oss-signal 0.8.6 → 0.9.0

package/CHANGELOG.md

@@ -2,6 +2,12 @@
 
 ## Unreleased
 
+## 0.9.0
+
+- Added local config support with `.oss-signal.json`, `.oss-signalrc.json`, `oss-signal.config.json`, and explicit `--config`.
+- Added not-applicable rule handling so maintainers can document exceptions without inflating failed recommendations.
+- Added GitHub Action `config` input, configuration docs, and a config example fixture.
+
 ## 0.8.6
 
 - Corrected reviewer evidence text so the separate demo remains accurately documented as `v0.8.4` while the main package advances.

package/README.md

@@ -55,8 +55,8 @@ For the full first-run path, see [docs/quickstart.md](docs/quickstart.md).
 Public evidence for the maintainer workflow is collected in [docs/index.md](docs/index.md), [docs/quickstart.md](docs/quickstart.md), [docs/evidence-ledger.md](docs/evidence-ledger.md), [docs/trust-center.md](docs/trust-center.md), [docs/reviewer-evidence.md](docs/reviewer-evidence.md), [docs/adoption-evidence.md](docs/adoption-evidence.md), [docs/adoption-kit.md](docs/adoption-kit.md), [docs/maintainer-trial.md](docs/maintainer-trial.md), [docs/maintainer-feedback.md](docs/maintainer-feedback.md), [docs/social-launch.md](docs/social-launch.md), [docs/architecture.md](docs/architecture.md), [docs/security-model.md](docs/security-model.md), [docs/json-output.md](docs/json-output.md), [docs/plan-output.md](docs/plan-output.md), [docs/sarif-code-scanning.md](docs/sarif-code-scanning.md), [docs/roadmap.md](docs/roadmap.md), [docs/post-submission-update.md](docs/post-submission-update.md), and [docs/brand.md](docs/brand.md).
 
 - Landing page: https://salmonplays.github.io/oss-signal/
-- Published package: [`oss-signal@0.8.6`](https://www.npmjs.com/package/oss-signal), with `latest` pointing at `0.8.6`.
-- Published GitHub Action: [`SalmonPlays/oss-signal@v0.8.6`](https://github.com/SalmonPlays/oss-signal/tree/v0.8.6).
+- Published package: [`oss-signal@0.9.0`](https://www.npmjs.com/package/oss-signal), with `latest` pointing at `0.9.0`.
+- Published GitHub Action: [`SalmonPlays/oss-signal@v0.9.0`](https://github.com/SalmonPlays/oss-signal/tree/v0.9.0).
 - GitHub Marketplace listing: https://github.com/marketplace/actions/oss-signal
 - Trust center: [docs/trust-center.md](docs/trust-center.md)
 - Quickstart: [docs/quickstart.md](docs/quickstart.md)
@@ -68,10 +68,11 @@ Public evidence for the maintainer workflow is collected in [docs/index.md](docs
 - Architecture: [docs/architecture.md](docs/architecture.md)
 - Security model: [docs/security-model.md](docs/security-model.md)
 - JSON output contract: [docs/json-output.md](docs/json-output.md)
+- Configuration: [docs/configuration.md](docs/configuration.md)
 - Maintainer plan output: [docs/plan-output.md](docs/plan-output.md)
 - SARIF Code Scanning walkthrough: [docs/sarif-code-scanning.md](docs/sarif-code-scanning.md)
 - Roadmap: [docs/roadmap.md](docs/roadmap.md)
-- Post-submission version note: the application may reference earlier evidence; `0.8.6` is the current maintained release and is documented in [docs/post-submission-update.md](docs/post-submission-update.md).
+- Post-submission version note: the application may reference earlier evidence; `0.9.0` is the current maintained release and is documented in [docs/post-submission-update.md](docs/post-submission-update.md).
 - Public checks: CI, Repository health, and CodeQL are passing on `main`.
 - Security posture: OpenSSF Scorecard is scheduled, CodeQL is active, secret scanning push protection is enabled, Dependabot alerts/security updates/malware alerts are enabled, and private vulnerability reporting is enabled.
 - Branch posture: `main` has branch protection to prevent force pushes and deletions while keeping direct maintainer maintenance possible.
@@ -82,7 +83,7 @@ Public evidence for the maintainer workflow is collected in [docs/index.md](docs
 - Merged external OSS contribution: [icoretech/codex-action PR #24](https://github.com/icoretech/codex-action/pull/24) is a focused Codex Action documentation safety fix.
 - Contributor intake: [good first issues](https://github.com/SalmonPlays/oss-signal/issues?q=is%3Aissue%20state%3Aopen%20label%3A%22good%20first%20issue%22) are labeled for small outside PRs.
 - Inventory mode: the CLI and Action can audit a newline-delimited list of repositories for organization-level triage.
-- Separate workflow demo: [oss-signal-adoption-demo](https://github.com/SalmonPlays/oss-signal-adoption-demo/actions/runs/27025632373) runs the public `v0.8.4` Action tag and uploads Markdown, SARIF, Issue-ready, and no-fail workflow artifacts. It remains valid demo evidence while the main repository has advanced to `v0.8.6`.
+- Separate workflow demo: [oss-signal-adoption-demo](https://github.com/SalmonPlays/oss-signal-adoption-demo/actions/runs/27025632373) runs the public `v0.8.4` Action tag and uploads Markdown, SARIF, Issue-ready, and no-fail workflow artifacts. It remains valid demo evidence while the main repository has advanced to `v0.9.0`.
 
 ## Why
 
@@ -150,6 +151,14 @@ oss-signal . --format json --fail-under 80
 
 See [docs/json-output.md](docs/json-output.md) for the JSON schema and fixture.
 
+Document intentional exceptions with a local config:
+
+```bash
+oss-signal . --config .oss-signal.json --format markdown
+```
+
+See [docs/configuration.md](docs/configuration.md) for not-applicable rules and scoring behavior.
+
 Audit multiple repositories from one newline-delimited inventory file:
 
 ```bash
@@ -223,7 +232,7 @@ Summary:
 
 See [docs/self-audit.md](docs/self-audit.md) for the full local self-audit report, [docs/examples/github-url-report.md](docs/examples/github-url-report.md) for the GitHub URL audit output, [docs/examples/github-issue-body.md](docs/examples/github-issue-body.md) for issue output, [docs/examples/github-plan.md](docs/examples/github-plan.md) for plan output, [docs/examples/maintainer-trial-workflow.yml](docs/examples/maintainer-trial-workflow.yml) for workflow output, and [docs/examples/self-audit.sarif](docs/examples/self-audit.sarif) for SARIF output.
 
-The [Repository health workflow](.github/workflows/repository-health.yml) runs `SalmonPlays/oss-signal@v0.8.6`, uploads the Markdown report as an artifact, and uploads SARIF to GitHub Code Scanning on non-PR runs. The [Repository inventory workflow](.github/workflows/repository-inventory.yml) runs the inventory mode from CI and uploads a multi-repository report artifact.
+The [Repository health workflow](.github/workflows/repository-health.yml) runs `SalmonPlays/oss-signal@v0.9.0`, uploads the Markdown report as an artifact, and uploads SARIF to GitHub Code Scanning on non-PR runs. The [Repository inventory workflow](.github/workflows/repository-inventory.yml) runs the inventory mode from CI and uploads a multi-repository report artifact.
 
 ## Field Audits
 
@@ -274,7 +283,7 @@ oss-signal . --fail-under 80
 Add `oss-signal` directly to a GitHub Actions workflow:
 
 ```yaml
-- uses: SalmonPlays/oss-signal@v0.8.6
+- uses: SalmonPlays/oss-signal@v0.9.0
   id: oss-signal
   with:
     fail-under: "80"
@@ -290,7 +299,7 @@ The Action writes a concise GitHub Actions step summary by default, so reviewers
 Run an inventory from CI:
 
 ```yaml
-- uses: SalmonPlays/oss-signal@v0.8.6
+- uses: SalmonPlays/oss-signal@v0.9.0
   env:
     GITHUB_TOKEN: ${{ github.token }}
   with:
@@ -302,7 +311,7 @@ Run an inventory from CI:
 Generate an editable Issue body from CI:
 
 ```yaml
-- uses: SalmonPlays/oss-signal@v0.8.6
+- uses: SalmonPlays/oss-signal@v0.9.0
   with:
     format: issue
     output: maintainer-follow-up.md
@@ -327,7 +336,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v5
-      - uses: SalmonPlays/oss-signal@v0.8.6
+      - uses: SalmonPlays/oss-signal@v0.9.0
         id: oss-signal
         with:
           fail-under: "80"
@@ -350,7 +359,7 @@ permissions:
 
 steps:
   - uses: actions/checkout@v5
-  - uses: SalmonPlays/oss-signal@v0.8.6
+  - uses: SalmonPlays/oss-signal@v0.9.0
     with:
       format: sarif
       output: oss-signal.sarif
@@ -360,7 +369,7 @@ steps:
       sarif_file: oss-signal.sarif
 ```
 
-This repository dogfoods the public Action tag in [Repository health](.github/workflows/repository-health.yml), which runs `SalmonPlays/oss-signal@v0.8.6` against the repository, uploads the Markdown report artifact, and publishes SARIF to Code Scanning on non-PR runs.
+This repository dogfoods the public Action tag in [Repository health](.github/workflows/repository-health.yml), which runs `SalmonPlays/oss-signal@v0.9.0` against the repository, uploads the Markdown report artifact, and publishes SARIF to Code Scanning on non-PR runs.
 
 You can also run the CLI directly in CI:
 

package/action.yml

@@ -34,6 +34,9 @@ inputs:
   ref:
     description: Git ref for GitHub URL audits.
     required: false
+  config:
+    description: Path to an oss-signal JSON config file. Local audits auto-detect .oss-signal.json.
+    required: false
 outputs:
   score:
     description: Numeric maintainer-readiness score, or average score in inventory mode.

package/docs/adoption-evidence.md

@@ -8,9 +8,9 @@ Last verified: 2026-06-07T03:51:47Z
 
 - Repository: https://github.com/SalmonPlays/oss-signal
 - GitHub Pages landing page: https://salmonplays.github.io/oss-signal/
-- npm package: https://www.npmjs.com/package/oss-signal (`0.8.6` latest after release)
-- GitHub Release: https://github.com/SalmonPlays/oss-signal/releases/tag/v0.8.6
-- GitHub Action tag: https://github.com/SalmonPlays/oss-signal/tree/v0.8.6
+- npm package: https://www.npmjs.com/package/oss-signal (`0.9.0` latest after release)
+- GitHub Release: https://github.com/SalmonPlays/oss-signal/releases/tag/v0.9.0
+- GitHub Action tag: https://github.com/SalmonPlays/oss-signal/tree/v0.9.0
 - GitHub Marketplace listing: https://github.com/marketplace/actions/oss-signal
 - GitHub Action metadata: [action.yml](../action.yml)
 - Public dogfood workflow: [.github/workflows/repository-health.yml](../.github/workflows/repository-health.yml)
@@ -41,6 +41,7 @@ Last verified: 2026-06-07T03:51:47Z
 - Architecture: [docs/architecture.md](architecture.md)
 - Security model: [docs/security-model.md](security-model.md)
 - JSON output contract: [docs/json-output.md](json-output.md)
+- Configuration: [docs/configuration.md](configuration.md)
 - SARIF Code Scanning walkthrough: [docs/sarif-code-scanning.md](sarif-code-scanning.md)
 - Roadmap: [docs/roadmap.md](roadmap.md)
 - Reviewer evidence quickstart: [docs/reviewer-evidence.md](reviewer-evidence.md)
@@ -69,7 +70,7 @@ The [post-submission update](post-submission-update.md) records why the current
 
 ## Published Package Verification
 
-The npm package is publicly available as `oss-signal@0.8.6` with `latest` pointing at `0.8.6` after the release workflow completes.
+The npm package is publicly available as `oss-signal@0.9.0` with `latest` pointing at `0.9.0` after the release workflow completes.
 
 The npm downloads API returned 356 downloads for both last-week and last-month windows on 2026-06-05. Download counts can lag publication, so this is treated as supporting evidence rather than proof of broad adoption.
 
@@ -77,11 +78,11 @@ Clean-directory package execution returned:
 
 ```json
 {
-  "version": "0.8.6"
+  "version": "0.9.0"
 }
 ```
 
-Local self-audit returned score `100`, grade `A`. Public GitHub URL report generation completed during this verification pass, and repository workflows use the public `v0.8.6` Action tag with `GITHUB_TOKEN`.
+Local self-audit returned score `100`, grade `A`. Public GitHub URL report generation completed during this verification pass, and repository workflows use the public `v0.9.0` Action tag with `GITHUB_TOKEN`.
 
 Current public workflow status:
 
@@ -92,7 +93,7 @@ Current public workflow status:
 - OpenSSF Scorecard: configured on `main` pushes and a weekly schedule, with JSON artifact output and public Scorecard publishing
 - Release: passing
 - GitHub Pages deployment: passing, with the repository homepage set to https://salmonplays.github.io/oss-signal/
-- GitHub Marketplace listing: published, with `v0.8.6` available as the current Action tag after release
+- GitHub Marketplace listing: published, with `v0.9.0` available as the current Action tag after release
 - GitHub issue forms: adoption report, trial feedback, and maintainer audit report forms are available for structured public evidence intake
 - GitHub citation metadata: `CITATION.cff` is present for the repository citation UI
 - Automation contract: JSON schema and fixture are documented for `--format json`
@@ -101,7 +102,7 @@ Current public workflow status:
 - Maintainer workflow Discussion: published
 - Separate public workflow demo: passing
 
-The npm registry previously returned `0.8.4` for both the package version and `latest` dist-tag on 2026-06-05T16:02:53Z. The 2026-06-07 release updates the expected latest version to `0.8.6`. The 2026-06-05 download check returned 356 downloads for the last-week and last-month windows.
+The npm registry previously returned `0.8.4` for both the package version and `latest` dist-tag on 2026-06-05T16:02:53Z. The 2026-06-07 release updates the expected latest version to `0.9.0`. The 2026-06-05 download check returned 356 downloads for the last-week and last-month windows.
 
 ## Separate Public Workflow Evidence
 
@@ -164,10 +165,10 @@ npm run audit:github
 node src/cli.js . --format sarif --output docs/examples/self-audit.sarif
 node src/cli.js --inventory docs/examples/inventory-targets.txt --format markdown --output docs/examples/inventory-report.md
 node src/cli.js platformatic/massimo --format json
-npm exec --yes --package=oss-signal@0.8.6 -- oss-signal --version
+npm exec --yes --package=oss-signal@0.9.0 -- oss-signal --version
 ```
 
-The current repository self-audit score is 100/100, the GitHub community profile health score is 100, and CI verifies the local GitHub Action wrapper. The public `v0.8.6` Action tag is used by the repository health workflow for Markdown and SARIF output after release. The published npm `0.8.6` package should return version `0.8.6` from a clean temporary directory.
+The current repository self-audit score is 100/100, the GitHub community profile health score is 100, and CI verifies the local GitHub Action wrapper. The public `v0.9.0` Action tag is used by the repository health workflow for Markdown and SARIF output after release. The published npm `0.9.0` package should return version `0.9.0` from a clean temporary directory.
 
 Public CI evidence:
 

package/docs/adoption-kit.md

@@ -9,7 +9,7 @@ For a first CLI run, start with [quickstart.md](quickstart.md). For a first CI t
 Run against a public repository without cloning:
 
 ```bash
-npm exec --yes --package=oss-signal@0.8.6 -- oss-signal owner/repo --format markdown --output oss-signal-report.md
+npm exec --yes --package=oss-signal@0.9.0 -- oss-signal owner/repo --format markdown --output oss-signal-report.md
 ```
 
 Run against the current checkout:
@@ -53,7 +53,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v5
-      - uses: SalmonPlays/oss-signal@v0.8.6
+      - uses: SalmonPlays/oss-signal@v0.9.0
         id: oss-signal
         with:
           fail-under: "80"
@@ -77,7 +77,7 @@ env:
 
 steps:
   - uses: actions/checkout@v5
-  - uses: SalmonPlays/oss-signal@v0.8.6
+  - uses: SalmonPlays/oss-signal@v0.9.0
     with:
       format: sarif
       output: oss-signal.sarif
@@ -93,7 +93,7 @@ Full walkthrough: [sarif-code-scanning.md](sarif-code-scanning.md)
 
 Useful adoption evidence is concrete and public:
 
-- A workflow run that uses `SalmonPlays/oss-signal@v0.8.6`.
+- A workflow run that uses `SalmonPlays/oss-signal@v0.9.0`.
 - A Markdown report attached as a workflow artifact.
 - A SARIF upload that appears in Code Scanning.
 - A focused issue or pull request created from an audit finding.

package/docs/assets/code-scanning-results.svg

@@ -6,7 +6,7 @@
   <rect x="0" y="0" width="920" height="58" rx="18" fill="#f6f8fa"/>
   <text x="32" y="37" fill="#24292f" font-family="-apple-system, BlinkMacSystemFont, Segoe UI, sans-serif" font-size="18" font-weight="700">GitHub Code Scanning</text>
   <text x="32" y="98" fill="#24292f" font-family="-apple-system, BlinkMacSystemFont, Segoe UI, sans-serif" font-size="28" font-weight="700">oss-signal maintainer-readiness findings</text>
-  <text x="32" y="132" fill="#57606a" font-family="-apple-system, BlinkMacSystemFont, Segoe UI, sans-serif" font-size="16">SARIF upload from SalmonPlays/oss-signal@v0.8.6</text>
+  <text x="32" y="132" fill="#57606a" font-family="-apple-system, BlinkMacSystemFont, Segoe UI, sans-serif" font-size="16">SARIF upload from SalmonPlays/oss-signal@v0.9.0</text>
   <rect x="32" y="162" width="856" height="72" rx="10" fill="#fffbdd" stroke="#d4a72c"/>
   <circle cx="65" cy="198" r="10" fill="#bf8700"/>
   <text x="88" y="194" fill="#24292f" font-family="-apple-system, BlinkMacSystemFont, Segoe UI, sans-serif" font-size="17" font-weight="700">oss-signal/security</text>

package/docs/assets/oss-signal-banner.svg

@@ -34,7 +34,7 @@
     <rect x="334" y="266" width="144" height="42" rx="21" fill="#dcfce7"/>
     <text x="359" y="293" fill="#166534">100/100 A</text>
     <rect x="494" y="266" width="142" height="42" rx="21" fill="#dbeafe"/>
-    <text x="521" y="293" fill="#1e40af">npm 0.8.6</text>
+    <text x="521" y="293" fill="#1e40af">npm 0.9.0</text>
     <rect x="652" y="266" width="178" height="42" rx="21" fill="#e0f2fe"/>
     <text x="681" y="293" fill="#075985">GitHub Action</text>
     <rect x="846" y="266" width="168" height="42" rx="21" fill="#fef9c3"/>

package/docs/codex-for-oss-application.md

@@ -9,8 +9,8 @@ This document summarizes why `oss-signal` is a fit for OpenAI's Codex for Open S
 - Display name: OSS Maintainer Signal
 - Repository: https://github.com/SalmonPlays/oss-signal
 - npm package: https://www.npmjs.com/package/oss-signal
-- GitHub Release: https://github.com/SalmonPlays/oss-signal/releases/tag/v0.8.6
-- GitHub Action tag: https://github.com/SalmonPlays/oss-signal/tree/v0.8.6
+- GitHub Release: https://github.com/SalmonPlays/oss-signal/releases/tag/v0.9.0
+- GitHub Action tag: https://github.com/SalmonPlays/oss-signal/tree/v0.9.0
 - CI workflow: https://github.com/SalmonPlays/oss-signal/actions/workflows/ci.yml
 - Repository health workflow: https://github.com/SalmonPlays/oss-signal/actions/workflows/repository-health.yml
 - Repository inventory workflow: https://github.com/SalmonPlays/oss-signal/actions/workflows/repository-inventory.yml
@@ -53,26 +53,26 @@ This project is designed around repeatable maintainer workflows where Codex is u
 
 The repository currently has:
 
-- A published npm package with `0.8.6` as the latest release.
+- A published npm package with `0.9.0` as the latest release.
 - A post-submission update page explaining why the current npm package and Action tag may be newer than the originally submitted evidence.
 - npm download API evidence showing 356 last-week and last-month downloads on 2026-06-05.
-- A published GitHub Release for v0.8.6 with maintainer plan output, CI usage guidance, and release notes.
+- A published GitHub Release for v0.9.0 with maintainer plan output, CI usage guidance, and release notes.
 - A reusable GitHub Action with `score`, `grade`, `failed`, and `report-path` outputs.
 - A repository inventory mode for organization-level maintainer-readiness triage, available in both CLI and GitHub Action form.
-- A clean npm smoke test of `oss-signal@0.8.6` returning version `0.8.6`.
+- A clean npm smoke test of `oss-signal@0.9.0` returning version `0.9.0`.
 - SARIF output for GitHub Code Scanning integration.
-- A v0.8.6 GitHub Action tag with step summary, SARIF support, inventory support, Issue-ready output, and maintainer plan output.
+- A v0.9.0 GitHub Action tag with step summary, SARIF support, inventory support, Issue-ready output, and maintainer plan output.
 - A workflow output mode that renders a no-fail GitHub Actions trial workflow for external maintainers.
-- A public dogfood workflow that runs `SalmonPlays/oss-signal@v0.8.6` against the repository, uploads the Markdown report artifact, and uploads SARIF to GitHub Code Scanning on non-PR runs.
-- A public dogfood inventory workflow that runs `SalmonPlays/oss-signal@v0.8.6` against a repository target list and uploads an inventory artifact.
-- A separate public workflow demo that runs `SalmonPlays/oss-signal@v0.8.6` from another repository and uploads Markdown, SARIF, Issue-ready, and no-fail workflow artifacts.
+- A public dogfood workflow that runs `SalmonPlays/oss-signal@v0.9.0` against the repository, uploads the Markdown report artifact, and uploads SARIF to GitHub Code Scanning on non-PR runs.
+- A public dogfood inventory workflow that runs `SalmonPlays/oss-signal@v0.9.0` against a repository target list and uploads an inventory artifact.
+- A separate public workflow demo that runs `SalmonPlays/oss-signal@v0.9.0` from another repository and uploads Markdown, SARIF, Issue-ready, and no-fail workflow artifacts.
 - A no-fail maintainer trial workflow that external maintainers can copy before enabling CI gates.
 - A trial feedback path for neutral or negative maintainer responses, so third-party feedback does not have to be overstated as adoption.
 - A maintainer playbook that documents audit, triage, issue, PR, CI, and SARIF workflows.
 - A release process and tag-triggered release workflow that verify package contents and publish to npm through Trusted Publishing.
 - CI, Repository health, CodeQL, and Release workflows passing publicly.
 - A local self-audit score of 100/100.
-- A clean-directory smoke test of `npm exec --yes --package=oss-signal@0.8.6 -- oss-signal --version`, returning `0.8.6`.
+- A clean-directory smoke test of `npm exec --yes --package=oss-signal@0.9.0 -- oss-signal --version`, returning `0.9.0`.
 - Public reports, issues, and PRs created from real repository audits, including six posted field-audit issues and five follow-up PRs.
 - One accepted external documentation PR, with a public maintainer merge comment, recorded in [evidence-ledger.md](evidence-ledger.md).
 
@@ -113,5 +113,5 @@ Prepared official form answers are in [codex-for-oss-form-answers.md](codex-for-
 ## Next Evidence To Collect
 
 - More merged external PRs or maintainer replies on field-audit PRs.
-- A public workflow run in an independent maintainer-owned repository using `SalmonPlays/oss-signal@v0.8.6`, ideally with SARIF or inventory upload enabled.
+- A public workflow run in an independent maintainer-owned repository using `SalmonPlays/oss-signal@v0.9.0`, ideally with SARIF or inventory upload enabled.
 - npm download data once the registry starts reporting weekly/monthly counts.

package/docs/codex-for-oss-form-answers.md

@@ -50,7 +50,7 @@ Primary maintainer
 ## Why This Repository Qualifies
 
 ```text
-oss-signal is a public OSS maintainer tool for reducing triage and review load. It ships as npm package oss-signal@0.8.6 and GitHub Action SalmonPlays/oss-signal@v0.8.6, supports Markdown/JSON/SARIF/Issue/Plan/Inventory/Workflow output, passes CI/CodeQL/Release, has a 100/100 self-audit, no-fail maintainer trial and feedback paths, six public field-audit issues, five public field-audit PRs, and one merged external Codex Action documentation PR.
+oss-signal is a public OSS maintainer tool for reducing triage and review load. It ships as npm package oss-signal@0.9.0 and GitHub Action SalmonPlays/oss-signal@v0.9.0, supports Markdown/JSON/SARIF/Issue/Plan/Inventory/Workflow output, passes CI/CodeQL/Release, has a 100/100 self-audit, no-fail maintainer trial and feedback paths, six public field-audit issues, five public field-audit PRs, and one merged external Codex Action documentation PR.
 ```
 
 ## Interest
@@ -81,13 +81,13 @@ Use Codex/API credits to run repeatable public repository audits, draft focused
 ## Anything Else
 
 ```text
-The project is early, so I am not overstating adoption. Current evidence includes npm 0.8.6 latest, 356 npm downloads reported by the registry API on 2026-06-05, a published v0.8.6 release, a reusable GitHub Action with inventory and workflow output, no-fail maintainer trial and feedback paths, a clean npm version smoke test, public CI/Repository health/CodeQL/Release, six field-audit issues, five field-audit PRs, and a separate public workflow demo with artifacts.
+The project is early, so I am not overstating adoption. Current evidence includes npm 0.9.0 latest, 356 npm downloads reported by the registry API on 2026-06-05, a published v0.9.0 release, a reusable GitHub Action with inventory and workflow output, no-fail maintainer trial and feedback paths, a clean npm version smoke test, public CI/Repository health/CodeQL/Release, six field-audit issues, five field-audit PRs, and a separate public workflow demo with artifacts.
 ```
 
 ## Evidence Links
 
 - npm package: https://www.npmjs.com/package/oss-signal
-- GitHub Release v0.8.6: https://github.com/SalmonPlays/oss-signal/releases/tag/v0.8.6
+- GitHub Release v0.9.0: https://github.com/SalmonPlays/oss-signal/releases/tag/v0.9.0
 - Main repository health workflow: https://github.com/SalmonPlays/oss-signal/actions/workflows/repository-health.yml
 - Separate workflow demo repository: https://github.com/SalmonPlays/oss-signal-adoption-demo
 - Separate successful workflow run: https://github.com/SalmonPlays/oss-signal-adoption-demo/actions/runs/27025632373

package/docs/configuration.md

@@ -0,0 +1,82 @@
+# Configuration
+
+`oss-signal` can read a small JSON config when a rule is intentionally not applicable to a repository.
+
+This is useful for real maintainer workflows because not every repository should be forced into the same checklist. For example, a docs-only repository may not need tests, or a library may intentionally omit a lockfile.
+
+## Auto-Detected Config Files
+
+Local audits automatically read the first matching file at the repository root:
+
+- `.oss-signal.json`
+- `.oss-signalrc.json`
+- `oss-signal.config.json`
+
+You can also pass a config explicitly:
+
+```bash
+oss-signal . --config .oss-signal.json
+```
+
+The GitHub Action supports the same path:
+
+```yaml
+- uses: SalmonPlays/oss-signal@v0.9.0
+  with:
+    config: .oss-signal.json
+    output: oss-signal-report.md
+```
+
+## Mark A Rule Not Applicable
+
+Use the `notApplicable` object when you want a compact config:
+
+```json
+{
+  "notApplicable": {
+    "lockfile": "Library package intentionally does not commit a lockfile.",
+    "codeql": "Security scanning is handled by a separate organization-level workflow."
+  }
+}
+```
+
+Or use the `rules` object when you want per-rule status:
+
+```json
+{
+  "rules": {
+    "tests": {
+      "status": "not-applicable",
+      "reason": "Documentation-only repository with no executable code."
+    }
+  }
+}
+```
+
+Not-applicable rules are shown as `N/A` in Markdown, excluded from failed recommendations, and removed from the score denominator. The report still records the reason so reviewers can see the maintainer decision.
+
+## Rule IDs
+
+Current rule IDs:
+
+- `readme`
+- `license`
+- `contributing`
+- `security`
+- `code-of-conduct`
+- `changelog`
+- `support`
+- `ci`
+- `tests`
+- `issue-templates`
+- `pull-request-template`
+- `dependabot`
+- `codeql`
+- `package-json`
+- `lockfile`
+
+Unknown rule IDs are reported as config warnings instead of silently changing the score.
+
+## Boundaries
+
+Use config for documented exceptions, not to inflate a score. If a missing signal would materially reduce maintainer safety or contributor clarity, fix the repository instead of marking the rule not applicable.

package/docs/evidence-ledger.md

@@ -8,13 +8,13 @@ This ledger keeps the strongest public `oss-signal` evidence in one reviewer-fri
 
 | Signal | Evidence | Status | Reviewer note |
 | --- | --- | --- | --- |
-| Installable CLI | https://www.npmjs.com/package/oss-signal | `0.8.6` is `latest` | Reviewers can run `npm exec --yes --package=oss-signal@0.8.6 -- oss-signal --version`. |
+| Installable CLI | https://www.npmjs.com/package/oss-signal | `0.9.0` is `latest` | Reviewers can run `npm exec --yes --package=oss-signal@0.9.0 -- oss-signal --version`. |
 | npm download API | 356 downloads for last-week and last-month windows | Checked 2026-06-05T09:57:04Z | Supporting distribution signal only; not claimed as broad adoption. |
-| GitHub Action release | https://github.com/SalmonPlays/oss-signal/tree/v0.8.6 | Published tag | Public Action tag used by repository workflows; the separate demo is refreshed after release publication. |
+| GitHub Action release | https://github.com/SalmonPlays/oss-signal/tree/v0.9.0 | Published tag | Public Action tag used by repository workflows; the separate demo is refreshed after release publication. |
 | GitHub Marketplace | https://github.com/marketplace/actions/oss-signal | Published listing | Free Action listing under Code quality. |
 | Maintainer trial path | [maintainer-trial.md](maintainer-trial.md) | Published | External maintainers can try the Action without failing CI, then share a workflow run or adoption report. |
 | Maintainer feedback path | [maintainer-feedback.md](maintainer-feedback.md) | Published | External maintainers can leave useful public feedback even when the tool is not adopted. |
-| Main repository dogfood | https://github.com/SalmonPlays/oss-signal/actions/workflows/repository-health.yml | Passing | Runs `SalmonPlays/oss-signal@v0.8.6` against this repository. |
+| Main repository dogfood | https://github.com/SalmonPlays/oss-signal/actions/workflows/repository-health.yml | Passing | Runs `SalmonPlays/oss-signal@v0.9.0` against this repository. |
 | Inventory dogfood | https://github.com/SalmonPlays/oss-signal/actions/workflows/repository-inventory.yml | Passing | Exercises multi-repository inventory mode. |
 | Separate public workflow demo | https://github.com/SalmonPlays/oss-signal-adoption-demo/actions/runs/27025632373 | Passing | Separate public repository runs `SalmonPlays/oss-signal@v0.8.4` and uploads Markdown, SARIF, issue-ready, and no-fail workflow artifacts. |
 | Accepted external contribution | https://github.com/icoretech/codex-action/pull/24 | Merged 2026-06-04 | External maintainer merged the focused Codex Action documentation safety fix and left a merge comment. |

package/docs/examples/github-action-workflow.yml

@@ -13,7 +13,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v5
-      - uses: SalmonPlays/oss-signal@v0.8.6
+      - uses: SalmonPlays/oss-signal@v0.9.0
         id: oss-signal
         with:
           fail-under: "80"

package/docs/examples/github-code-scanning-workflow.yml

@@ -18,13 +18,13 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v5
-      - uses: SalmonPlays/oss-signal@v0.8.6
+      - uses: SalmonPlays/oss-signal@v0.9.0
         id: oss-signal
         with:
           fail-under: "80"
           output: oss-signal-report.md
           summary: "true"
-      - uses: SalmonPlays/oss-signal@v0.8.6
+      - uses: SalmonPlays/oss-signal@v0.9.0
         with:
           format: sarif
           output: oss-signal.sarif

package/docs/examples/github-inventory-workflow.yml

@@ -16,7 +16,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v5
-      - uses: SalmonPlays/oss-signal@v0.8.6
+      - uses: SalmonPlays/oss-signal@v0.9.0
         id: oss-signal
         env:
           GITHUB_TOKEN: ${{ github.token }}

package/docs/examples/github-url-report.json

@@ -1,6 +1,6 @@
 {
   "tool": "oss-signal",
-  "version": "0.8.6",
+  "version": "0.9.0",
   "root": "https://github.com/SalmonPlays/oss-signal",
   "source": {
     "type": "github",
@@ -14,13 +14,14 @@
     "openIssues": 5,
     "healthPercentage": 100
   },
-  "generatedAt": "2026-06-07T03:57:48.351Z",
+  "generatedAt": "2026-06-07T04:17:30.910Z",
   "score": 100,
   "grade": "A",
   "summary": {
     "total": 15,
     "passed": 15,
-    "failed": 0
+    "failed": 0,
+    "notApplicable": 0
   },
   "checks": [
     {

package/docs/examples/github-url-report.md

@@ -2,7 +2,7 @@
 
 Repository: `https://github.com/SalmonPlays/oss-signal`
 Source: GitHub (SalmonPlays/oss-signal@main)
-Generated: 2026-06-07T03:57:48.351Z
+Generated: 2026-06-07T04:17:30.910Z
 
 Score: **100/100** (A)
 

package/docs/examples/maintainer-trial-workflow.yml

@@ -15,7 +15,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v5
-      - uses: SalmonPlays/oss-signal@v0.8.6
+      - uses: SalmonPlays/oss-signal@v0.9.0
         id: oss-signal
         with:
           output: oss-signal-report.md

package/docs/examples/oss-signal-config.json

@@ -0,0 +1,6 @@
+{
+  "notApplicable": {
+    "lockfile": "Library package intentionally does not commit a lockfile.",
+    "codeql": "Security scanning is handled by a separate organization-level workflow."
+  }
+}

package/docs/examples/self-audit.sarif

@@ -6,7 +6,7 @@
       "tool": {
         "driver": {
           "name": "oss-signal",
-          "semanticVersion": "0.8.6",
+          "semanticVersion": "0.9.0",
           "informationUri": "https://github.com/SalmonPlays/oss-signal",
           "rules": [
             {
@@ -400,7 +400,7 @@
         "score": 100,
         "grade": "A",
         "source": "local",
-        "generatedAt": "2026-06-07T03:57:46.629Z"
+        "generatedAt": "2026-06-07T04:17:29.319Z"
       }
     }
   ]

package/docs/index.md

@@ -13,7 +13,7 @@ npx oss-signal SalmonPlays/oss-signal
 Run as a GitHub Action:
 
 ```yaml
-- uses: SalmonPlays/oss-signal@v0.8.6
+- uses: SalmonPlays/oss-signal@v0.9.0
   id: oss-signal
   with:
     path: "."
@@ -40,6 +40,7 @@ Run as a GitHub Action:
 - [Maintainer trial](maintainer-trial.md)
 - [Maintainer feedback](maintainer-feedback.md)
 - [Social launch kit](social-launch.md)
+- [Configuration](configuration.md)
 - [Maintainer playbook](maintainer-playbook.md)
 - [Architecture](architecture.md)
 - [Security model](security-model.md)
@@ -56,6 +57,6 @@ Run as a GitHub Action:
 
 - Repository: https://github.com/SalmonPlays/oss-signal
 - npm package: https://www.npmjs.com/package/oss-signal
-- GitHub Action tag: https://github.com/SalmonPlays/oss-signal/tree/v0.8.6
+- GitHub Action tag: https://github.com/SalmonPlays/oss-signal/tree/v0.9.0
 - GitHub Marketplace listing: https://github.com/marketplace/actions/oss-signal
 - Maintainer workflow discussion: https://github.com/SalmonPlays/oss-signal/discussions/5

package/docs/json-output.md

@@ -30,6 +30,7 @@ Important fields:
 | `score` | integer | Maintainer-readiness score from 0 to 100. |
 | `grade` | string | `A`, `B`, `C`, `D`, or `F`. |
 | `summary` | object | Total, passed, and failed check counts. |
+| `config` | object | Present when a config file marks rules not applicable or emits config warnings. |
 | `checks` | array | Full rule results with evidence, rationale, and fix text. |
 | `recommendations` | array | Failed checks sorted by weight. Empty when score is 100. |
 
@@ -53,10 +54,12 @@ Inventory JSON intentionally summarizes each repository instead of embedding eve
 
 The JSON output is designed for automation, but `oss-signal` is still pre-1.0. Treat the current schema as the public contract for `0.6.x`. If a future release removes or renames fields, it should document the change in [CHANGELOG.md](../CHANGELOG.md) and the release notes.
 
-Stable for `0.6.x`:
+Stable for `0.9.x`:
 
 - Top-level `tool`, `version`, `root`, `source`, `generatedAt`, `score`, `grade`, `summary`, `checks`, and `recommendations`.
-- Check fields `id`, `label`, `weight`, `passed`, `evidence`, `why`, and `fix`.
+- Optional top-level `config` when a repository uses an `oss-signal` config file.
+- Summary fields `total`, `passed`, `failed`, and `notApplicable`.
+- Check fields `id`, `label`, `weight`, `passed`, `evidence`, `why`, `fix`, and optional `notApplicable` / `configReason`.
 - Recommendation fields `id`, `label`, `weight`, `why`, and `fix`.
 
 Not stable: