oss-signal 0.8.5 → 0.8.6

package/CHANGELOG.md

@@ -2,6 +2,10 @@
 
 ## Unreleased
 
+## 0.8.6
+
+- Corrected reviewer evidence text so the separate demo remains accurately documented as `v0.8.4` while the main package advances.
+
 ## 0.8.5
 
 - Added evidence and next-step details to Markdown reports so first-time maintainers can see what `oss-signal` detected without reading JSON.

package/README.md

@@ -55,8 +55,8 @@ For the full first-run path, see [docs/quickstart.md](docs/quickstart.md).
 Public evidence for the maintainer workflow is collected in [docs/index.md](docs/index.md), [docs/quickstart.md](docs/quickstart.md), [docs/evidence-ledger.md](docs/evidence-ledger.md), [docs/trust-center.md](docs/trust-center.md), [docs/reviewer-evidence.md](docs/reviewer-evidence.md), [docs/adoption-evidence.md](docs/adoption-evidence.md), [docs/adoption-kit.md](docs/adoption-kit.md), [docs/maintainer-trial.md](docs/maintainer-trial.md), [docs/maintainer-feedback.md](docs/maintainer-feedback.md), [docs/social-launch.md](docs/social-launch.md), [docs/architecture.md](docs/architecture.md), [docs/security-model.md](docs/security-model.md), [docs/json-output.md](docs/json-output.md), [docs/plan-output.md](docs/plan-output.md), [docs/sarif-code-scanning.md](docs/sarif-code-scanning.md), [docs/roadmap.md](docs/roadmap.md), [docs/post-submission-update.md](docs/post-submission-update.md), and [docs/brand.md](docs/brand.md).
 
 - Landing page: https://salmonplays.github.io/oss-signal/
-- Published package: [`oss-signal@0.8.5`](https://www.npmjs.com/package/oss-signal), with `latest` pointing at `0.8.5`.
-- Published GitHub Action: [`SalmonPlays/oss-signal@v0.8.5`](https://github.com/SalmonPlays/oss-signal/tree/v0.8.5).
+- Published package: [`oss-signal@0.8.6`](https://www.npmjs.com/package/oss-signal), with `latest` pointing at `0.8.6`.
+- Published GitHub Action: [`SalmonPlays/oss-signal@v0.8.6`](https://github.com/SalmonPlays/oss-signal/tree/v0.8.6).
 - GitHub Marketplace listing: https://github.com/marketplace/actions/oss-signal
 - Trust center: [docs/trust-center.md](docs/trust-center.md)
 - Quickstart: [docs/quickstart.md](docs/quickstart.md)
@@ -71,7 +71,7 @@ Public evidence for the maintainer workflow is collected in [docs/index.md](docs
 - Maintainer plan output: [docs/plan-output.md](docs/plan-output.md)
 - SARIF Code Scanning walkthrough: [docs/sarif-code-scanning.md](docs/sarif-code-scanning.md)
 - Roadmap: [docs/roadmap.md](docs/roadmap.md)
-- Post-submission version note: the application may reference earlier evidence; `0.8.5` is the current maintained release and is documented in [docs/post-submission-update.md](docs/post-submission-update.md).
+- Post-submission version note: the application may reference earlier evidence; `0.8.6` is the current maintained release and is documented in [docs/post-submission-update.md](docs/post-submission-update.md).
 - Public checks: CI, Repository health, and CodeQL are passing on `main`.
 - Security posture: OpenSSF Scorecard is scheduled, CodeQL is active, secret scanning push protection is enabled, Dependabot alerts/security updates/malware alerts are enabled, and private vulnerability reporting is enabled.
 - Branch posture: `main` has branch protection to prevent force pushes and deletions while keeping direct maintainer maintenance possible.
@@ -82,7 +82,7 @@ Public evidence for the maintainer workflow is collected in [docs/index.md](docs
 - Merged external OSS contribution: [icoretech/codex-action PR #24](https://github.com/icoretech/codex-action/pull/24) is a focused Codex Action documentation safety fix.
 - Contributor intake: [good first issues](https://github.com/SalmonPlays/oss-signal/issues?q=is%3Aissue%20state%3Aopen%20label%3A%22good%20first%20issue%22) are labeled for small outside PRs.
 - Inventory mode: the CLI and Action can audit a newline-delimited list of repositories for organization-level triage.
-- Separate workflow demo: [oss-signal-adoption-demo](https://github.com/SalmonPlays/oss-signal-adoption-demo/actions/runs/27025632373) runs the public `v0.8.5` Action tag and uploads Markdown, SARIF, Issue-ready, and no-fail workflow artifacts.
+- Separate workflow demo: [oss-signal-adoption-demo](https://github.com/SalmonPlays/oss-signal-adoption-demo/actions/runs/27025632373) runs the public `v0.8.4` Action tag and uploads Markdown, SARIF, Issue-ready, and no-fail workflow artifacts. It remains valid demo evidence while the main repository has advanced to `v0.8.6`.
 
 ## Why
 
@@ -223,7 +223,7 @@ Summary:
 
 See [docs/self-audit.md](docs/self-audit.md) for the full local self-audit report, [docs/examples/github-url-report.md](docs/examples/github-url-report.md) for the GitHub URL audit output, [docs/examples/github-issue-body.md](docs/examples/github-issue-body.md) for issue output, [docs/examples/github-plan.md](docs/examples/github-plan.md) for plan output, [docs/examples/maintainer-trial-workflow.yml](docs/examples/maintainer-trial-workflow.yml) for workflow output, and [docs/examples/self-audit.sarif](docs/examples/self-audit.sarif) for SARIF output.
 
-The [Repository health workflow](.github/workflows/repository-health.yml) runs `SalmonPlays/oss-signal@v0.8.5`, uploads the Markdown report as an artifact, and uploads SARIF to GitHub Code Scanning on non-PR runs. The [Repository inventory workflow](.github/workflows/repository-inventory.yml) runs the inventory mode from CI and uploads a multi-repository report artifact.
+The [Repository health workflow](.github/workflows/repository-health.yml) runs `SalmonPlays/oss-signal@v0.8.6`, uploads the Markdown report as an artifact, and uploads SARIF to GitHub Code Scanning on non-PR runs. The [Repository inventory workflow](.github/workflows/repository-inventory.yml) runs the inventory mode from CI and uploads a multi-repository report artifact.
 
 ## Field Audits
 
@@ -245,7 +245,7 @@ Additional focused external contribution: [icoretech/codex-action PR #24](https:
 
 For a compact maintainer/adoption summary, see [docs/adoption-evidence.md](docs/adoption-evidence.md). For a reviewer-oriented verification path, see [docs/reviewer-evidence.md](docs/reviewer-evidence.md).
 
-Separate public workflow evidence: [SalmonPlays/oss-signal-adoption-demo](https://github.com/SalmonPlays/oss-signal-adoption-demo) runs `SalmonPlays/oss-signal@v0.8.5` and produced a successful [workflow run](https://github.com/SalmonPlays/oss-signal-adoption-demo/actions/runs/27025632373) with Markdown, SARIF, Issue-ready, and no-fail workflow artifacts.
+Separate public workflow evidence: [SalmonPlays/oss-signal-adoption-demo](https://github.com/SalmonPlays/oss-signal-adoption-demo) runs `SalmonPlays/oss-signal@v0.8.4` and produced a successful [workflow run](https://github.com/SalmonPlays/oss-signal-adoption-demo/actions/runs/27025632373) with Markdown, SARIF, Issue-ready, and no-fail workflow artifacts.
 
 ## Example Recommendation Output
 
@@ -274,7 +274,7 @@ oss-signal . --fail-under 80
 Add `oss-signal` directly to a GitHub Actions workflow:
 
 ```yaml
-- uses: SalmonPlays/oss-signal@v0.8.5
+- uses: SalmonPlays/oss-signal@v0.8.6
   id: oss-signal
   with:
     fail-under: "80"
@@ -290,7 +290,7 @@ The Action writes a concise GitHub Actions step summary by default, so reviewers
 Run an inventory from CI:
 
 ```yaml
-- uses: SalmonPlays/oss-signal@v0.8.5
+- uses: SalmonPlays/oss-signal@v0.8.6
   env:
     GITHUB_TOKEN: ${{ github.token }}
   with:
@@ -302,7 +302,7 @@ Run an inventory from CI:
 Generate an editable Issue body from CI:
 
 ```yaml
-- uses: SalmonPlays/oss-signal@v0.8.5
+- uses: SalmonPlays/oss-signal@v0.8.6
   with:
     format: issue
     output: maintainer-follow-up.md
@@ -327,7 +327,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v5
-      - uses: SalmonPlays/oss-signal@v0.8.5
+      - uses: SalmonPlays/oss-signal@v0.8.6
         id: oss-signal
         with:
           fail-under: "80"
@@ -350,7 +350,7 @@ permissions:
 
 steps:
   - uses: actions/checkout@v5
-  - uses: SalmonPlays/oss-signal@v0.8.5
+  - uses: SalmonPlays/oss-signal@v0.8.6
     with:
       format: sarif
       output: oss-signal.sarif
@@ -360,7 +360,7 @@ steps:
       sarif_file: oss-signal.sarif
 ```
 
-This repository dogfoods the public Action tag in [Repository health](.github/workflows/repository-health.yml), which runs `SalmonPlays/oss-signal@v0.8.5` against the repository, uploads the Markdown report artifact, and publishes SARIF to Code Scanning on non-PR runs.
+This repository dogfoods the public Action tag in [Repository health](.github/workflows/repository-health.yml), which runs `SalmonPlays/oss-signal@v0.8.6` against the repository, uploads the Markdown report artifact, and publishes SARIF to Code Scanning on non-PR runs.
 
 You can also run the CLI directly in CI:
 

package/docs/adoption-evidence.md

@@ -8,9 +8,9 @@ Last verified: 2026-06-07T03:51:47Z
 
 - Repository: https://github.com/SalmonPlays/oss-signal
 - GitHub Pages landing page: https://salmonplays.github.io/oss-signal/
-- npm package: https://www.npmjs.com/package/oss-signal (`0.8.5` latest after release)
-- GitHub Release: https://github.com/SalmonPlays/oss-signal/releases/tag/v0.8.5
-- GitHub Action tag: https://github.com/SalmonPlays/oss-signal/tree/v0.8.5
+- npm package: https://www.npmjs.com/package/oss-signal (`0.8.6` latest after release)
+- GitHub Release: https://github.com/SalmonPlays/oss-signal/releases/tag/v0.8.6
+- GitHub Action tag: https://github.com/SalmonPlays/oss-signal/tree/v0.8.6
 - GitHub Marketplace listing: https://github.com/marketplace/actions/oss-signal
 - GitHub Action metadata: [action.yml](../action.yml)
 - Public dogfood workflow: [.github/workflows/repository-health.yml](../.github/workflows/repository-health.yml)
@@ -69,7 +69,7 @@ The [post-submission update](post-submission-update.md) records why the current
 
 ## Published Package Verification
 
-The npm package is publicly available as `oss-signal@0.8.5` with `latest` pointing at `0.8.5` after the release workflow completes.
+The npm package is publicly available as `oss-signal@0.8.6` with `latest` pointing at `0.8.6` after the release workflow completes.
 
 The npm downloads API returned 356 downloads for both last-week and last-month windows on 2026-06-05. Download counts can lag publication, so this is treated as supporting evidence rather than proof of broad adoption.
 
@@ -77,11 +77,11 @@ Clean-directory package execution returned:
 
 ```json
 {
-  "version": "0.8.5"
+  "version": "0.8.6"
 }
 ```
 
-Local self-audit returned score `100`, grade `A`. Public GitHub URL report generation completed during this verification pass, and repository workflows use the public `v0.8.5` Action tag with `GITHUB_TOKEN`.
+Local self-audit returned score `100`, grade `A`. Public GitHub URL report generation completed during this verification pass, and repository workflows use the public `v0.8.6` Action tag with `GITHUB_TOKEN`.
 
 Current public workflow status:
 
@@ -92,7 +92,7 @@ Current public workflow status:
 - OpenSSF Scorecard: configured on `main` pushes and a weekly schedule, with JSON artifact output and public Scorecard publishing
 - Release: passing
 - GitHub Pages deployment: passing, with the repository homepage set to https://salmonplays.github.io/oss-signal/
-- GitHub Marketplace listing: published, with `v0.8.5` available as the current Action tag after release
+- GitHub Marketplace listing: published, with `v0.8.6` available as the current Action tag after release
 - GitHub issue forms: adoption report, trial feedback, and maintainer audit report forms are available for structured public evidence intake
 - GitHub citation metadata: `CITATION.cff` is present for the repository citation UI
 - Automation contract: JSON schema and fixture are documented for `--format json`
@@ -101,7 +101,7 @@ Current public workflow status:
 - Maintainer workflow Discussion: published
 - Separate public workflow demo: passing
 
-The npm registry previously returned `0.8.4` for both the package version and `latest` dist-tag on 2026-06-05T16:02:53Z. The 2026-06-07 release updates the expected latest version to `0.8.5`. The 2026-06-05 download check returned 356 downloads for the last-week and last-month windows.
+The npm registry previously returned `0.8.4` for both the package version and `latest` dist-tag on 2026-06-05T16:02:53Z. The 2026-06-07 release updates the expected latest version to `0.8.6`. The 2026-06-05 download check returned 356 downloads for the last-week and last-month windows.
 
 ## Separate Public Workflow Evidence
 
@@ -164,10 +164,10 @@ npm run audit:github
 node src/cli.js . --format sarif --output docs/examples/self-audit.sarif
 node src/cli.js --inventory docs/examples/inventory-targets.txt --format markdown --output docs/examples/inventory-report.md
 node src/cli.js platformatic/massimo --format json
-npm exec --yes --package=oss-signal@0.8.5 -- oss-signal --version
+npm exec --yes --package=oss-signal@0.8.6 -- oss-signal --version
 ```
 
-The current repository self-audit score is 100/100, the GitHub community profile health score is 100, and CI verifies the local GitHub Action wrapper. The public `v0.8.5` Action tag is used by the repository health workflow for Markdown and SARIF output after release. The published npm `0.8.5` package should return version `0.8.5` from a clean temporary directory.
+The current repository self-audit score is 100/100, the GitHub community profile health score is 100, and CI verifies the local GitHub Action wrapper. The public `v0.8.6` Action tag is used by the repository health workflow for Markdown and SARIF output after release. The published npm `0.8.6` package should return version `0.8.6` from a clean temporary directory.
 
 Public CI evidence:
 

package/docs/adoption-kit.md

@@ -9,7 +9,7 @@ For a first CLI run, start with [quickstart.md](quickstart.md). For a first CI t
 Run against a public repository without cloning:
 
 ```bash
-npm exec --yes --package=oss-signal@0.8.5 -- oss-signal owner/repo --format markdown --output oss-signal-report.md
+npm exec --yes --package=oss-signal@0.8.6 -- oss-signal owner/repo --format markdown --output oss-signal-report.md
 ```
 
 Run against the current checkout:
@@ -53,7 +53,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v5
-      - uses: SalmonPlays/oss-signal@v0.8.5
+      - uses: SalmonPlays/oss-signal@v0.8.6
         id: oss-signal
         with:
           fail-under: "80"
@@ -77,7 +77,7 @@ env:
 
 steps:
   - uses: actions/checkout@v5
-  - uses: SalmonPlays/oss-signal@v0.8.5
+  - uses: SalmonPlays/oss-signal@v0.8.6
     with:
       format: sarif
       output: oss-signal.sarif
@@ -93,7 +93,7 @@ Full walkthrough: [sarif-code-scanning.md](sarif-code-scanning.md)
 
 Useful adoption evidence is concrete and public:
 
-- A workflow run that uses `SalmonPlays/oss-signal@v0.8.5`.
+- A workflow run that uses `SalmonPlays/oss-signal@v0.8.6`.
 - A Markdown report attached as a workflow artifact.
 - A SARIF upload that appears in Code Scanning.
 - A focused issue or pull request created from an audit finding.

package/docs/assets/code-scanning-results.svg

@@ -6,7 +6,7 @@
   <rect x="0" y="0" width="920" height="58" rx="18" fill="#f6f8fa"/>
   <text x="32" y="37" fill="#24292f" font-family="-apple-system, BlinkMacSystemFont, Segoe UI, sans-serif" font-size="18" font-weight="700">GitHub Code Scanning</text>
   <text x="32" y="98" fill="#24292f" font-family="-apple-system, BlinkMacSystemFont, Segoe UI, sans-serif" font-size="28" font-weight="700">oss-signal maintainer-readiness findings</text>
-  <text x="32" y="132" fill="#57606a" font-family="-apple-system, BlinkMacSystemFont, Segoe UI, sans-serif" font-size="16">SARIF upload from SalmonPlays/oss-signal@v0.8.5</text>
+  <text x="32" y="132" fill="#57606a" font-family="-apple-system, BlinkMacSystemFont, Segoe UI, sans-serif" font-size="16">SARIF upload from SalmonPlays/oss-signal@v0.8.6</text>
   <rect x="32" y="162" width="856" height="72" rx="10" fill="#fffbdd" stroke="#d4a72c"/>
   <circle cx="65" cy="198" r="10" fill="#bf8700"/>
   <text x="88" y="194" fill="#24292f" font-family="-apple-system, BlinkMacSystemFont, Segoe UI, sans-serif" font-size="17" font-weight="700">oss-signal/security</text>

package/docs/assets/oss-signal-banner.svg

@@ -34,7 +34,7 @@
     <rect x="334" y="266" width="144" height="42" rx="21" fill="#dcfce7"/>
     <text x="359" y="293" fill="#166534">100/100 A</text>
     <rect x="494" y="266" width="142" height="42" rx="21" fill="#dbeafe"/>
-    <text x="521" y="293" fill="#1e40af">npm 0.8.5</text>
+    <text x="521" y="293" fill="#1e40af">npm 0.8.6</text>
     <rect x="652" y="266" width="178" height="42" rx="21" fill="#e0f2fe"/>
     <text x="681" y="293" fill="#075985">GitHub Action</text>
     <rect x="846" y="266" width="168" height="42" rx="21" fill="#fef9c3"/>

package/docs/codex-for-oss-application.md

@@ -9,8 +9,8 @@ This document summarizes why `oss-signal` is a fit for OpenAI's Codex for Open S
 - Display name: OSS Maintainer Signal
 - Repository: https://github.com/SalmonPlays/oss-signal
 - npm package: https://www.npmjs.com/package/oss-signal
-- GitHub Release: https://github.com/SalmonPlays/oss-signal/releases/tag/v0.8.5
-- GitHub Action tag: https://github.com/SalmonPlays/oss-signal/tree/v0.8.5
+- GitHub Release: https://github.com/SalmonPlays/oss-signal/releases/tag/v0.8.6
+- GitHub Action tag: https://github.com/SalmonPlays/oss-signal/tree/v0.8.6
 - CI workflow: https://github.com/SalmonPlays/oss-signal/actions/workflows/ci.yml
 - Repository health workflow: https://github.com/SalmonPlays/oss-signal/actions/workflows/repository-health.yml
 - Repository inventory workflow: https://github.com/SalmonPlays/oss-signal/actions/workflows/repository-inventory.yml
@@ -53,32 +53,32 @@ This project is designed around repeatable maintainer workflows where Codex is u
 
 The repository currently has:
 
-- A published npm package with `0.8.5` as the latest release.
+- A published npm package with `0.8.6` as the latest release.
 - A post-submission update page explaining why the current npm package and Action tag may be newer than the originally submitted evidence.
 - npm download API evidence showing 356 last-week and last-month downloads on 2026-06-05.
-- A published GitHub Release for v0.8.5 with maintainer plan output, CI usage guidance, and release notes.
+- A published GitHub Release for v0.8.6 with maintainer plan output, CI usage guidance, and release notes.
 - A reusable GitHub Action with `score`, `grade`, `failed`, and `report-path` outputs.
 - A repository inventory mode for organization-level maintainer-readiness triage, available in both CLI and GitHub Action form.
-- A clean npm smoke test of `oss-signal@0.8.5` returning version `0.8.5`.
+- A clean npm smoke test of `oss-signal@0.8.6` returning version `0.8.6`.
 - SARIF output for GitHub Code Scanning integration.
-- A v0.8.5 GitHub Action tag with step summary, SARIF support, inventory support, Issue-ready output, and maintainer plan output.
+- A v0.8.6 GitHub Action tag with step summary, SARIF support, inventory support, Issue-ready output, and maintainer plan output.
 - A workflow output mode that renders a no-fail GitHub Actions trial workflow for external maintainers.
-- A public dogfood workflow that runs `SalmonPlays/oss-signal@v0.8.5` against the repository, uploads the Markdown report artifact, and uploads SARIF to GitHub Code Scanning on non-PR runs.
-- A public dogfood inventory workflow that runs `SalmonPlays/oss-signal@v0.8.5` against a repository target list and uploads an inventory artifact.
-- A separate public workflow demo that runs `SalmonPlays/oss-signal@v0.8.5` from another repository and uploads Markdown, SARIF, Issue-ready, and no-fail workflow artifacts.
+- A public dogfood workflow that runs `SalmonPlays/oss-signal@v0.8.6` against the repository, uploads the Markdown report artifact, and uploads SARIF to GitHub Code Scanning on non-PR runs.
+- A public dogfood inventory workflow that runs `SalmonPlays/oss-signal@v0.8.6` against a repository target list and uploads an inventory artifact.
+- A separate public workflow demo that runs `SalmonPlays/oss-signal@v0.8.6` from another repository and uploads Markdown, SARIF, Issue-ready, and no-fail workflow artifacts.
 - A no-fail maintainer trial workflow that external maintainers can copy before enabling CI gates.
 - A trial feedback path for neutral or negative maintainer responses, so third-party feedback does not have to be overstated as adoption.
 - A maintainer playbook that documents audit, triage, issue, PR, CI, and SARIF workflows.
 - A release process and tag-triggered release workflow that verify package contents and publish to npm through Trusted Publishing.
 - CI, Repository health, CodeQL, and Release workflows passing publicly.
 - A local self-audit score of 100/100.
-- A clean-directory smoke test of `npm exec --yes --package=oss-signal@0.8.5 -- oss-signal --version`, returning `0.8.5`.
+- A clean-directory smoke test of `npm exec --yes --package=oss-signal@0.8.6 -- oss-signal --version`, returning `0.8.6`.
 - Public reports, issues, and PRs created from real repository audits, including six posted field-audit issues and five follow-up PRs.
 - One accepted external documentation PR, with a public maintainer merge comment, recorded in [evidence-ledger.md](evidence-ledger.md).
 
 ## Separate Workflow Demo
 
-The repository https://github.com/SalmonPlays/oss-signal-adoption-demo runs the public `SalmonPlays/oss-signal@v0.8.5` Action tag from a separate workflow. The successful run at https://github.com/SalmonPlays/oss-signal-adoption-demo/actions/runs/27025632373 uploaded an `oss-signal-adoption-demo-report` artifact containing Markdown, SARIF, Issue-ready, and no-fail workflow output.
+The repository https://github.com/SalmonPlays/oss-signal-adoption-demo runs the public `SalmonPlays/oss-signal@v0.8.4` Action tag from a separate workflow. The successful run at https://github.com/SalmonPlays/oss-signal-adoption-demo/actions/runs/27025632373 uploaded an `oss-signal-adoption-demo-report` artifact containing Markdown, SARIF, Issue-ready, and no-fail workflow output.
 
 This is intentionally described as a separate public workflow demo rather than third-party adoption because the repository is also owned by `SalmonPlays`. It still proves that the published Action tag is consumable outside the main repository.
 
@@ -113,5 +113,5 @@ Prepared official form answers are in [codex-for-oss-form-answers.md](codex-for-
 ## Next Evidence To Collect
 
 - More merged external PRs or maintainer replies on field-audit PRs.
-- A public workflow run in an independent maintainer-owned repository using `SalmonPlays/oss-signal@v0.8.5`, ideally with SARIF or inventory upload enabled.
+- A public workflow run in an independent maintainer-owned repository using `SalmonPlays/oss-signal@v0.8.6`, ideally with SARIF or inventory upload enabled.
 - npm download data once the registry starts reporting weekly/monthly counts.

package/docs/codex-for-oss-form-answers.md

@@ -50,7 +50,7 @@ Primary maintainer
 ## Why This Repository Qualifies
 
 ```text
-oss-signal is a public OSS maintainer tool for reducing triage and review load. It ships as npm package oss-signal@0.8.5 and GitHub Action SalmonPlays/oss-signal@v0.8.5, supports Markdown/JSON/SARIF/Issue/Plan/Inventory/Workflow output, passes CI/CodeQL/Release, has a 100/100 self-audit, no-fail maintainer trial and feedback paths, six public field-audit issues, five public field-audit PRs, and one merged external Codex Action documentation PR.
+oss-signal is a public OSS maintainer tool for reducing triage and review load. It ships as npm package oss-signal@0.8.6 and GitHub Action SalmonPlays/oss-signal@v0.8.6, supports Markdown/JSON/SARIF/Issue/Plan/Inventory/Workflow output, passes CI/CodeQL/Release, has a 100/100 self-audit, no-fail maintainer trial and feedback paths, six public field-audit issues, five public field-audit PRs, and one merged external Codex Action documentation PR.
 ```
 
 ## Interest
@@ -81,13 +81,13 @@ Use Codex/API credits to run repeatable public repository audits, draft focused
 ## Anything Else
 
 ```text
-The project is early, so I am not overstating adoption. Current evidence includes npm 0.8.5 latest, 356 npm downloads reported by the registry API on 2026-06-05, a published v0.8.5 release, a reusable GitHub Action with inventory and workflow output, no-fail maintainer trial and feedback paths, a clean npm version smoke test, public CI/Repository health/CodeQL/Release, six field-audit issues, five field-audit PRs, and a separate public workflow demo with artifacts.
+The project is early, so I am not overstating adoption. Current evidence includes npm 0.8.6 latest, 356 npm downloads reported by the registry API on 2026-06-05, a published v0.8.6 release, a reusable GitHub Action with inventory and workflow output, no-fail maintainer trial and feedback paths, a clean npm version smoke test, public CI/Repository health/CodeQL/Release, six field-audit issues, five field-audit PRs, and a separate public workflow demo with artifacts.
 ```
 
 ## Evidence Links
 
 - npm package: https://www.npmjs.com/package/oss-signal
-- GitHub Release v0.8.5: https://github.com/SalmonPlays/oss-signal/releases/tag/v0.8.5
+- GitHub Release v0.8.6: https://github.com/SalmonPlays/oss-signal/releases/tag/v0.8.6
 - Main repository health workflow: https://github.com/SalmonPlays/oss-signal/actions/workflows/repository-health.yml
 - Separate workflow demo repository: https://github.com/SalmonPlays/oss-signal-adoption-demo
 - Separate successful workflow run: https://github.com/SalmonPlays/oss-signal-adoption-demo/actions/runs/27025632373

package/docs/evidence-ledger.md

@@ -8,15 +8,15 @@ This ledger keeps the strongest public `oss-signal` evidence in one reviewer-fri
 
 | Signal | Evidence | Status | Reviewer note |
 | --- | --- | --- | --- |
-| Installable CLI | https://www.npmjs.com/package/oss-signal | `0.8.5` is `latest` | Reviewers can run `npm exec --yes --package=oss-signal@0.8.5 -- oss-signal --version`. |
+| Installable CLI | https://www.npmjs.com/package/oss-signal | `0.8.6` is `latest` | Reviewers can run `npm exec --yes --package=oss-signal@0.8.6 -- oss-signal --version`. |
 | npm download API | 356 downloads for last-week and last-month windows | Checked 2026-06-05T09:57:04Z | Supporting distribution signal only; not claimed as broad adoption. |
-| GitHub Action release | https://github.com/SalmonPlays/oss-signal/tree/v0.8.5 | Published tag | Public Action tag used by repository workflows; the separate demo is refreshed after release publication. |
+| GitHub Action release | https://github.com/SalmonPlays/oss-signal/tree/v0.8.6 | Published tag | Public Action tag used by repository workflows; the separate demo is refreshed after release publication. |
 | GitHub Marketplace | https://github.com/marketplace/actions/oss-signal | Published listing | Free Action listing under Code quality. |
 | Maintainer trial path | [maintainer-trial.md](maintainer-trial.md) | Published | External maintainers can try the Action without failing CI, then share a workflow run or adoption report. |
 | Maintainer feedback path | [maintainer-feedback.md](maintainer-feedback.md) | Published | External maintainers can leave useful public feedback even when the tool is not adopted. |
-| Main repository dogfood | https://github.com/SalmonPlays/oss-signal/actions/workflows/repository-health.yml | Passing | Runs `SalmonPlays/oss-signal@v0.8.5` against this repository. |
+| Main repository dogfood | https://github.com/SalmonPlays/oss-signal/actions/workflows/repository-health.yml | Passing | Runs `SalmonPlays/oss-signal@v0.8.6` against this repository. |
 | Inventory dogfood | https://github.com/SalmonPlays/oss-signal/actions/workflows/repository-inventory.yml | Passing | Exercises multi-repository inventory mode. |
-| Separate public workflow demo | https://github.com/SalmonPlays/oss-signal-adoption-demo/actions/runs/27025632373 | Passing | Separate public repository runs `SalmonPlays/oss-signal@v0.8.5` and uploads Markdown, SARIF, issue-ready, and no-fail workflow artifacts. |
+| Separate public workflow demo | https://github.com/SalmonPlays/oss-signal-adoption-demo/actions/runs/27025632373 | Passing | Separate public repository runs `SalmonPlays/oss-signal@v0.8.4` and uploads Markdown, SARIF, issue-ready, and no-fail workflow artifacts. |
 | Accepted external contribution | https://github.com/icoretech/codex-action/pull/24 | Merged 2026-06-04 | External maintainer merged the focused Codex Action documentation safety fix and left a merge comment. |
 | Maintainer merge comment | https://github.com/icoretech/codex-action/pull/24#issuecomment-4623923361 | Public maintainer response | Stronger than an open PR because the external maintainer accepted the change. |
 | Field-audit issues | [adoption evidence](adoption-evidence.md#public-field-audits-and-prs) | Six posted issues | These show the audit-to-maintainer-follow-up workflow, but are not counted as adoption unless maintainers reply, act, or endorse them. |

package/docs/examples/github-action-workflow.yml

@@ -13,7 +13,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v5
-      - uses: SalmonPlays/oss-signal@v0.8.5
+      - uses: SalmonPlays/oss-signal@v0.8.6
         id: oss-signal
         with:
           fail-under: "80"

package/docs/examples/github-code-scanning-workflow.yml

@@ -18,13 +18,13 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v5
-      - uses: SalmonPlays/oss-signal@v0.8.5
+      - uses: SalmonPlays/oss-signal@v0.8.6
         id: oss-signal
         with:
           fail-under: "80"
           output: oss-signal-report.md
           summary: "true"
-      - uses: SalmonPlays/oss-signal@v0.8.5
+      - uses: SalmonPlays/oss-signal@v0.8.6
         with:
           format: sarif
           output: oss-signal.sarif

package/docs/examples/github-inventory-workflow.yml

@@ -16,7 +16,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v5
-      - uses: SalmonPlays/oss-signal@v0.8.5
+      - uses: SalmonPlays/oss-signal@v0.8.6
         id: oss-signal
         env:
           GITHUB_TOKEN: ${{ github.token }}

package/docs/examples/github-url-report.json

@@ -1,6 +1,6 @@
 {
   "tool": "oss-signal",
-  "version": "0.8.5",
+  "version": "0.8.6",
   "root": "https://github.com/SalmonPlays/oss-signal",
   "source": {
     "type": "github",
@@ -14,7 +14,7 @@
     "openIssues": 5,
     "healthPercentage": 100
   },
-  "generatedAt": "2026-06-07T03:52:59.481Z",
+  "generatedAt": "2026-06-07T03:57:48.351Z",
   "score": 100,
   "grade": "A",
   "summary": {

package/docs/examples/github-url-report.md

@@ -2,7 +2,7 @@
 
 Repository: `https://github.com/SalmonPlays/oss-signal`
 Source: GitHub (SalmonPlays/oss-signal@main)
-Generated: 2026-06-07T03:52:59.481Z
+Generated: 2026-06-07T03:57:48.351Z
 
 Score: **100/100** (A)
 

package/docs/examples/maintainer-trial-workflow.yml

@@ -15,7 +15,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v5
-      - uses: SalmonPlays/oss-signal@v0.8.5
+      - uses: SalmonPlays/oss-signal@v0.8.6
         id: oss-signal
         with:
           output: oss-signal-report.md

package/docs/examples/self-audit.sarif

@@ -6,7 +6,7 @@
       "tool": {
         "driver": {
           "name": "oss-signal",
-          "semanticVersion": "0.8.5",
+          "semanticVersion": "0.8.6",
           "informationUri": "https://github.com/SalmonPlays/oss-signal",
           "rules": [
             {
@@ -400,7 +400,7 @@
         "score": 100,
         "grade": "A",
         "source": "local",
-        "generatedAt": "2026-06-07T03:52:57.921Z"
+        "generatedAt": "2026-06-07T03:57:46.629Z"
       }
     }
   ]

package/docs/index.md

@@ -13,7 +13,7 @@ npx oss-signal SalmonPlays/oss-signal
 Run as a GitHub Action:
 
 ```yaml
-- uses: SalmonPlays/oss-signal@v0.8.5
+- uses: SalmonPlays/oss-signal@v0.8.6
   id: oss-signal
   with:
     path: "."
@@ -56,6 +56,6 @@ Run as a GitHub Action:
 
 - Repository: https://github.com/SalmonPlays/oss-signal
 - npm package: https://www.npmjs.com/package/oss-signal
-- GitHub Action tag: https://github.com/SalmonPlays/oss-signal/tree/v0.8.5
+- GitHub Action tag: https://github.com/SalmonPlays/oss-signal/tree/v0.8.6
 - GitHub Marketplace listing: https://github.com/marketplace/actions/oss-signal
 - Maintainer workflow discussion: https://github.com/SalmonPlays/oss-signal/discussions/5

package/docs/maintainer-playbook.md

@@ -83,7 +83,7 @@ See [plan-output.md](plan-output.md) and [examples/github-plan.md](examples/gith
 Add the GitHub Action to keep the signal visible:
 
 ```yaml
-- uses: SalmonPlays/oss-signal@v0.8.5
+- uses: SalmonPlays/oss-signal@v0.8.6
   id: oss-signal
   with:
     fail-under: "80"
@@ -96,7 +96,7 @@ The Action writes `score`, `grade`, `failed`, and `report-path` outputs, and wri
 For a repository inventory, commit a newline-delimited target list and pass it through the Action:
 
 ```yaml
-- uses: SalmonPlays/oss-signal@v0.8.5
+- uses: SalmonPlays/oss-signal@v0.8.6
   env:
     GITHUB_TOKEN: ${{ github.token }}
   with:
@@ -116,7 +116,7 @@ permissions:
 
 steps:
   - uses: actions/checkout@v5
-  - uses: SalmonPlays/oss-signal@v0.8.5
+  - uses: SalmonPlays/oss-signal@v0.8.6
     with:
       format: sarif
       output: oss-signal.sarif
@@ -134,7 +134,7 @@ See [docs/sarif-code-scanning.md](sarif-code-scanning.md) for the permissions, e
 
 Useful evidence for maintainers and reviewers:
 
-- A public workflow run that uses `SalmonPlays/oss-signal@v0.8.5`.
+- A public workflow run that uses `SalmonPlays/oss-signal@v0.8.6`.
 - A generated Markdown report attached as an artifact.
 - A SARIF upload in Code Scanning.
 - A small issue or PR that follows from an audit finding.

package/docs/maintainer-trial.md

@@ -26,7 +26,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v5
-      - uses: SalmonPlays/oss-signal@v0.8.5
+      - uses: SalmonPlays/oss-signal@v0.8.6
         id: oss-signal
         with:
           output: oss-signal-report.md
@@ -54,32 +54,32 @@ The same workflow is available as [examples/maintainer-trial-workflow.yml](examp
 Run against a public repository without cloning:
 
 ```bash
-npm exec --yes --package=oss-signal@0.8.5 -- oss-signal owner/repo --format markdown --output oss-signal-report.md
+npm exec --yes --package=oss-signal@0.8.6 -- oss-signal owner/repo --format markdown --output oss-signal-report.md
 ```
 
 Generate an issue-ready draft for human review:
 
 ```bash
-npm exec --yes --package=oss-signal@0.8.5 -- oss-signal owner/repo --format issue --output maintainer-follow-up.md
+npm exec --yes --package=oss-signal@0.8.6 -- oss-signal owner/repo --format issue --output maintainer-follow-up.md
 ```
 
 Generate a PR-sized plan before opening a pull request:
 
 ```bash
-npm exec --yes --package=oss-signal@0.8.5 -- oss-signal owner/repo --format plan --output maintainer-plan.md
+npm exec --yes --package=oss-signal@0.8.6 -- oss-signal owner/repo --format plan --output maintainer-plan.md
 ```
 
 Generate the no-fail trial workflow:
 
 ```bash
-npm exec --yes --package=oss-signal@0.8.5 -- oss-signal owner/repo --format workflow --output .github/workflows/oss-signal-trial.yml
+npm exec --yes --package=oss-signal@0.8.6 -- oss-signal owner/repo --format workflow --output .github/workflows/oss-signal-trial.yml
 ```
 
 ## Evidence To Share
 
 Useful public evidence is concrete:
 
-- a workflow run that uses `SalmonPlays/oss-signal@v0.8.5`
+- a workflow run that uses `SalmonPlays/oss-signal@v0.8.6`
 - a linked `oss-signal-report.md` artifact
 - a maintainer reply saying the report was useful, not useful, or intentionally out of scope
 - a merged issue-template, security-policy, CI, or documentation PR informed by the report

package/docs/marketplace.md

@@ -7,13 +7,13 @@ This checklist records the Marketplace publishing state for `oss-signal`.
 - Repository is public.
 - Action metadata exists at the repository root: [../action.yml](../action.yml).
 - The Action metadata uses a unique name: `oss-signal`.
-- The repository has a released Action tag: `v0.8.5`.
+- The repository has a released Action tag: `v0.8.6`.
 - The README contains install, CLI, GitHub Action, SARIF, inventory, workflow-trial, and maintainer workflow examples.
 - The repository has public CI, CodeQL, OpenSSF Scorecard, repository health, repository inventory, and release workflows.
 - The repository includes an MIT [LICENSE](../LICENSE) that should be used as the Action EULA for Marketplace users.
 - GitHub Marketplace Developer Agreement has been reviewed by the repository owner.
 - The GitHub Marketplace listing is published: https://github.com/marketplace/actions/oss-signal
-- The current Action tag is `v0.8.5`: https://github.com/SalmonPlays/oss-signal/tree/v0.8.5
+- The current Action tag is `v0.8.6`: https://github.com/SalmonPlays/oss-signal/tree/v0.8.6
 
 ## Marketplace Categories
 
@@ -26,7 +26,7 @@ Secondary category: `Code quality`
 Title:
 
 ```text
-oss-signal v0.8.5
+oss-signal v0.8.6
 ```
 
 Description:

package/docs/post-submission-update.md

@@ -28,12 +28,13 @@ The older submission evidence remains valid. The current `latest` npm version si
 | `v0.8.3` | npm package, GitHub Release, Action tag | Added workflow-level Node.js 24 opt-in ahead of GitHub Actions' Node.js 20 removal. |
 | `v0.8.4` | npm package, GitHub Release, Action tag | Scoped the Scorecard workflow opt-in so Scorecard result publication passes workflow verification. |
 | `v0.8.5` | npm package, GitHub Release, Action tag | Added evidence and next-step details to Markdown reports plus a maintainer quickstart. |
+| `v0.8.6` | npm package, GitHub Release, Action tag | Corrected reviewer evidence text for the separate public demo. |
 
 ## Current Evidence
 
-- npm package: https://www.npmjs.com/package/oss-signal (`0.8.5` latest after release)
-- GitHub Release: https://github.com/SalmonPlays/oss-signal/releases/tag/v0.8.5
-- GitHub Action tag: https://github.com/SalmonPlays/oss-signal/tree/v0.8.5
+- npm package: https://www.npmjs.com/package/oss-signal (`0.8.6` latest after release)
+- GitHub Release: https://github.com/SalmonPlays/oss-signal/releases/tag/v0.8.6
+- GitHub Action tag: https://github.com/SalmonPlays/oss-signal/tree/v0.8.6
 - Release workflow: https://github.com/SalmonPlays/oss-signal/actions/workflows/release.yml
 - Repository health workflow: https://github.com/SalmonPlays/oss-signal/actions/workflows/repository-health.yml
 - GitHub repository profile: description, npm homepage, eight maintainer-focused topics, social preview image, and profile pin are live.
@@ -48,7 +49,7 @@ The older submission evidence remains valid. The current `latest` npm version si
 
 ## Clean Verification
 
-The public registry should return `0.8.5` for both package version and `latest` dist-tag after the first-run UX release.
+The public registry should return `0.8.6` for both package version and `latest` dist-tag after the reviewer-evidence correction release.
 
 ```bash
 npm view oss-signal version dist-tags --json
@@ -58,17 +59,17 @@ Expected result:
 
 ```json
 {
-  "version": "0.8.5",
+  "version": "0.8.6",
   "dist-tags": {
-    "latest": "0.8.5"
+    "latest": "0.8.6"
   }
 }
 ```
 
-A clean npm execution should return version `0.8.5`.
+A clean npm execution should return version `0.8.6`.
 
 ```bash
-npm exec --yes --package=oss-signal@0.8.5 -- oss-signal --version
+npm exec --yes --package=oss-signal@0.8.6 -- oss-signal --version
 ```
 
 ## Review Impact
@@ -76,7 +77,7 @@ npm exec --yes --package=oss-signal@0.8.5 -- oss-signal --version
 This version difference should be read as post-submission maintenance progress, not as a mismatch. It strengthens the evidence in three ways:
 
 - The package now has a successful npm Trusted Publishing release from GitHub Actions.
-- The GitHub Action tag, npm package, release notes, and documentation all point to `0.8.5`.
+- The GitHub Action tag, npm package, release notes, and documentation all point to `0.8.6`.
 - The repository has public CI, Repository health, Repository inventory, CodeQL, OpenSSF Scorecard, Release workflow evidence, social preview branding, profile pinning, Discussions, CODEOWNERS, and issue routing.
 - The current release includes `--format plan`, which turns audit findings into PR-sized outreach plans before external posting.
 - The current release includes `--format workflow`, which renders a no-fail GitHub Actions trial workflow for external maintainers.

package/docs/quickstart.md

@@ -71,7 +71,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v5
-      - uses: SalmonPlays/oss-signal@v0.8.5
+      - uses: SalmonPlays/oss-signal@v0.8.6
         with:
           output: oss-signal-report.md
           summary: "true"

package/docs/release-notes/v0.8.6.md

@@ -0,0 +1,11 @@
+`oss-signal` v0.8.6 corrects the reviewer evidence text after the first-run UX release.
+
+## Changes
+
+- Keeps the separate public demo accurately documented as a `v0.8.4` workflow run until that repository can be refreshed.
+- Keeps the main package, Action tag, examples, and dogfood workflows aligned on `v0.8.6`.
+
+## Verification
+
+- `npm run check`
+- `npm publish --dry-run`

package/docs/reviewer-evidence.md

@@ -6,7 +6,7 @@ This page gives reviewers a short path to verify that `oss-signal` is a real OSS
 
 ## Application Version Note
 
-The Codex for Open Source application was submitted on 2026-06-03. The npm package and Action tag continued to move after submission as normal OSS maintenance. If any submitted field references older evidence, treat `0.8.5` as the current maintained release and see [post-submission-update.md](post-submission-update.md).
+The Codex for Open Source application was submitted on 2026-06-03. The npm package and Action tag continued to move after submission as normal OSS maintenance. If any submitted field references older evidence, treat `0.8.6` as the current maintained release and see [post-submission-update.md](post-submission-update.md).
 
 ## Five-Minute Verification
 
@@ -16,20 +16,20 @@ The Codex for Open Source application was submitted on 2026-06-03. The npm packa
 npm view oss-signal version dist-tags --json
 ```
 
-Expected result: `version` is `0.8.5`, and `dist-tags.latest` is `0.8.5`.
+Expected result: `version` is `0.8.6`, and `dist-tags.latest` is `0.8.6`.
 
 2. Run the published package from a clean install:
 
 ```bash
-npm exec --yes --package=oss-signal@0.8.5 -- oss-signal --version
+npm exec --yes --package=oss-signal@0.8.6 -- oss-signal --version
 ```
 
-Expected result: `0.8.5`.
+Expected result: `0.8.6`.
 
 To audit the public GitHub repository from a local shell, set `GITHUB_TOKEN` if unauthenticated API rate limits are exhausted:
 
 ```bash
-GITHUB_TOKEN=<token> npm exec --yes --package=oss-signal@0.8.5 -- oss-signal SalmonPlays/oss-signal --format json
+GITHUB_TOKEN=<token> npm exec --yes --package=oss-signal@0.8.6 -- oss-signal SalmonPlays/oss-signal --format json
 ```
 
 Expected result with API access: score `100`, grade `A`, source `github`.
@@ -72,8 +72,8 @@ Expected result: a Markdown table with one row per repository, average score, sc
 
 5. Inspect the public Action tag:
 
-- Action tag: https://github.com/SalmonPlays/oss-signal/tree/v0.8.5
-- Release: https://github.com/SalmonPlays/oss-signal/releases/tag/v0.8.5
+- Action tag: https://github.com/SalmonPlays/oss-signal/tree/v0.8.6
+- Release: https://github.com/SalmonPlays/oss-signal/releases/tag/v0.8.6
 - Action metadata: [../action.yml](../action.yml)
 
 6. Inspect field-audit evidence:

package/docs/sarif-code-scanning.md

@@ -26,7 +26,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v5
-      - uses: SalmonPlays/oss-signal@v0.8.5
+      - uses: SalmonPlays/oss-signal@v0.8.6
         with:
           format: sarif
           output: oss-signal.sarif

package/docs/security-model.md

@@ -46,7 +46,7 @@ SARIF output reports maintainer-readiness findings at warning level. These findi
 ## Supply Chain
 
 - The npm package is published publicly as `oss-signal`.
-- The GitHub Action is pinned by release tag, for example `SalmonPlays/oss-signal@v0.8.5`.
+- The GitHub Action is pinned by release tag, for example `SalmonPlays/oss-signal@v0.8.6`.
 - The release workflow checks the package version against the release tag before publishing.
 - The repository runs CI, CodeQL, OpenSSF Scorecard, repository health, and repository inventory workflows on `main`.
 

package/docs/self-audit.md

@@ -2,7 +2,7 @@
 
 Repository: `/Users/amon/Documents/Codex/2026-06-01/openai-s/outputs/oss-signal`
 Source: local
-Generated: 2026-06-07T03:52:57.877Z
+Generated: 2026-06-07T03:57:46.617Z
 
 Score: **100/100** (A)
 

package/docs/social-launch.md

@@ -85,7 +85,7 @@ https://github.com/SalmonPlays/oss-signal
 ## GitHub Discussion Announcement
 
 ```markdown
-`oss-signal` v0.8.5 is live on npm and GitHub Marketplace.
+`oss-signal` v0.8.6 is live on npm and GitHub Marketplace.
 
 The tool is built for OSS maintainers and contributors who want a small, repeatable way to check maintainer-readiness signals before opening cleanup issues or PRs.
 

package/docs/trust-center.md

@@ -11,7 +11,7 @@ This page collects the strongest public signals for reviewers, maintainers, and
 What it does have is a complete, public maintainer workflow:
 
 - Public npm package: https://www.npmjs.com/package/oss-signal
-- Public GitHub Action tag: https://github.com/SalmonPlays/oss-signal/tree/v0.8.5
+- Public GitHub Action tag: https://github.com/SalmonPlays/oss-signal/tree/v0.8.6
 - Public GitHub Marketplace listing: https://github.com/marketplace/actions/oss-signal
 - Public GitHub Pages landing page: https://salmonplays.github.io/oss-signal/
 - Public no-fail maintainer trial workflow: [maintainer-trial.md](maintainer-trial.md)
@@ -27,7 +27,7 @@ What it does have is a complete, public maintainer workflow:
 
 | Signal | Public evidence | Why it matters |
 | --- | --- | --- |
-| Installable CLI | `npm exec --yes --package=oss-signal@0.8.5 -- oss-signal --version` | Reviewers can run the package without cloning this repository. |
+| Installable CLI | `npm exec --yes --package=oss-signal@0.8.6 -- oss-signal --version` | Reviewers can run the package without cloning this repository. |
 | Marketplace Action | https://github.com/marketplace/actions/oss-signal | Users can discover and copy the Action through GitHub Marketplace. |
 | Maintainer trial | [maintainer-trial](maintainer-trial.md) | External maintainers can try the Action without failing CI first. |
 | Maintainer feedback | [maintainer-feedback](maintainer-feedback.md) | Neutral or negative maintainer responses can still improve rules and count as real third-party feedback. |
@@ -48,7 +48,7 @@ What it does have is a complete, public maintainer workflow:
 The GitHub Marketplace listing is a discovery page for the Action. It lets users find `oss-signal`, inspect the Action metadata and README, and copy a workflow snippet using:
 
 ```yaml
-- uses: SalmonPlays/oss-signal@v0.8.5
+- uses: SalmonPlays/oss-signal@v0.8.6
 ```
 
 The listing is not a paid product. It is a free Action listing. Running GitHub Actions has separate GitHub Actions billing rules, but standard GitHub-hosted runners are free for public repositories.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "oss-signal",
-  "version": "0.8.5",
+  "version": "0.8.6",
   "description": "Maintainer-readiness CLI and GitHub Action for OSS triage, CI evidence, inventory reports, SARIF, issue-ready cleanup, and workflow trials.",
   "type": "module",
   "bin": {

package/src/index.js

@@ -2,7 +2,7 @@ import { promises as fs } from "node:fs";
 import https from "node:https";
 import path from "node:path";
 
-export const VERSION = "0.8.5";
+export const VERSION = "0.8.6";
 
 const SARIF_RULE_LOCATIONS = {
   readme: "README.md",
@@ -404,7 +404,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v5
-      - uses: SalmonPlays/oss-signal@v0.8.5
+      - uses: SalmonPlays/oss-signal@v0.8.6
         id: oss-signal
         with:
           output: oss-signal-report.md