmonPlays/oss-signal@v0.6.3`, ideally with SARIF or inventory upload enabled.
 - npm download data once the registry starts reporting weekly/monthly counts.

package/docs/codex-for-oss-form-answers.md

@@ -1,6 +1,6 @@
 # Codex for Open Source Form Answers
 
-Snapshot: 2026-06-03T12:45:11Z
+Snapshot: 2026-06-04T02:42:51Z
 
 This page prepares concise answers for the official Codex for Open Source application form: https://openai.com/form/codex-for-oss/
 
@@ -50,7 +50,7 @@ Primary maintainer
 ## Why This Repository Qualifies
 
 ```text
-oss-signal is a public OSS maintainer tool for reducing triage and review load. It ships as npm package oss-signal@0.6.0 and GitHub Action SalmonPlays/oss-signal@v0.6.0, supports Markdown/JSON/SARIF/Issue/Inventory output, passes CI/CodeQL/Release, has a 100/100 self-audit, and has four public field-audit issues plus four PRs.
+oss-signal is a public OSS maintainer tool for reducing triage and review load. It ships as npm package oss-signal@0.6.3 and GitHub Action SalmonPlays/oss-signal@v0.6.3, supports Markdown/JSON/SARIF/Issue/Inventory output, passes CI/CodeQL/Release, has a 100/100 self-audit, and has four public field-audit issues plus four PRs.
 ```
 
 ## Interest
@@ -81,13 +81,13 @@ Use Codex/API credits to run repeatable public repository audits, draft focused
 ## Anything Else
 
 ```text
-The project is early, so I am not overstating adoption. Current evidence includes npm 0.6.0 latest, 356 npm downloads reported by the registry API, a published v0.6.0 release, a reusable GitHub Action with inventory mode, a clean npm smoke test returning 100/A, public CI/Repository health/CodeQL/Release, four field-audit issues, four PRs, and a workflow demo with artifacts.
+The project is early, so I am not overstating adoption. Current evidence includes npm 0.6.3 latest, 356 npm downloads reported by the registry API, a published v0.6.3 release, a reusable GitHub Action with inventory mode, a clean npm smoke test returning 100/A, public CI/Repository health/CodeQL/Release, four field-audit issues, four PRs, and a workflow demo with artifacts.
 ```
 
 ## Evidence Links
 
 - npm package: https://www.npmjs.com/package/oss-signal
-- GitHub Release v0.6.0: https://github.com/SalmonPlays/oss-signal/releases/tag/v0.6.0
+- GitHub Release v0.6.3: https://github.com/SalmonPlays/oss-signal/releases/tag/v0.6.3
 - Main repository health workflow: https://github.com/SalmonPlays/oss-signal/actions/workflows/repository-health.yml
 - Separate workflow demo repository: https://github.com/SalmonPlays/oss-signal-adoption-demo
 - Separate successful workflow run: https://github.com/SalmonPlays/oss-signal-adoption-demo/actions/runs/26883001038

package/docs/examples/github-action-workflow.yml

@@ -10,7 +10,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
-      - uses: SalmonPlays/oss-signal@v0.6.0
+      - uses: SalmonPlays/oss-signal@v0.6.3
         id: oss-signal
         with:
           fail-under: "80"

package/docs/examples/github-code-scanning-workflow.yml

@@ -15,13 +15,13 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
-      - uses: SalmonPlays/oss-signal@v0.6.0
+      - uses: SalmonPlays/oss-signal@v0.6.3
         id: oss-signal
         with:
           fail-under: "80"
           output: oss-signal-report.md
           summary: "true"
-      - uses: SalmonPlays/oss-signal@v0.6.0
+      - uses: SalmonPlays/oss-signal@v0.6.3
         with:
           format: sarif
           output: oss-signal.sarif

package/docs/examples/github-inventory-workflow.yml

@@ -13,7 +13,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
-      - uses: SalmonPlays/oss-signal@v0.6.0
+      - uses: SalmonPlays/oss-signal@v0.6.3
         id: oss-signal
         env:
           GITHUB_TOKEN: ${{ github.token }}

package/docs/examples/github-url-report.md

@@ -2,7 +2,7 @@
 
 Repository: `https://github.com/SalmonPlays/oss-signal`
 Source: GitHub (SalmonPlays/oss-signal@main)
-Generated: 2026-06-03T12:53:35.922Z
+Generated: 2026-06-04T02:43:33.542Z
 
 Score: **100/100** (A)
 

package/docs/examples/inventory-report.md

@@ -1,6 +1,6 @@
 # OSS Signal Inventory
 
-Generated: 2026-06-03T12:53:38.785Z
+Generated: 2026-06-04T02:42:56.030Z
 Repositories: 3
 Average score: **73/100** (C)
 Score range: 55-100

package/docs/examples/self-audit.sarif

@@ -6,7 +6,7 @@
       "tool": {
         "driver": {
           "name": "oss-signal",
-          "semanticVersion": "0.6.0",
+          "semanticVersion": "0.6.3",
           "informationUri": "https://github.com/SalmonPlays/oss-signal",
           "rules": [
             {
@@ -400,7 +400,7 @@
         "score": 100,
         "grade": "A",
         "source": "local",
-        "generatedAt": "2026-06-03T12:53:52.213Z"
+        "generatedAt": "2026-06-04T02:42:52.048Z"
       }
     }
   ]

package/docs/maintainer-playbook.md

@@ -71,7 +71,7 @@ The field-audit examples in [docs/outreach](outreach) show this pattern for publ
 Add the GitHub Action to keep the signal visible:
 
 ```yaml
-- uses: SalmonPlays/oss-signal@v0.6.0
+- uses: SalmonPlays/oss-signal@v0.6.3
   id: oss-signal
   with:
     fail-under: "80"
@@ -84,7 +84,7 @@ The Action writes `score`, `grade`, `failed`, and `report-path` outputs, and wri
 For a repository inventory, commit a newline-delimited target list and pass it through the Action:
 
 ```yaml
-- uses: SalmonPlays/oss-signal@v0.6.0
+- uses: SalmonPlays/oss-signal@v0.6.3
   env:
     GITHUB_TOKEN: ${{ github.token }}
   with:
@@ -104,7 +104,7 @@ permissions:
 
 steps:
   - uses: actions/checkout@v4
-  - uses: SalmonPlays/oss-signal@v0.6.0
+  - uses: SalmonPlays/oss-signal@v0.6.3
     with:
       format: sarif
       output: oss-signal.sarif
@@ -120,7 +120,7 @@ See [docs/examples/github-code-scanning-workflow.yml](examples/github-code-scann
 
 Useful evidence for maintainers and reviewers:
 
-- A public workflow run that uses `SalmonPlays/oss-signal@v0.6.0`.
+- A public workflow run that uses `SalmonPlays/oss-signal@v0.6.3`.
 - A generated Markdown report attached as an artifact.
 - A SARIF upload in Code Scanning.
 - A small issue or PR that follows from an audit finding.

package/docs/release-notes/v0.6.1.md

@@ -0,0 +1,18 @@
+# oss-signal v0.6.1
+
+`oss-signal` v0.6.1 publishes the repository inventory release with GitHub Release automation enabled.
+
+## Highlights
+
+- Keeps the v0.6 inventory mode for auditing newline-delimited lists of repositories.
+- Keeps GitHub Action inventory support with step summary output and average-score outputs.
+- Adds release workflow automation that creates a GitHub Release from `docs/release-notes/`.
+- Verifies npm package contents before release publication.
+
+## Verification
+
+```bash
+npm run check
+node src/cli.js --inventory docs/examples/inventory-targets.txt --format markdown
+npm publish --dry-run
+```

package/docs/release-notes/v0.6.2.md

@@ -0,0 +1,17 @@
+# oss-signal v0.6.2
+
+`oss-signal` v0.6.2 switches release publishing to npm Trusted Publishing.
+
+## Highlights
+
+- Publishes from GitHub Actions through npm Trusted Publishing and OIDC.
+- Keeps npm provenance enabled with `npm publish --provenance`.
+- Removes the old `NPM_TOKEN` / `NPM_PUBLISH_ENABLED` gate from release publishing.
+- Keeps the v0.6 repository inventory CLI and GitHub Action support.
+
+## Verification
+
+```bash
+npm run check
+npm publish --dry-run
+```

package/docs/release-notes/v0.6.3.md

@@ -0,0 +1,16 @@
+# oss-signal v0.6.3
+
+`oss-signal` v0.6.3 completes the move to npm Trusted Publishing.
+
+## Highlights
+
+- Uses Node 24 and npm 11.16 in the release workflow for Trusted Publishing support.
+- Publishes from GitHub Actions without a manual npm OTP.
+- Keeps GitHub Release creation, package verification, and the v0.6 repository inventory workflow.
+
+## Verification
+
+```bash
+npm run check
+npm publish --dry-run
+```

package/docs/release-process.md

@@ -49,11 +49,11 @@ git push origin main --tags
 
 Create a GitHub Release for the tag and use the release notes in `docs/release-notes/` when available.
 
-For example, `v0.6.0` uses [docs/release-notes/v0.6.0.md](release-notes/v0.6.0.md).
+For example, `v0.6.3` uses [docs/release-notes/v0.6.3.md](release-notes/v0.6.3.md).
 
 ## npm Publish
 
-Manual publish path:
+Manual publish path, used only as a fallback:
 
 ```bash
 npm publish --access public
@@ -61,14 +61,14 @@ npm publish --access public
 
 Automation path:
 
-The tag-triggered [release workflow](../.github/workflows/release.yml) runs the same checks and verifies the package with `npm publish --dry-run`.
+The tag-triggered [release workflow](../.github/workflows/release.yml) runs the same checks, verifies the package with `npm publish --dry-run`, creates a GitHub Release, and publishes to npm with Trusted Publishing provenance.
 
-It publishes with provenance only when both release controls are configured:
+Trusted Publishing must be configured on npm for:
 
-- Repository secret `NPM_TOKEN` contains an npm automation token.
-- Repository variable `NPM_PUBLISH_ENABLED` is set to `true`.
-
-If either control is missing, the workflow prints a notice and stops after dry-run verification. This keeps tag verification useful when npm publishing is handled manually.
+- Package: `oss-signal`
+- Repository: `SalmonPlays/oss-signal`
+- Workflow file: `release.yml`
+- Permission: npm publish
 
 ## Post-Release Verification
 

package/docs/reviewer-evidence.md

@@ -1,6 +1,6 @@
 # Reviewer Evidence Quickstart
 
-Last verified: 2026-06-03T12:45:11Z
+Last verified: 2026-06-04T02:42:51Z
 
 This page gives reviewers a short path to verify that `oss-signal` is a real OSS maintainer workflow tool, not only a demo repository.
 
@@ -12,12 +12,12 @@ This page gives reviewers a short path to verify that `oss-signal` is a real OSS
 npm view oss-signal version dist-tags --json
 ```
 
-Expected result: `version` is `0.6.0`, and `dist-tags.latest` is `0.6.0`.
+Expected result: `version` is `0.6.3`, and `dist-tags.latest` is `0.6.3`.
 
 2. Run the published package against the public repository:
 
 ```bash
-npm exec --yes --package=oss-signal@0.6.0 -- oss-signal SalmonPlays/oss-signal --format json
+npm exec --yes --package=oss-signal@0.6.3 -- oss-signal SalmonPlays/oss-signal --format json
 ```
 
 Expected result: score `100`, grade `A`, source `github`.
@@ -40,8 +40,8 @@ Expected result: a Markdown table with one row per repository, average score, sc
 
 5. Inspect the public Action tag:
 
-- Action tag: https://github.com/SalmonPlays/oss-signal/tree/v0.6.0
-- Release: https://github.com/SalmonPlays/oss-signal/releases/tag/v0.6.0
+- Action tag: https://github.com/SalmonPlays/oss-signal/tree/v0.6.3
+- Release: https://github.com/SalmonPlays/oss-signal/releases/tag/v0.6.3
 - Action metadata: [../action.yml](../action.yml)
 
 6. Inspect field-audit evidence:

package/docs/self-audit.md

@@ -2,7 +2,7 @@
 
 Repository: `/Users/amon/Documents/Codex/2026-06-01/openai-s/outputs/oss-signal`
 Source: local
-Generated: 2026-06-03T12:53:52.423Z
+Generated: 2026-06-04T02:42:52.248Z
 
 Score: **100/100** (A)
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "oss-signal",
-  "version": "0.6.0",
+  "version": "0.6.3",
   "description": "A dependency-light CLI that audits open-source repository maintenance readiness.",
   "type": "module",
   "bin": {

package/src/index.js

@@ -2,7 +2,7 @@ import { promises as fs } from "node:fs";
 import https from "node:https";
 import path from "node:path";
 
-export const VERSION = "0.6.0";
+export const VERSION = "0.6.3";
 
 const SARIF_RULE_LOCATIONS = {
   readme: "README.md",