repopilot 0.9.0 → 0.10.0

package/README.md

@@ -15,6 +15,10 @@ and framework health checks. It gives developers useful terminal reports, CI gat
 SARIF for GitHub Code Scanning, and Markdown briefs that can be pasted into Claude
 Code, ChatGPT, Cursor, or another coding assistant.
 
+Version `0.10.0` is an adoption and stability release: it focuses on cleaner
+rollout diagnostics, reproducible audit receipts, CI artifacts, and 0.x command
+compatibility while keeping all scans local.
+
 ## Why RepoPilot?
 
 Most linters and audit tools stop at the terminal. RepoPilot bridges the gap to your AI assistant:
@@ -36,23 +40,25 @@ repopilot ai context . | pbcopy   # macOS: paste into your coding assistant
 
 - Repository scanning for projects, folders, and individual files
 - Gitignore-aware walking with built-in ignores for common build, cache, vendor, and native platform directories
-- Architecture findings: oversized files, deep nesting, too many modules per directory
+- Architecture findings: oversized files, deep nesting, deep relative imports, risky barrel files, too many modules per directory
 - Coupling analysis: excessive fan-out, high-instability hubs, circular dependencies
 - Code quality findings: cyclomatic complexity density, long functions, TODO/FIXME/HACK markers
 - Security findings: hardcoded secret candidates, committed private keys, committed `.env` files
 - Testing findings: missing test folder, source files without test counterparts
-- Framework findings for JavaScript, React, React Native, and Expo projects
+- Framework findings for JavaScript, React, React Native, Expo, and Django projects
 - React Native architecture profile: project kind, New Architecture, Hermes, Codegen, platform mismatch, and package manager signals
 - Workspace scanning (`--workspace`) for npm, yarn, pnpm, and Cargo workspaces with per-package risk summary — parallel per-package scans
 - Evidence-backed findings with stable rule IDs, severity, file paths, line numbers, and snippets
-- 36 built-in rules with titles, descriptions, recommendations, and docs links
+- 46 built-in rules with titles, descriptions, recommendations, and docs links
 - `repopilot.toml` configuration generated by `repopilot init`
 - Configuration presets (`--preset strict|balanced|lenient`) for quick threshold tuning
 - Baseline workflow for accepting existing findings in legacy repositories
 - CI-friendly failure thresholds with `--fail-on`
 - Git diff-aware review mode for prioritizing findings introduced by changed lines
+- Doctor adoption guidance for config, baseline, CI gate, report, and receipt readiness
+- Audit receipt JSON from `repopilot scan --receipt` for reproducible scan evidence
 - Console, JSON, Markdown, HTML, and SARIF (2.1.0) scan output — SARIF includes per-result category and workspace package properties
-- First-party GitHub Action wrapper for `scan`, `review`, `compare`, and `ai` workflows, with optional SARIF upload for scans
+- First-party GitHub Action wrapper for `scan`, `review`, `compare`, and `ai` workflows, with optional SARIF upload and receipt output for scans
 - Compare mode for diffing two JSON scan reports
 - **`repopilot ai context`** — formats scan output as LLM-ready markdown, paste into Claude Code or ChatGPT to start remediating
 - **`repopilot ai plan`** — turns findings into a prioritized remediation plan
@@ -105,17 +111,36 @@ cargo build --release
 
 ## Quick Start
 
+No config needed. Run this in any repository and see findings immediately:
+
 ```bash
-repopilot init
 repopilot scan .
-repopilot ai context .
-repopilot review . --base origin/main --fail-on new-high
+```
+
+Then get an AI-ready brief to paste into Claude Code, Cursor, or ChatGPT:
+
+```bash
+repopilot ai context . | pbcopy   # macOS — copies to clipboard
+repopilot ai context .            # print to terminal
+```
+
+That's the two-minute loop. Scan, read the output, paste the context into your assistant, fix.
+
+### Going deeper
+
+Once you want CI integration, baseline tracking, or tighter configuration:
+
+```bash
+repopilot init                                              # generate repopilot.toml
+repopilot doctor .                                          # check CI / baseline readiness
+repopilot baseline create .                                 # accept existing findings as known debt
+repopilot review . --base origin/main --fail-on new-high    # CI gate on new findings only
 ```
 
 Save a shareable report:
 
 ```bash
-repopilot scan . --format markdown --output repopilot-report.md
+repopilot scan . --format markdown --output repopilot-report.md --receipt .repopilot/receipt.json
 ```
 
 Reduce scan noise while iterating:
@@ -357,6 +382,7 @@ repopilot scan . --format sarif > repopilot.sarif
 ```
 
 Use JSON when custom scripts need to parse RepoPilot results. Console, Markdown, and HTML reports include the RepoPilot version, risk summary, top rules, and grouped findings for human review. Use SARIF for CI and code scanning integrations, including GitHub Code Scanning.
+Use `--receipt <path>` with `scan` when CI or release processes need compact evidence of the exact RepoPilot version, git state, scan scope, finding counts, language counts, and health score.
 
 See [docs/integrations/github-code-scanning.md](docs/integrations/github-code-scanning.md) for a copy-paste GitHub Actions workflow, required permissions, and local validation commands.
 
@@ -377,7 +403,7 @@ Use `--fail-on new-high` to fail CI only when new high or critical findings are
 When `--fail-on new-*` is used without `--baseline`, RepoPilot treats all current findings as new. For baseline-based adoption, commit an accepted baseline and scan against it in CI.
 
 To upload RepoPilot findings to GitHub Code Scanning, generate SARIF and use `github/codeql-action/upload-sarif`. The workflow must include `security-events: write`.
-The first-party action can also run `command: ai-context`, `command: ai-plan`, or `command: ai-prompt`; those commands emit Markdown and do not produce SARIF. Prefer typed action inputs such as `path`, `config`, `baseline`, `fail-on`, `focus`, `budget`, and `output`; `args` remains available for advanced flags.
+The first-party action can also run `command: ai-context`, `command: ai-plan`, or `command: ai-prompt`; those commands emit Markdown and do not produce SARIF. Prefer typed action inputs such as `path`, `config`, `baseline`, `fail-on`, `focus`, `budget`, `output`, and `receipt`; `args` remains available for advanced flags.
 
 ```yaml
 name: RepoPilot
@@ -403,7 +429,7 @@ jobs:
         run: cargo install repopilot
 
       - name: Run RepoPilot
-        run: repopilot scan . --baseline .repopilot/baseline.json --fail-on new-high
+        run: repopilot scan . --baseline .repopilot/baseline.json --fail-on new-high --receipt repopilot-receipt.json
 
       - name: Run RepoPilot (SARIF)
         run: repopilot scan . --format sarif --output repopilot.sarif
@@ -413,6 +439,13 @@ jobs:
         if: always()
         with:
           sarif_file: repopilot.sarif
+
+      - name: Upload audit receipt
+        uses: actions/upload-artifact@v4
+        if: always()
+        with:
+          name: repopilot-receipt
+          path: repopilot-receipt.json
 ```
 
 ## Roadmap
@@ -438,7 +471,7 @@ These are planned ideas, not current features:
 | [docs/react-native.md](docs/react-native.md) | React Native and Expo detection, findings, and limitations |
 | [docs/integrations/github-code-scanning.md](docs/integrations/github-code-scanning.md) | GitHub Code Scanning SARIF workflow |
 | [docs/release.md](docs/release.md) | Manual release process |
-| [docs/release-checklist-0.9.md](docs/release-checklist-0.9.md) | 0.9.0 release readiness checklist |
+| [docs/release-checklist-0.10.md](docs/release-checklist-0.10.md) | 0.10.0 release readiness checklist |
 | [docs/distribution.md](docs/distribution.md) | Distribution channels |
 | [docs/github-ruleset.md](docs/github-ruleset.md) | GitHub branch ruleset configuration |
 | [CHANGELOG.md](CHANGELOG.md) | Version history |

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "repopilot",
-	"version": "0.9.0",
+	"version": "0.10.0",
 	"description": "Local-first CLI for repository audit, architecture risk detection, baseline tracking, and CI-friendly code review.",
 	"license": "MIT OR Apache-2.0",
 	"repository": {

package/scripts/smoke-product.sh

@@ -206,9 +206,11 @@ assert_non_empty "$TMP_DIR/repopilot.toml"
 run_repopilot doctor . --format markdown --output "$TMP_DIR/doctor.md"
 assert_non_empty "$TMP_DIR/doctor.md"
 
-run_repopilot scan . --format json --output "$TMP_DIR/scan.json"
+run_repopilot scan . --format json --output "$TMP_DIR/scan.json" --receipt "$TMP_DIR/receipt.json"
 assert_non_empty "$TMP_DIR/scan.json"
 validate_json_if_possible "$TMP_DIR/scan.json"
+assert_non_empty "$TMP_DIR/receipt.json"
+validate_json_if_possible "$TMP_DIR/receipt.json"
 
 run_repopilot scan . --format markdown --output "$TMP_DIR/scan.md"
 assert_non_empty "$TMP_DIR/scan.md"