shipcheck-cli 0.2.0 → 0.2.1

package/README.md

@@ -6,15 +6,17 @@ Release-readiness and AI-app exposure scanner for JavaScript and TypeScript repo
 
 It also checks the failure points that show up in AI-built apps made with Lovable, Bolt, Replit, Cursor, v0, Base44, Supabase, Firebase, Stripe, and AI API integrations: exposed private keys, public frontend env vars that look private, unsigned Stripe webhooks, missing Firebase rules, undocumented Supabase RLS, debug API routes, and missing AI usage guardrails.
 
+Tool page: https://tatelyman.github.io/tate-web-services/shipcheck.html
+
 ## Install
 
-Run from GitHub without publishing to npm:
+Run from npm:
 
 ```bash
-npx --yes github:TateLyman/shipcheck-cli .
+npx --yes shipcheck-cli .
 ```
 
-Clone and build locally:
+Or install/build locally:
 
 ```bash
 npm install
@@ -47,6 +49,34 @@ shipcheck ../client-app --format markdown
 shipcheck . --strict --fail-on medium
 ```
 
+## GitHub Action
+
+Action repo: https://github.com/TateLyman/shipcheck-action
+
+Add Shipcheck as a release gate in any JS/TS repo:
+
+```yaml
+name: shipcheck
+
+on:
+  pull_request:
+  push:
+    branches:
+      - main
+
+jobs:
+  shipcheck:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: TateLyman/shipcheck-action@v1
+        with:
+          fail-on: medium
+          strict: true
+```
+
+The action runs the npm package with `npx`, so target repos do not need to add Shipcheck as a dependency.
+
 ## What It Checks
 
 - `package.json` exists and has repeatable `test` and `build` scripts
@@ -90,6 +120,12 @@ JSON output is designed for automation:
 shipcheck . --format json
 ```
 
+## Manual Review
+
+Shipcheck is the first pass. If the report finds a blocker in an app you own or are authorized to inspect, you can request a manual review from the tool page.
+
+Manual reviews focus on auth, data rules, env boundaries, Stripe/webhooks, deploy config, and the first paid user flow.
+
 ## Exit Codes
 
 By default, `shipcheck` exits with code `1` only when a `high` finding is present.

package/dist/src/cli.js

@@ -10,7 +10,7 @@ async function main() {
         return;
     }
     if (args.version) {
-        console.log("0.2.0");
+        console.log("0.2.1");
         return;
     }
     const report = await scanRepository({

package/package.json

@@ -1,8 +1,16 @@
 {
   "name": "shipcheck-cli",
-  "version": "0.2.0",
+  "version": "0.2.1",
   "description": "Release-readiness and AI-app exposure scanner for JavaScript and TypeScript repositories.",
   "type": "module",
+  "homepage": "https://tatelyman.github.io/tate-web-services/shipcheck.html",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/TateLyman/shipcheck-cli.git"
+  },
+  "bugs": {
+    "url": "https://github.com/TateLyman/shipcheck-cli/issues"
+  },
   "bin": {
     "shipcheck": "dist/src/cli.js"
   },