prodlint 0.10.2 → 0.10.4

package/README.md

@@ -13,7 +13,7 @@ npx prodlint
 ```
 
 ```
-  prodlint v0.10.2
+  prodlint v0.10.4
   Scanned 148 files · 2 critical · 5 warnings · 1 info
 
   src/app/api/checkout/route.ts
@@ -145,7 +145,7 @@ npm i -g prodlint     # Global install
 
 prodlint avoids common false positives:
 
-- **AST parsing** — Babel-based analysis for 12 rules (imports, catch blocks, redirects, SSRF, path traversal, JWT, HTML injection, hydration, transactions, env leaks, loops, SQL) with regex fallback
+- **AST parsing** — Babel-based analysis for 13 rules (imports, catch blocks, redirects, redirects in try/catch, SSRF, path traversal, JWT, HTML injection, hydration, transactions, env leaks, loops, SQL) with regex fallback
 - **Monorepo support** — npm/yarn/pnpm workspace dependencies resolved automatically
 - **Framework awareness** — Prisma, Drizzle, Supabase, Knex, and Sequelize whitelists prevent false SQL injection flags
 - **Middleware detection** — Clerk, NextAuth, Supabase middleware detected — auth findings downgraded
@@ -187,14 +187,16 @@ jobs:
           threshold: 50
 ```
 
-Posts a score breakdown as a PR comment and fails the build if below threshold. Each
-release of the action runs its matching prodlint version, so pinning the action (`@v1`,
-a version tag, or a commit SHA) also pins the scanner.
+Posts a score breakdown as a PR comment, and fails the build when the scan finds critical
+issues or the score is below `threshold`. Each release of the action runs its matching
+prodlint version, so pinning the action (`@v1`, a version tag, or a commit SHA) also pins
+the scanner.
 
 | Input | Default | Description |
 |-------|---------|-------------|
 | `path` | `.` | Path to scan |
 | `threshold` | `0` | Minimum score to pass (0-100) |
+| `fail-on-critical` | `true` | Fail when the scan finds critical issues; `false` reports them without failing |
 | `ignore` | | Comma-separated glob patterns to ignore |
 | `comment` | `true` | Post PR comment with results |
 
@@ -236,7 +238,7 @@ Use prodlint inside Cursor, Claude Code, or any MCP-compatible editor:
 
 **Claude Code:**
 ```bash
-claude mcp add prodlint -- npx -y -p prodlint prodlint-mcp
+claude mcp add prodlint -- npx -y prodlint-mcp
 ```
 
 **Cursor / Windsurf:**
@@ -245,17 +247,26 @@ claude mcp add prodlint -- npx -y -p prodlint prodlint-mcp
   "mcpServers": {
     "prodlint": {
       "command": "npx",
-      "args": ["-y", "-p", "prodlint", "prodlint-mcp"]
+      "args": ["-y", "prodlint-mcp"]
     }
   }
 }
 ```
 
-`-p prodlint` runs the MCP server straight from the `prodlint` package, so you always get
-the current scanner.
+`prodlint-mcp` is a thin launcher for the server built into `prodlint`. It's published with
+every prodlint release, so it always runs the matching scanner.
 
 Ask your AI: *"Run prodlint on this project"* and it calls the `scan` tool directly.
 
+| Tool | Inputs | Returns |
+|------|--------|---------|
+| `scan` | `path` (project directory), optional `ignore`, `minSeverity` (`critical` / `warning` / `info`), `categories`, `maxFindings` (default 30) | Score, category scores, and findings most severe first. Every critical finding is listed, even past `maxFindings`. |
+| `scan-web` | `url` | Site score, grade, and the 14 agent-readiness checks |
+
+Both tools return a Markdown summary plus structured output (`structuredContent` matching
+each tool's `outputSchema`), and both are marked read-only (`readOnlyHint`), which hosted
+reviewers such as GitHub Copilot code review require before they call an MCP tool.
+
 ## Site Score
 
 Check any deployed website for AI agent-readiness — 14 checks covering emerging standards like llms.txt, TDMRep, AgentCard, AI-Disclosure, HTTP Signatures (RFC 9421), and more.

package/action.yml

@@ -13,6 +13,10 @@ inputs:
     description: 'Minimum score to pass (0-100). Fails the check if score is below this.'
     required: false
     default: '0'
+  fail-on-critical:
+    description: 'Fail the check when the scan finds critical issues (true/false)'
+    required: false
+    default: 'true'
   ignore:
     description: 'Glob patterns to ignore (comma-separated)'
     required: false
@@ -34,7 +38,7 @@ runs:
   using: 'composite'
   steps:
     - name: Setup Node.js
-      uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+      uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
       with:
         node-version: '22'
         # Automatic caching would key off the scanned repo's package.json; npx needs none.
@@ -58,49 +62,33 @@ runs:
 
         # The exact release this action ships with (scripts/sync-versions.cjs bumps it), so
         # pinning the action — @v1, a version tag or a commit SHA — also pins the scanner.
-        OUTPUT=$(npx -y prodlint@0.10.2 "${CMD_ARGS[@]}" 2>&1) || true
-
-        SCORE=$(echo "$OUTPUT" | node -e "
-          const d = JSON.parse(require('fs').readFileSync(0, 'utf8'));
-          console.log(Number(d.overallScore) || 0);
-        " 2>/dev/null || echo "0")
-        SCORE=$(echo "$SCORE" | tr -cd '0-9')
-
-        CRITICAL=$(echo "$OUTPUT" | node -e "
-          const d = JSON.parse(require('fs').readFileSync(0, 'utf8'));
-          console.log(Number(d.summary.critical) || 0);
-        " 2>/dev/null || echo "0")
-        CRITICAL=$(echo "$CRITICAL" | tr -cd '0-9')
-
-        echo "score=${SCORE:-0}" >> "$GITHUB_OUTPUT"
-        echo "critical=${CRITICAL:-0}" >> "$GITHUB_OUTPUT"
-        echo "$OUTPUT" > "$RUNNER_TEMP/prodlint-result.json"
+        # It exits 1 when it finds criticals and 2 when the scan fails; "Check results" decides.
+        EXIT_CODE=0
+        npx -y prodlint@0.10.4 "${CMD_ARGS[@]}" > "$RUNNER_TEMP/prodlint-result.json" || EXIT_CODE=$?
+        echo "exit-code=$EXIT_CODE" >> "$GITHUB_OUTPUT"
+        node "$GITHUB_ACTION_PATH/scripts/action-check.cjs" outputs "$RUNNER_TEMP/prodlint-result.json" >> "$GITHUB_OUTPUT"
 
     # Built by a script file rather than inline `node -e`: the comment carries file paths
     # and messages from the scanned repo, and the script's escaping is unit-tested.
     - name: Generate comment body
-      if: inputs.comment == 'true' && github.event_name == 'pull_request'
+      if: inputs.comment == 'true' && github.event_name == 'pull_request' && steps.scan.outputs.scanned == 'true'
       id: comment
       shell: bash
       run: node "$GITHUB_ACTION_PATH/scripts/action-comment.cjs" "$RUNNER_TEMP/prodlint-result.json" "$RUNNER_TEMP/prodlint-comment.md"
 
     - name: Post PR comment
-      if: inputs.comment == 'true' && github.event_name == 'pull_request'
+      if: inputs.comment == 'true' && github.event_name == 'pull_request' && steps.scan.outputs.scanned == 'true'
       uses: marocchino/sticky-pull-request-comment@5770ad5eb8f42dd2c4f34da00c94c5381e49af88 # v3.0.5
       with:
         header: prodlint
         path: ${{ runner.temp }}/prodlint-comment.md
 
-    - name: Check threshold
-      if: inputs.threshold != '0'
+    # Fails on critical findings (unless fail-on-critical is false), on a score below
+    # threshold, and when the scan didn't produce a result.
+    - name: Check results
       shell: bash
       env:
-        SCAN_SCORE: ${{ steps.scan.outputs.score }}
+        SCAN_EXIT_CODE: ${{ steps.scan.outputs.exit-code }}
         INPUT_THRESHOLD: ${{ inputs.threshold }}
-      run: |
-        SCORE="$SCAN_SCORE"
-        THRESHOLD="$INPUT_THRESHOLD"
-        if [ "$SCORE" -lt "$THRESHOLD" ]; then
-          echo "::error::Prodlint score ($SCORE) is below threshold ($THRESHOLD)"
-          exit 1
-        fi
+        INPUT_FAIL_ON_CRITICAL: ${{ inputs.fail-on-critical }}
+      run: node "$GITHUB_ACTION_PATH/scripts/action-check.cjs" check "$RUNNER_TEMP/prodlint-result.json"