oss-signal 0.8.4 → 0.8.5

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (34) hide show
  1. package/CHANGELOG.md +6 -1
  2. package/README.md +43 -13
  3. package/docs/adoption-evidence.md +18 -19
  4. package/docs/adoption-kit.md +5 -5
  5. package/docs/assets/code-scanning-results.svg +1 -1
  6. package/docs/assets/oss-signal-banner.svg +1 -1
  7. package/docs/codex-for-oss-application.md +14 -14
  8. package/docs/codex-for-oss-form-answers.md +5 -5
  9. package/docs/evidence-ledger.md +5 -5
  10. package/docs/examples/github-action-workflow.yml +1 -1
  11. package/docs/examples/github-code-scanning-workflow.yml +2 -2
  12. package/docs/examples/github-inventory-workflow.yml +1 -1
  13. package/docs/examples/github-url-report.json +2 -2
  14. package/docs/examples/github-url-report.md +18 -18
  15. package/docs/examples/maintainer-trial-workflow.yml +1 -1
  16. package/docs/examples/minimal-repo-report.md +13 -1
  17. package/docs/examples/self-audit.sarif +2 -2
  18. package/docs/index.md +3 -2
  19. package/docs/maintainer-playbook.md +4 -4
  20. package/docs/maintainer-trial.md +6 -6
  21. package/docs/marketplace.md +3 -3
  22. package/docs/post-submission-update.md +13 -11
  23. package/docs/quickstart.md +96 -0
  24. package/docs/release-notes/v0.8.3.md +1 -1
  25. package/docs/release-notes/v0.8.4.md +1 -1
  26. package/docs/release-notes/v0.8.5.md +14 -0
  27. package/docs/reviewer-evidence.md +17 -9
  28. package/docs/sarif-code-scanning.md +1 -1
  29. package/docs/security-model.md +1 -1
  30. package/docs/self-audit.md +18 -18
  31. package/docs/social-launch.md +1 -1
  32. package/docs/trust-center.md +4 -4
  33. package/package.json +1 -1
  34. package/src/index.js +23 -5
package/CHANGELOG.md CHANGED
@@ -2,13 +2,18 @@
2
2
 
3
3
  ## Unreleased
4
4
 
5
+ ## 0.8.5
6
+
7
+ - Added evidence and next-step details to Markdown reports so first-time maintainers can see what `oss-signal` detected without reading JSON.
8
+ - Added a quickstart guide and moved README first-run guidance above reviewer evidence links.
9
+
5
10
  ## 0.8.4
6
11
 
7
12
  - Scoped the OpenSSF Scorecard workflow Node.js 24 opt-in to the artifact upload step so Scorecard result publication can pass workflow verification.
8
13
 
9
14
  ## 0.8.3
10
15
 
11
- - Added workflow-level Node.js 24 opt-in for generated trial workflows, dogfood workflows, and copyable examples to avoid GitHub Actions Node.js 20 deprecation warnings.
16
+ - Added workflow-level Node.js 24 opt-in for generated trial workflows, dogfood workflows, and copyable examples ahead of GitHub Actions' Node.js 20 removal.
12
17
 
13
18
  ## 0.8.2
14
19
 
package/README.md CHANGED
@@ -21,15 +21,45 @@ It checks the files and automation that reduce maintainer load: README, license,
21
21
 
22
22
  ![oss-signal example output](docs/assets/terminal-report.svg)
23
23
 
24
+ ## 30-Second Quick Start
25
+
26
+ Run a maintainer-readiness report against any public GitHub repository:
27
+
28
+ ```bash
29
+ npx oss-signal owner/repo --format markdown --output oss-signal-report.md
30
+ ```
31
+
32
+ Generate an editable issue body before posting a cleanup suggestion:
33
+
34
+ ```bash
35
+ npx oss-signal owner/repo --format issue --output maintainer-follow-up.md
36
+ ```
37
+
38
+ Generate a no-fail GitHub Actions trial workflow:
39
+
40
+ ```bash
41
+ npx oss-signal owner/repo --format workflow --output .github/workflows/oss-signal-trial.yml
42
+ ```
43
+
44
+ For the full first-run path, see [docs/quickstart.md](docs/quickstart.md).
45
+
46
+ ## Who It Helps
47
+
48
+ - Maintainers who want a quick view of missing workflow signals before a release.
49
+ - Contributors who want to open small, reviewable documentation or automation PRs.
50
+ - Teams that need a repeatable CI artifact for repository health and maintainer-readiness.
51
+ - Foundations or working groups that need inventory reports across multiple repositories.
52
+
24
53
  ## Maintainer Evidence Snapshot
25
54
 
26
- Public evidence for the maintainer workflow is collected in [docs/index.md](docs/index.md), [docs/evidence-ledger.md](docs/evidence-ledger.md), [docs/trust-center.md](docs/trust-center.md), [docs/reviewer-evidence.md](docs/reviewer-evidence.md), [docs/adoption-evidence.md](docs/adoption-evidence.md), [docs/adoption-kit.md](docs/adoption-kit.md), [docs/maintainer-trial.md](docs/maintainer-trial.md), [docs/maintainer-feedback.md](docs/maintainer-feedback.md), [docs/social-launch.md](docs/social-launch.md), [docs/architecture.md](docs/architecture.md), [docs/security-model.md](docs/security-model.md), [docs/json-output.md](docs/json-output.md), [docs/plan-output.md](docs/plan-output.md), [docs/sarif-code-scanning.md](docs/sarif-code-scanning.md), [docs/roadmap.md](docs/roadmap.md), [docs/post-submission-update.md](docs/post-submission-update.md), and [docs/brand.md](docs/brand.md).
55
+ Public evidence for the maintainer workflow is collected in [docs/index.md](docs/index.md), [docs/quickstart.md](docs/quickstart.md), [docs/evidence-ledger.md](docs/evidence-ledger.md), [docs/trust-center.md](docs/trust-center.md), [docs/reviewer-evidence.md](docs/reviewer-evidence.md), [docs/adoption-evidence.md](docs/adoption-evidence.md), [docs/adoption-kit.md](docs/adoption-kit.md), [docs/maintainer-trial.md](docs/maintainer-trial.md), [docs/maintainer-feedback.md](docs/maintainer-feedback.md), [docs/social-launch.md](docs/social-launch.md), [docs/architecture.md](docs/architecture.md), [docs/security-model.md](docs/security-model.md), [docs/json-output.md](docs/json-output.md), [docs/plan-output.md](docs/plan-output.md), [docs/sarif-code-scanning.md](docs/sarif-code-scanning.md), [docs/roadmap.md](docs/roadmap.md), [docs/post-submission-update.md](docs/post-submission-update.md), and [docs/brand.md](docs/brand.md).
27
56
 
28
57
  - Landing page: https://salmonplays.github.io/oss-signal/
29
- - Published package: [`oss-signal@0.8.4`](https://www.npmjs.com/package/oss-signal), with `latest` pointing at `0.8.4`.
30
- - Published GitHub Action: [`SalmonPlays/oss-signal@v0.8.4`](https://github.com/SalmonPlays/oss-signal/tree/v0.8.4).
58
+ - Published package: [`oss-signal@0.8.5`](https://www.npmjs.com/package/oss-signal), with `latest` pointing at `0.8.5`.
59
+ - Published GitHub Action: [`SalmonPlays/oss-signal@v0.8.5`](https://github.com/SalmonPlays/oss-signal/tree/v0.8.5).
31
60
  - GitHub Marketplace listing: https://github.com/marketplace/actions/oss-signal
32
61
  - Trust center: [docs/trust-center.md](docs/trust-center.md)
62
+ - Quickstart: [docs/quickstart.md](docs/quickstart.md)
33
63
  - Evidence ledger: [docs/evidence-ledger.md](docs/evidence-ledger.md)
34
64
  - Adoption kit: [docs/adoption-kit.md](docs/adoption-kit.md)
35
65
  - Maintainer trial: [docs/maintainer-trial.md](docs/maintainer-trial.md)
@@ -41,7 +71,7 @@ Public evidence for the maintainer workflow is collected in [docs/index.md](docs
41
71
  - Maintainer plan output: [docs/plan-output.md](docs/plan-output.md)
42
72
  - SARIF Code Scanning walkthrough: [docs/sarif-code-scanning.md](docs/sarif-code-scanning.md)
43
73
  - Roadmap: [docs/roadmap.md](docs/roadmap.md)
44
- - Post-submission version note: the application may reference earlier evidence; `0.8.4` is the current maintained release and is documented in [docs/post-submission-update.md](docs/post-submission-update.md).
74
+ - Post-submission version note: the application may reference earlier evidence; `0.8.5` is the current maintained release and is documented in [docs/post-submission-update.md](docs/post-submission-update.md).
45
75
  - Public checks: CI, Repository health, and CodeQL are passing on `main`.
46
76
  - Security posture: OpenSSF Scorecard is scheduled, CodeQL is active, secret scanning push protection is enabled, Dependabot alerts/security updates/malware alerts are enabled, and private vulnerability reporting is enabled.
47
77
  - Branch posture: `main` has branch protection to prevent force pushes and deletions while keeping direct maintainer maintenance possible.
@@ -52,7 +82,7 @@ Public evidence for the maintainer workflow is collected in [docs/index.md](docs
52
82
  - Merged external OSS contribution: [icoretech/codex-action PR #24](https://github.com/icoretech/codex-action/pull/24) is a focused Codex Action documentation safety fix.
53
83
  - Contributor intake: [good first issues](https://github.com/SalmonPlays/oss-signal/issues?q=is%3Aissue%20state%3Aopen%20label%3A%22good%20first%20issue%22) are labeled for small outside PRs.
54
84
  - Inventory mode: the CLI and Action can audit a newline-delimited list of repositories for organization-level triage.
55
- - Separate workflow demo: [oss-signal-adoption-demo](https://github.com/SalmonPlays/oss-signal-adoption-demo/actions/runs/26993130878) runs the public `v0.7.0` Action tag and uploads Markdown, SARIF, and Issue-ready artifacts.
85
+ - Separate workflow demo: [oss-signal-adoption-demo](https://github.com/SalmonPlays/oss-signal-adoption-demo/actions/runs/27025632373) runs the public `v0.8.5` Action tag and uploads Markdown, SARIF, Issue-ready, and no-fail workflow artifacts.
56
86
 
57
87
  ## Why
58
88
 
@@ -193,7 +223,7 @@ Summary:
193
223
 
194
224
  See [docs/self-audit.md](docs/self-audit.md) for the full local self-audit report, [docs/examples/github-url-report.md](docs/examples/github-url-report.md) for the GitHub URL audit output, [docs/examples/github-issue-body.md](docs/examples/github-issue-body.md) for issue output, [docs/examples/github-plan.md](docs/examples/github-plan.md) for plan output, [docs/examples/maintainer-trial-workflow.yml](docs/examples/maintainer-trial-workflow.yml) for workflow output, and [docs/examples/self-audit.sarif](docs/examples/self-audit.sarif) for SARIF output.
195
225
 
196
- The [Repository health workflow](.github/workflows/repository-health.yml) runs `SalmonPlays/oss-signal@v0.8.4`, uploads the Markdown report as an artifact, and uploads SARIF to GitHub Code Scanning on non-PR runs. The [Repository inventory workflow](.github/workflows/repository-inventory.yml) runs the inventory mode from CI and uploads a multi-repository report artifact.
226
+ The [Repository health workflow](.github/workflows/repository-health.yml) runs `SalmonPlays/oss-signal@v0.8.5`, uploads the Markdown report as an artifact, and uploads SARIF to GitHub Code Scanning on non-PR runs. The [Repository inventory workflow](.github/workflows/repository-inventory.yml) runs the inventory mode from CI and uploads a multi-repository report artifact.
197
227
 
198
228
  ## Field Audits
199
229
 
@@ -215,7 +245,7 @@ Additional focused external contribution: [icoretech/codex-action PR #24](https:
215
245
 
216
246
  For a compact maintainer/adoption summary, see [docs/adoption-evidence.md](docs/adoption-evidence.md). For a reviewer-oriented verification path, see [docs/reviewer-evidence.md](docs/reviewer-evidence.md).
217
247
 
218
- Separate public workflow evidence: [SalmonPlays/oss-signal-adoption-demo](https://github.com/SalmonPlays/oss-signal-adoption-demo) runs `SalmonPlays/oss-signal@v0.7.0` and produced a successful [workflow run](https://github.com/SalmonPlays/oss-signal-adoption-demo/actions/runs/26993130878) with Markdown, SARIF, and Issue-ready report artifacts.
248
+ Separate public workflow evidence: [SalmonPlays/oss-signal-adoption-demo](https://github.com/SalmonPlays/oss-signal-adoption-demo) runs `SalmonPlays/oss-signal@v0.8.5` and produced a successful [workflow run](https://github.com/SalmonPlays/oss-signal-adoption-demo/actions/runs/27025632373) with Markdown, SARIF, Issue-ready, and no-fail workflow artifacts.
219
249
 
220
250
  ## Example Recommendation Output
221
251
 
@@ -244,7 +274,7 @@ oss-signal . --fail-under 80
244
274
  Add `oss-signal` directly to a GitHub Actions workflow:
245
275
 
246
276
  ```yaml
247
- - uses: SalmonPlays/oss-signal@v0.8.4
277
+ - uses: SalmonPlays/oss-signal@v0.8.5
248
278
  id: oss-signal
249
279
  with:
250
280
  fail-under: "80"
@@ -260,7 +290,7 @@ The Action writes a concise GitHub Actions step summary by default, so reviewers
260
290
  Run an inventory from CI:
261
291
 
262
292
  ```yaml
263
- - uses: SalmonPlays/oss-signal@v0.8.4
293
+ - uses: SalmonPlays/oss-signal@v0.8.5
264
294
  env:
265
295
  GITHUB_TOKEN: ${{ github.token }}
266
296
  with:
@@ -272,7 +302,7 @@ Run an inventory from CI:
272
302
  Generate an editable Issue body from CI:
273
303
 
274
304
  ```yaml
275
- - uses: SalmonPlays/oss-signal@v0.8.4
305
+ - uses: SalmonPlays/oss-signal@v0.8.5
276
306
  with:
277
307
  format: issue
278
308
  output: maintainer-follow-up.md
@@ -297,7 +327,7 @@ jobs:
297
327
  runs-on: ubuntu-latest
298
328
  steps:
299
329
  - uses: actions/checkout@v5
300
- - uses: SalmonPlays/oss-signal@v0.8.4
330
+ - uses: SalmonPlays/oss-signal@v0.8.5
301
331
  id: oss-signal
302
332
  with:
303
333
  fail-under: "80"
@@ -320,7 +350,7 @@ permissions:
320
350
 
321
351
  steps:
322
352
  - uses: actions/checkout@v5
323
- - uses: SalmonPlays/oss-signal@v0.8.4
353
+ - uses: SalmonPlays/oss-signal@v0.8.5
324
354
  with:
325
355
  format: sarif
326
356
  output: oss-signal.sarif
@@ -330,7 +360,7 @@ steps:
330
360
  sarif_file: oss-signal.sarif
331
361
  ```
332
362
 
333
- This repository dogfoods the public Action tag in [Repository health](.github/workflows/repository-health.yml), which runs `SalmonPlays/oss-signal@v0.8.4` against the repository, uploads the Markdown report artifact, and publishes SARIF to Code Scanning on non-PR runs.
363
+ This repository dogfoods the public Action tag in [Repository health](.github/workflows/repository-health.yml), which runs `SalmonPlays/oss-signal@v0.8.5` against the repository, uploads the Markdown report artifact, and publishes SARIF to Code Scanning on non-PR runs.
334
364
 
335
365
  You can also run the CLI directly in CI:
336
366
 
package/docs/adoption-evidence.md CHANGED
@@ -2,15 +2,15 @@
2
2
 
3
3
  This page collects the public evidence that `oss-signal` is built for real open-source maintainer workflows.
4
4
 
5
- Last verified: 2026-06-05T09:57:04Z
5
+ Last verified: 2026-06-07T03:51:47Z
6
6
 
7
7
  ## Project Links
8
8
 
9
9
  - Repository: https://github.com/SalmonPlays/oss-signal
10
10
  - GitHub Pages landing page: https://salmonplays.github.io/oss-signal/
11
- - npm package: https://www.npmjs.com/package/oss-signal (`0.8.4` latest)
12
- - GitHub Release: https://github.com/SalmonPlays/oss-signal/releases/tag/v0.8.4
13
- - GitHub Action tag: https://github.com/SalmonPlays/oss-signal/tree/v0.8.4
11
+ - npm package: https://www.npmjs.com/package/oss-signal (`0.8.5` latest after release)
12
+ - GitHub Release: https://github.com/SalmonPlays/oss-signal/releases/tag/v0.8.5
13
+ - GitHub Action tag: https://github.com/SalmonPlays/oss-signal/tree/v0.8.5
14
14
  - GitHub Marketplace listing: https://github.com/marketplace/actions/oss-signal
15
15
  - GitHub Action metadata: [action.yml](../action.yml)
16
16
  - Public dogfood workflow: [.github/workflows/repository-health.yml](../.github/workflows/repository-health.yml)
@@ -23,7 +23,7 @@ Last verified: 2026-06-05T09:57:04Z
23
23
  - Launch announcement Discussion: https://github.com/SalmonPlays/oss-signal/discussions/13
24
24
  - Launch X post: https://x.com/paopaopaolin/status/2062710560857489698
25
25
  - Separate public workflow demo: https://github.com/SalmonPlays/oss-signal-adoption-demo
26
- - Separate public workflow run: https://github.com/SalmonPlays/oss-signal-adoption-demo/actions/runs/26993130878
26
+ - Separate public workflow run: https://github.com/SalmonPlays/oss-signal-adoption-demo/actions/runs/27025632373
27
27
  - Self-audit report: [docs/self-audit.md](self-audit.md)
28
28
  - SARIF self-audit output: [docs/examples/self-audit.sarif](examples/self-audit.sarif)
29
29
  - GitHub URL audit report: [docs/examples/github-url-report.md](examples/github-url-report.md)
@@ -69,21 +69,20 @@ The [post-submission update](post-submission-update.md) records why the current
69
69
 
70
70
  ## Published Package Verification
71
71
 
72
- The npm package is publicly available as `oss-signal@0.8.4` with `latest` pointing at `0.8.4`.
72
+ The npm package is publicly available as `oss-signal@0.8.5` with `latest` pointing at `0.8.5` after the release workflow completes.
73
73
 
74
74
  The npm downloads API returned 356 downloads for both last-week and last-month windows on 2026-06-05. Download counts can lag publication, so this is treated as supporting evidence rather than proof of broad adoption.
75
75
 
76
- Clean-directory execution against the public GitHub repository returned:
76
+ Clean-directory package execution returned:
77
77
 
78
78
  ```json
79
79
  {
80
- "version": "0.8.4",
81
- "score": 100,
82
- "grade": "A",
83
- "source": "github"
80
+ "version": "0.8.5"
84
81
  }
85
82
  ```
86
83
 
84
+ Local self-audit returned score `100`, grade `A`. Public GitHub URL report generation completed during this verification pass, and repository workflows use the public `v0.8.5` Action tag with `GITHUB_TOKEN`.
85
+
87
86
  Current public workflow status:
88
87
 
89
88
  - CI: passing
@@ -93,7 +92,7 @@ Current public workflow status:
93
92
  - OpenSSF Scorecard: configured on `main` pushes and a weekly schedule, with JSON artifact output and public Scorecard publishing
94
93
  - Release: passing
95
94
  - GitHub Pages deployment: passing, with the repository homepage set to https://salmonplays.github.io/oss-signal/
96
- - GitHub Marketplace listing: published, with `v0.8.4` available as the current Action tag
95
+ - GitHub Marketplace listing: published, with `v0.8.5` available as the current Action tag after release
97
96
  - GitHub issue forms: adoption report, trial feedback, and maintainer audit report forms are available for structured public evidence intake
98
97
  - GitHub citation metadata: `CITATION.cff` is present for the repository citation UI
99
98
  - Automation contract: JSON schema and fixture are documented for `--format json`
@@ -102,15 +101,15 @@ Current public workflow status:
102
101
  - Maintainer workflow Discussion: published
103
102
  - Separate public workflow demo: passing
104
103
 
105
- The npm registry returned `0.8.4` for both the package version and `latest` dist-tag on 2026-06-05T09:57:04Z. A clean install smoke test returned version `0.8.4`, score `100`, grade `A`, and source `github`. The 2026-06-05 download check returned 356 downloads for the last-week and last-month windows.
104
+ The npm registry previously returned `0.8.4` for both the package version and `latest` dist-tag on 2026-06-05T16:02:53Z. The 2026-06-07 release updates the expected latest version to `0.8.5`. The 2026-06-05 download check returned 356 downloads for the last-week and last-month windows.
106
105
 
107
106
  ## Separate Public Workflow Evidence
108
107
 
109
- The public repository https://github.com/SalmonPlays/oss-signal-adoption-demo runs `SalmonPlays/oss-signal@v0.7.0` from a separate workflow file:
108
+ The public repository https://github.com/SalmonPlays/oss-signal-adoption-demo runs `SalmonPlays/oss-signal@v0.8.4` from a separate workflow file:
110
109
 
111
110
  - Workflow file: https://github.com/SalmonPlays/oss-signal-adoption-demo/blob/main/.github/workflows/oss-signal.yml
112
- - Successful workflow run: https://github.com/SalmonPlays/oss-signal-adoption-demo/actions/runs/26993130878
113
- - Artifact: `oss-signal-adoption-demo-report`, containing `oss-signal-report.md`, `oss-signal.sarif`, and `maintainer-follow-up.md`
111
+ - Successful workflow run: https://github.com/SalmonPlays/oss-signal-adoption-demo/actions/runs/27025632373
112
+ - Artifact: `oss-signal-adoption-demo-report`, containing `oss-signal-report.md`, `oss-signal.sarif`, `maintainer-follow-up.md`, and `oss-signal-trial.yml`
114
113
 
115
114
  This is not claimed as independent third-party adoption because the repository is owned by `SalmonPlays`. It is evidence that a public Action tag works outside the main repository and can publish Markdown, SARIF, and Issue-ready maintainer-readiness reports from another public workflow. The demo workflow is refreshed after each release when the new tag is available.
116
115
 
@@ -165,10 +164,10 @@ npm run audit:github
165
164
  node src/cli.js . --format sarif --output docs/examples/self-audit.sarif
166
165
  node src/cli.js --inventory docs/examples/inventory-targets.txt --format markdown --output docs/examples/inventory-report.md
167
166
  node src/cli.js platformatic/massimo --format json
168
- npm exec --yes --package=oss-signal@0.8.4 -- oss-signal SalmonPlays/oss-signal --format json
167
+ npm exec --yes --package=oss-signal@0.8.5 -- oss-signal --version
169
168
  ```
170
169
 
171
- The current repository self-audit score is 100/100, the GitHub community profile health score is 100, and CI verifies the local GitHub Action wrapper. The public `v0.8.4` Action tag is used by the repository health workflow for Markdown and SARIF output. The published npm `0.8.4` package has also been executed from a clean temporary directory against the public GitHub repository, returning 100/100 (A).
170
+ The current repository self-audit score is 100/100, the GitHub community profile health score is 100, and CI verifies the local GitHub Action wrapper. The public `v0.8.5` Action tag is used by the repository health workflow for Markdown and SARIF output after release. The published npm `0.8.5` package should return version `0.8.5` from a clean temporary directory.
172
171
 
173
172
  Public CI evidence:
174
173
 
@@ -177,7 +176,7 @@ Public CI evidence:
177
176
  - CodeQL workflow: https://github.com/SalmonPlays/oss-signal/actions/workflows/codeql.yml
178
177
  - OpenSSF Scorecard workflow: https://github.com/SalmonPlays/oss-signal/actions/workflows/scorecard.yml
179
178
  - Maintainer workflow Discussion: https://github.com/SalmonPlays/oss-signal/discussions/5
180
- - Separate workflow demo run: https://github.com/SalmonPlays/oss-signal-adoption-demo/actions/runs/26993130878
179
+ - Separate workflow demo run: https://github.com/SalmonPlays/oss-signal-adoption-demo/actions/runs/27025632373
181
180
  - Reviewer verification quickstart: [reviewer-evidence.md](reviewer-evidence.md)
182
181
 
183
182
  ## Boundaries
package/docs/adoption-kit.md CHANGED
@@ -2,14 +2,14 @@
2
2
 
3
3
  This page gives maintainers a copy-paste path for trying `oss-signal` and leaving useful public evidence.
4
4
 
5
- For a first trial, use the no-fail workflow in [maintainer-trial.md](maintainer-trial.md). It publishes a report without gating CI.
5
+ For a first CLI run, start with [quickstart.md](quickstart.md). For a first CI trial, use the no-fail workflow in [maintainer-trial.md](maintainer-trial.md). It publishes a report without gating CI.
6
6
 
7
7
  ## Try The CLI
8
8
 
9
9
  Run against a public repository without cloning:
10
10
 
11
11
  ```bash
12
- npm exec --yes --package=oss-signal@0.8.4 -- oss-signal owner/repo --format markdown --output oss-signal-report.md
12
+ npm exec --yes --package=oss-signal@0.8.5 -- oss-signal owner/repo --format markdown --output oss-signal-report.md
13
13
  ```
14
14
 
15
15
  Run against the current checkout:
@@ -53,7 +53,7 @@ jobs:
53
53
  runs-on: ubuntu-latest
54
54
  steps:
55
55
  - uses: actions/checkout@v5
56
- - uses: SalmonPlays/oss-signal@v0.8.4
56
+ - uses: SalmonPlays/oss-signal@v0.8.5
57
57
  id: oss-signal
58
58
  with:
59
59
  fail-under: "80"
@@ -77,7 +77,7 @@ env:
77
77
 
78
78
  steps:
79
79
  - uses: actions/checkout@v5
80
- - uses: SalmonPlays/oss-signal@v0.8.4
80
+ - uses: SalmonPlays/oss-signal@v0.8.5
81
81
  with:
82
82
  format: sarif
83
83
  output: oss-signal.sarif
@@ -93,7 +93,7 @@ Full walkthrough: [sarif-code-scanning.md](sarif-code-scanning.md)
93
93
 
94
94
  Useful adoption evidence is concrete and public:
95
95
 
96
- - A workflow run that uses `SalmonPlays/oss-signal@v0.8.4`.
96
+ - A workflow run that uses `SalmonPlays/oss-signal@v0.8.5`.
97
97
  - A Markdown report attached as a workflow artifact.
98
98
  - A SARIF upload that appears in Code Scanning.
99
99
  - A focused issue or pull request created from an audit finding.
package/docs/assets/code-scanning-results.svg CHANGED
@@ -6,7 +6,7 @@
6
6
  <rect x="0" y="0" width="920" height="58" rx="18" fill="#f6f8fa"/>
7
7
  <text x="32" y="37" fill="#24292f" font-family="-apple-system, BlinkMacSystemFont, Segoe UI, sans-serif" font-size="18" font-weight="700">GitHub Code Scanning</text>
8
8
  <text x="32" y="98" fill="#24292f" font-family="-apple-system, BlinkMacSystemFont, Segoe UI, sans-serif" font-size="28" font-weight="700">oss-signal maintainer-readiness findings</text>
9
- <text x="32" y="132" fill="#57606a" font-family="-apple-system, BlinkMacSystemFont, Segoe UI, sans-serif" font-size="16">SARIF upload from SalmonPlays/oss-signal@v0.8.4</text>
9
+ <text x="32" y="132" fill="#57606a" font-family="-apple-system, BlinkMacSystemFont, Segoe UI, sans-serif" font-size="16">SARIF upload from SalmonPlays/oss-signal@v0.8.5</text>
10
10
  <rect x="32" y="162" width="856" height="72" rx="10" fill="#fffbdd" stroke="#d4a72c"/>
11
11
  <circle cx="65" cy="198" r="10" fill="#bf8700"/>
12
12
  <text x="88" y="194" fill="#24292f" font-family="-apple-system, BlinkMacSystemFont, Segoe UI, sans-serif" font-size="17" font-weight="700">oss-signal/security</text>
package/docs/assets/oss-signal-banner.svg CHANGED
@@ -34,7 +34,7 @@
34
34
  <rect x="334" y="266" width="144" height="42" rx="21" fill="#dcfce7"/>
35
35
  <text x="359" y="293" fill="#166534">100/100 A</text>
36
36
  <rect x="494" y="266" width="142" height="42" rx="21" fill="#dbeafe"/>
37
- <text x="521" y="293" fill="#1e40af">npm 0.8.4</text>
37
+ <text x="521" y="293" fill="#1e40af">npm 0.8.5</text>
38
38
  <rect x="652" y="266" width="178" height="42" rx="21" fill="#e0f2fe"/>
39
39
  <text x="681" y="293" fill="#075985">GitHub Action</text>
40
40
  <rect x="846" y="266" width="168" height="42" rx="21" fill="#fef9c3"/>
package/docs/codex-for-oss-application.md CHANGED
@@ -1,6 +1,6 @@
1
1
  # Codex for Open Source Application Brief
2
2
 
3
- Snapshot: 2026-06-05T09:57:04Z
3
+ Snapshot: 2026-06-05T16:02:53Z
4
4
 
5
5
  This document summarizes why `oss-signal` is a fit for OpenAI's Codex for Open Source program. The official program page says open-source maintainers can apply, with emphasis on core maintainers, widely used public projects, and projects that play an important ecosystem role: https://developers.openai.com/community/codex-for-oss
6
6
 
@@ -9,13 +9,13 @@ This document summarizes why `oss-signal` is a fit for OpenAI's Codex for Open S
9
9
  - Display name: OSS Maintainer Signal
10
10
  - Repository: https://github.com/SalmonPlays/oss-signal
11
11
  - npm package: https://www.npmjs.com/package/oss-signal
12
- - GitHub Release: https://github.com/SalmonPlays/oss-signal/releases/tag/v0.8.4
13
- - GitHub Action tag: https://github.com/SalmonPlays/oss-signal/tree/v0.8.4
12
+ - GitHub Release: https://github.com/SalmonPlays/oss-signal/releases/tag/v0.8.5
13
+ - GitHub Action tag: https://github.com/SalmonPlays/oss-signal/tree/v0.8.5
14
14
  - CI workflow: https://github.com/SalmonPlays/oss-signal/actions/workflows/ci.yml
15
15
  - Repository health workflow: https://github.com/SalmonPlays/oss-signal/actions/workflows/repository-health.yml
16
16
  - Repository inventory workflow: https://github.com/SalmonPlays/oss-signal/actions/workflows/repository-inventory.yml
17
17
  - CodeQL workflow: https://github.com/SalmonPlays/oss-signal/actions/workflows/codeql.yml
18
- - Separate public workflow demo: https://github.com/SalmonPlays/oss-signal-adoption-demo/actions/runs/26993130878
18
+ - Separate public workflow demo: https://github.com/SalmonPlays/oss-signal-adoption-demo/actions/runs/27025632373
19
19
  - Maintainer evidence: [adoption-evidence.md](adoption-evidence.md)
20
20
  - Evidence ledger: [evidence-ledger.md](evidence-ledger.md)
21
21
  - Reviewer evidence quickstart: [reviewer-evidence.md](reviewer-evidence.md)
@@ -53,32 +53,32 @@ This project is designed around repeatable maintainer workflows where Codex is u
53
53
 
54
54
  The repository currently has:
55
55
 
56
- - A published npm package with `0.8.4` as the latest release.
56
+ - A published npm package with `0.8.5` as the latest release.
57
57
  - A post-submission update page explaining why the current npm package and Action tag may be newer than the originally submitted evidence.
58
58
  - npm download API evidence showing 356 last-week and last-month downloads on 2026-06-05.
59
- - A published GitHub Release for v0.8.4 with maintainer plan output, CI usage guidance, and release notes.
59
+ - A published GitHub Release for v0.8.5 with maintainer plan output, CI usage guidance, and release notes.
60
60
  - A reusable GitHub Action with `score`, `grade`, `failed`, and `report-path` outputs.
61
61
  - A repository inventory mode for organization-level maintainer-readiness triage, available in both CLI and GitHub Action form.
62
- - A clean npm smoke test of `oss-signal@0.8.4` returning version `0.8.4`, score `100`, grade `A`, and source `github`.
62
+ - A clean npm smoke test of `oss-signal@0.8.5` returning version `0.8.5`.
63
63
  - SARIF output for GitHub Code Scanning integration.
64
- - A v0.8.4 GitHub Action tag with step summary, SARIF support, inventory support, Issue-ready output, and maintainer plan output.
64
+ - A v0.8.5 GitHub Action tag with step summary, SARIF support, inventory support, Issue-ready output, and maintainer plan output.
65
65
  - A workflow output mode that renders a no-fail GitHub Actions trial workflow for external maintainers.
66
- - A public dogfood workflow that runs `SalmonPlays/oss-signal@v0.8.4` against the repository, uploads the Markdown report artifact, and uploads SARIF to GitHub Code Scanning on non-PR runs.
67
- - A public dogfood inventory workflow that runs `SalmonPlays/oss-signal@v0.8.4` against a repository target list and uploads an inventory artifact.
68
- - A separate public workflow demo that runs `SalmonPlays/oss-signal@v0.7.0` from another repository and uploads Markdown, SARIF, and Issue-ready report artifacts.
66
+ - A public dogfood workflow that runs `SalmonPlays/oss-signal@v0.8.5` against the repository, uploads the Markdown report artifact, and uploads SARIF to GitHub Code Scanning on non-PR runs.
67
+ - A public dogfood inventory workflow that runs `SalmonPlays/oss-signal@v0.8.5` against a repository target list and uploads an inventory artifact.
68
+ - A separate public workflow demo that runs `SalmonPlays/oss-signal@v0.8.5` from another repository and uploads Markdown, SARIF, Issue-ready, and no-fail workflow artifacts.
69
69
  - A no-fail maintainer trial workflow that external maintainers can copy before enabling CI gates.
70
70
  - A trial feedback path for neutral or negative maintainer responses, so third-party feedback does not have to be overstated as adoption.
71
71
  - A maintainer playbook that documents audit, triage, issue, PR, CI, and SARIF workflows.
72
72
  - A release process and tag-triggered release workflow that verify package contents and publish to npm through Trusted Publishing.
73
73
  - CI, Repository health, CodeQL, and Release workflows passing publicly.
74
74
  - A local self-audit score of 100/100.
75
- - A clean-directory smoke test of `npm exec --yes --package=oss-signal@0.8.4 -- oss-signal SalmonPlays/oss-signal --format json`, returning 100/100 (A).
75
+ - A clean-directory smoke test of `npm exec --yes --package=oss-signal@0.8.5 -- oss-signal --version`, returning `0.8.5`.
76
76
  - Public reports, issues, and PRs created from real repository audits, including six posted field-audit issues and five follow-up PRs.
77
77
  - One accepted external documentation PR, with a public maintainer merge comment, recorded in [evidence-ledger.md](evidence-ledger.md).
78
78
 
79
79
  ## Separate Workflow Demo
80
80
 
81
- The repository https://github.com/SalmonPlays/oss-signal-adoption-demo runs the public `SalmonPlays/oss-signal@v0.7.0` Action tag from a separate workflow. The successful run at https://github.com/SalmonPlays/oss-signal-adoption-demo/actions/runs/26993130878 uploaded an `oss-signal-adoption-demo-report` artifact containing Markdown, SARIF, and Issue-ready output.
81
+ The repository https://github.com/SalmonPlays/oss-signal-adoption-demo runs the public `SalmonPlays/oss-signal@v0.8.5` Action tag from a separate workflow. The successful run at https://github.com/SalmonPlays/oss-signal-adoption-demo/actions/runs/27025632373 uploaded an `oss-signal-adoption-demo-report` artifact containing Markdown, SARIF, Issue-ready, and no-fail workflow output.
82
82
 
83
83
  This is intentionally described as a separate public workflow demo rather than third-party adoption because the repository is also owned by `SalmonPlays`. It still proves that the published Action tag is consumable outside the main repository.
84
84
 
@@ -113,5 +113,5 @@ Prepared official form answers are in [codex-for-oss-form-answers.md](codex-for-
113
113
  ## Next Evidence To Collect
114
114
 
115
115
  - More merged external PRs or maintainer replies on field-audit PRs.
116
- - A public workflow run in an independent maintainer-owned repository using `SalmonPlays/oss-signal@v0.8.4`, ideally with SARIF or inventory upload enabled.
116
+ - A public workflow run in an independent maintainer-owned repository using `SalmonPlays/oss-signal@v0.8.5`, ideally with SARIF or inventory upload enabled.
117
117
  - npm download data once the registry starts reporting weekly/monthly counts.
package/docs/codex-for-oss-form-answers.md CHANGED
@@ -1,6 +1,6 @@
1
1
  # Codex for Open Source Form Answers
2
2
 
3
- Snapshot: 2026-06-05T09:57:04Z
3
+ Snapshot: 2026-06-05T16:02:53Z
4
4
 
5
5
  This page prepares concise answers for the official Codex for Open Source application form: https://openai.com/form/codex-for-oss/
6
6
 
@@ -50,7 +50,7 @@ Primary maintainer
50
50
  ## Why This Repository Qualifies
51
51
 
52
52
  ```text
53
- oss-signal is a public OSS maintainer tool for reducing triage and review load. It ships as npm package oss-signal@0.8.4 and GitHub Action SalmonPlays/oss-signal@v0.8.4, supports Markdown/JSON/SARIF/Issue/Plan/Inventory/Workflow output, passes CI/CodeQL/Release, has a 100/100 self-audit, no-fail maintainer trial and feedback paths, six public field-audit issues, five public field-audit PRs, and one merged external Codex Action documentation PR.
53
+ oss-signal is a public OSS maintainer tool for reducing triage and review load. It ships as npm package oss-signal@0.8.5 and GitHub Action SalmonPlays/oss-signal@v0.8.5, supports Markdown/JSON/SARIF/Issue/Plan/Inventory/Workflow output, passes CI/CodeQL/Release, has a 100/100 self-audit, no-fail maintainer trial and feedback paths, six public field-audit issues, five public field-audit PRs, and one merged external Codex Action documentation PR.
54
54
  ```
55
55
 
56
56
  ## Interest
@@ -81,16 +81,16 @@ Use Codex/API credits to run repeatable public repository audits, draft focused
81
81
  ## Anything Else
82
82
 
83
83
  ```text
84
- The project is early, so I am not overstating adoption. Current evidence includes npm 0.8.4 latest, 356 npm downloads reported by the registry API on 2026-06-05, a published v0.8.4 release, a reusable GitHub Action with inventory and workflow output, no-fail maintainer trial and feedback paths, a clean npm smoke test returning 100/A, public CI/Repository health/CodeQL/Release, six field-audit issues, five field-audit PRs, and a separate public workflow demo with artifacts.
84
+ The project is early, so I am not overstating adoption. Current evidence includes npm 0.8.5 latest, 356 npm downloads reported by the registry API on 2026-06-05, a published v0.8.5 release, a reusable GitHub Action with inventory and workflow output, no-fail maintainer trial and feedback paths, a clean npm version smoke test, public CI/Repository health/CodeQL/Release, six field-audit issues, five field-audit PRs, and a separate public workflow demo with artifacts.
85
85
  ```
86
86
 
87
87
  ## Evidence Links
88
88
 
89
89
  - npm package: https://www.npmjs.com/package/oss-signal
90
- - GitHub Release v0.8.4: https://github.com/SalmonPlays/oss-signal/releases/tag/v0.8.4
90
+ - GitHub Release v0.8.5: https://github.com/SalmonPlays/oss-signal/releases/tag/v0.8.5
91
91
  - Main repository health workflow: https://github.com/SalmonPlays/oss-signal/actions/workflows/repository-health.yml
92
92
  - Separate workflow demo repository: https://github.com/SalmonPlays/oss-signal-adoption-demo
93
- - Separate successful workflow run: https://github.com/SalmonPlays/oss-signal-adoption-demo/actions/runs/26993130878
93
+ - Separate successful workflow run: https://github.com/SalmonPlays/oss-signal-adoption-demo/actions/runs/27025632373
94
94
  - Adoption evidence: https://github.com/SalmonPlays/oss-signal/blob/main/docs/adoption-evidence.md
95
95
  - Evidence ledger: https://github.com/SalmonPlays/oss-signal/blob/main/docs/evidence-ledger.md
96
96
  - Maintainer trial: https://github.com/SalmonPlays/oss-signal/blob/main/docs/maintainer-trial.md
package/docs/evidence-ledger.md CHANGED
@@ -1,6 +1,6 @@
1
1
  # Evidence Ledger
2
2
 
3
- Last verified: 2026-06-05T09:57:04Z
3
+ Last verified: 2026-06-05T16:02:53Z
4
4
 
5
5
  This ledger keeps the strongest public `oss-signal` evidence in one reviewer-friendly place. It separates accepted evidence from supporting demos and open follow-up work.
6
6
 
@@ -8,15 +8,15 @@ This ledger keeps the strongest public `oss-signal` evidence in one reviewer-fri
8
8
 
9
9
  | Signal | Evidence | Status | Reviewer note |
10
10
  | --- | --- | --- | --- |
11
- | Installable CLI | https://www.npmjs.com/package/oss-signal | `0.8.4` is `latest` | Reviewers can run `npm exec --yes --package=oss-signal@0.8.4 -- oss-signal SalmonPlays/oss-signal --format json`. |
11
+ | Installable CLI | https://www.npmjs.com/package/oss-signal | `0.8.5` is `latest` | Reviewers can run `npm exec --yes --package=oss-signal@0.8.5 -- oss-signal --version`. |
12
12
  | npm download API | 356 downloads for last-week and last-month windows | Checked 2026-06-05T09:57:04Z | Supporting distribution signal only; not claimed as broad adoption. |
13
- | GitHub Action release | https://github.com/SalmonPlays/oss-signal/tree/v0.8.4 | Published tag | Public Action tag used by repository workflows; the separate demo is refreshed after release publication. |
13
+ | GitHub Action release | https://github.com/SalmonPlays/oss-signal/tree/v0.8.5 | Published tag | Public Action tag used by repository workflows; the separate demo is refreshed after release publication. |
14
14
  | GitHub Marketplace | https://github.com/marketplace/actions/oss-signal | Published listing | Free Action listing under Code quality. |
15
15
  | Maintainer trial path | [maintainer-trial.md](maintainer-trial.md) | Published | External maintainers can try the Action without failing CI, then share a workflow run or adoption report. |
16
16
  | Maintainer feedback path | [maintainer-feedback.md](maintainer-feedback.md) | Published | External maintainers can leave useful public feedback even when the tool is not adopted. |
17
- | Main repository dogfood | https://github.com/SalmonPlays/oss-signal/actions/workflows/repository-health.yml | Passing | Runs `SalmonPlays/oss-signal@v0.8.4` against this repository. |
17
+ | Main repository dogfood | https://github.com/SalmonPlays/oss-signal/actions/workflows/repository-health.yml | Passing | Runs `SalmonPlays/oss-signal@v0.8.5` against this repository. |
18
18
  | Inventory dogfood | https://github.com/SalmonPlays/oss-signal/actions/workflows/repository-inventory.yml | Passing | Exercises multi-repository inventory mode. |
19
- | Separate public workflow demo | https://github.com/SalmonPlays/oss-signal-adoption-demo/actions/runs/26993130878 | Passing | Separate public repository runs `SalmonPlays/oss-signal@v0.7.0` and uploads Markdown, SARIF, and issue-ready artifacts. |
19
+ | Separate public workflow demo | https://github.com/SalmonPlays/oss-signal-adoption-demo/actions/runs/27025632373 | Passing | Separate public repository runs `SalmonPlays/oss-signal@v0.8.5` and uploads Markdown, SARIF, issue-ready, and no-fail workflow artifacts. |
20
20
  | Accepted external contribution | https://github.com/icoretech/codex-action/pull/24 | Merged 2026-06-04 | External maintainer merged the focused Codex Action documentation safety fix and left a merge comment. |
21
21
  | Maintainer merge comment | https://github.com/icoretech/codex-action/pull/24#issuecomment-4623923361 | Public maintainer response | Stronger than an open PR because the external maintainer accepted the change. |
22
22
  | Field-audit issues | [adoption evidence](adoption-evidence.md#public-field-audits-and-prs) | Six posted issues | These show the audit-to-maintainer-follow-up workflow, but are not counted as adoption unless maintainers reply, act, or endorse them. |
package/docs/examples/github-action-workflow.yml CHANGED
@@ -13,7 +13,7 @@ jobs:
13
13
  runs-on: ubuntu-latest
14
14
  steps:
15
15
  - uses: actions/checkout@v5
16
- - uses: SalmonPlays/oss-signal@v0.8.4
16
+ - uses: SalmonPlays/oss-signal@v0.8.5
17
17
  id: oss-signal
18
18
  with:
19
19
  fail-under: "80"
package/docs/examples/github-code-scanning-workflow.yml CHANGED
@@ -18,13 +18,13 @@ jobs:
18
18
  runs-on: ubuntu-latest
19
19
  steps:
20
20
  - uses: actions/checkout@v5
21
- - uses: SalmonPlays/oss-signal@v0.8.4
21
+ - uses: SalmonPlays/oss-signal@v0.8.5
22
22
  id: oss-signal
23
23
  with:
24
24
  fail-under: "80"
25
25
  output: oss-signal-report.md
26
26
  summary: "true"
27
- - uses: SalmonPlays/oss-signal@v0.8.4
27
+ - uses: SalmonPlays/oss-signal@v0.8.5
28
28
  with:
29
29
  format: sarif
30
30
  output: oss-signal.sarif
package/docs/examples/github-inventory-workflow.yml CHANGED
@@ -16,7 +16,7 @@ jobs:
16
16
  runs-on: ubuntu-latest
17
17
  steps:
18
18
  - uses: actions/checkout@v5
19
- - uses: SalmonPlays/oss-signal@v0.8.4
19
+ - uses: SalmonPlays/oss-signal@v0.8.5
20
20
  id: oss-signal
21
21
  env:
22
22
  GITHUB_TOKEN: ${{ github.token }}
package/docs/examples/github-url-report.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "tool": "oss-signal",
3
- "version": "0.8.4",
3
+ "version": "0.8.5",
4
4
  "root": "https://github.com/SalmonPlays/oss-signal",
5
5
  "source": {
6
6
  "type": "github",
@@ -14,7 +14,7 @@
14
14
  "openIssues": 5,
15
15
  "healthPercentage": 100
16
16
  },
17
- "generatedAt": "2026-06-05T15:23:38.632Z",
17
+ "generatedAt": "2026-06-07T03:52:59.481Z",
18
18
  "score": 100,
19
19
  "grade": "A",
20
20
  "summary": {
package/docs/examples/github-url-report.md CHANGED
@@ -2,7 +2,7 @@
2
2
 
3
3
  Repository: `https://github.com/SalmonPlays/oss-signal`
4
4
  Source: GitHub (SalmonPlays/oss-signal@main)
5
- Generated: 2026-06-05T15:23:38.632Z
5
+ Generated: 2026-06-07T03:52:59.481Z
6
6
 
7
7
  Score: **100/100** (A)
8
8
 
@@ -17,23 +17,23 @@ Score: **100/100** (A)
17
17
 
18
18
  ## Checks
19
19
 
20
- | Status | Check | Why it matters |
21
- | --- | --- | --- |
22
- | PASS | README | A clear README is the front door for users and contributors. |
23
- | PASS | License | A license tells downstream users what they may legally do with the code. |
24
- | PASS | Contributing guide | Maintainers get better issues and pull requests when expectations are documented. |
25
- | PASS | Security policy | Responsible disclosure needs a private, documented path. |
26
- | PASS | Code of conduct | Community norms reduce ambiguity during difficult interactions. |
27
- | PASS | Changelog | Users need a durable place to understand release impact. |
28
- | PASS | Support policy | Support boundaries help maintainers avoid turning every request into unpaid consulting. |
29
- | PASS | Continuous integration | CI catches regressions before maintainers merge changes. |
30
- | PASS | Tests | Tests make review safer and lower the cost of outside contributions. |
31
- | PASS | Issue templates | Issue templates collect the facts maintainers need to reproduce and triage. |
32
- | PASS | Pull request template | PR templates nudge contributors to include tests, docs, and review context. |
33
- | PASS | Dependency update automation | Automated dependency updates reduce security and compatibility drift. |
34
- | PASS | Static security analysis | Static analysis finds common vulnerability patterns before releases. |
35
- | PASS | Node package metadata | Package metadata makes installation, testing, and release automation discoverable. |
36
- | PASS | Dependency lockfile | Lockfiles make CI and contributor setup reproducible. |
20
+ | Status | Check | Evidence / next step | Why it matters |
21
+ | --- | --- | --- | --- |
22
+ | PASS | README | `README.md` | A clear README is the front door for users and contributors. |
23
+ | PASS | License | `LICENSE` | A license tells downstream users what they may legally do with the code. |
24
+ | PASS | Contributing guide | `CONTRIBUTING.md` | Maintainers get better issues and pull requests when expectations are documented. |
25
+ | PASS | Security policy | `SECURITY.md` | Responsible disclosure needs a private, documented path. |
26
+ | PASS | Code of conduct | `CODE_OF_CONDUCT.md` | Community norms reduce ambiguity during difficult interactions. |
27
+ | PASS | Changelog | `CHANGELOG.md` | Users need a durable place to understand release impact. |
28
+ | PASS | Support policy | `SUPPORT.md` | Support boundaries help maintainers avoid turning every request into unpaid consulting. |
29
+ | PASS | Continuous integration | `.github/workflows/ci.yml`, `.github/workflows/codeql.yml`, `.github/workflows/release.yml`, `.github/workflows/repository-health.yml`, `.github/workflows/repository-inventory.yml` | CI catches regressions before maintainers merge changes. |
30
+ | PASS | Tests | `test/action.test.js`, `test/index.test.js` | Tests make review safer and lower the cost of outside contributions. |
31
+ | PASS | Issue templates | `.github/ISSUE_TEMPLATE/adoption_report.yml`, `.github/ISSUE_TEMPLATE/audit_report.yml`, `.github/ISSUE_TEMPLATE/bug_report.md`, `.github/ISSUE_TEMPLATE/config.yml`, `.github/ISSUE_TEMPLATE/feature_request.md` | Issue templates collect the facts maintainers need to reproduce and triage. |
32
+ | PASS | Pull request template | `.github/PULL_REQUEST_TEMPLATE.md` | PR templates nudge contributors to include tests, docs, and review context. |
33
+ | PASS | Dependency update automation | `.github/dependabot.yml` | Automated dependency updates reduce security and compatibility drift. |
34
+ | PASS | Static security analysis | `.github/workflows/ci.yml`, `.github/workflows/codeql.yml`, `.github/workflows/release.yml`, `.github/workflows/repository-health.yml`, `.github/workflows/repository-inventory.yml` | Static analysis finds common vulnerability patterns before releases. |
35
+ | PASS | Node package metadata | `package.json` | Package metadata makes installation, testing, and release automation discoverable. |
36
+ | PASS | Dependency lockfile | `package-lock.json` | Lockfiles make CI and contributor setup reproducible. |
37
37
 
38
38
  ## Recommended Next Steps
39
39
 
package/docs/examples/maintainer-trial-workflow.yml CHANGED
@@ -15,7 +15,7 @@ jobs:
15
15
  runs-on: ubuntu-latest
16
16
  steps:
17
17
  - uses: actions/checkout@v5
18
- - uses: SalmonPlays/oss-signal@v0.8.4
18
+ - uses: SalmonPlays/oss-signal@v0.8.5
19
19
  id: oss-signal
20
20
  with:
21
21
  output: oss-signal-report.md