shipready 1.8.0 → 1.8.1

package/README.md

@@ -11,6 +11,8 @@ shipready is a CLI for developers who build with AI and vibe-coding tools. It sc
 
 **No API key required. Works fully offline. No telemetry.**
 
+![shipready finds a hardcoded API key, moves it to .env automatically, and the score goes from 55 to 80](.github/assets/demo.gif)
+
 ## Why shipready exists
 
 AI coding tools are great at producing working code fast, but they routinely:
@@ -136,29 +138,37 @@ shipready fix --dry-run
 
 ```txt
 ╭──────────────────────────────────────────────────────────╮
-│ shipready v1.3.0                                         │
-│ project Next.js  ·  pm pnpm                              │
+│ shipready v1.8.0                                         │
+│ project Next.js  ·  pm npm                               │
 ╰──────────────────────────────────────────────────────────╯
 
-  Score  ████████████████████░░░░░░░░  72/100  almost there
+  Score  ███████████████░░░░░░░░░░░░░  55/100  not ready to ship
+  -8 weak README  ·  -6 no test script  ·  -25 hardcoded secret  ·  -6 TODO comments (3)
 
-  ✓ package.json  ok
-  ✓ README        ok
-  ✗ Env safety    .env.example missing (3 env vars used in code)
-  ✗                .env is not ignored by git
-  ✓ Secrets       No obvious secrets found
-  ✗ Git history   1 secret buried in git history (removed from code but still exposed)
-  ⚠ Code hygiene  4 TODO/FIXME comments found
-  ⚠                2 console.log calls found
-  ✓ .gitignore    ok
+  ✓ package.json  package.json found
+  ⚠               Missing scripts: test, lint
+  ✓ README        README.md found
+  ⚠               README looks thin - add installation and usage instructions
+  ℹ Env safety    No environment variables detected in code
+  ✗ Secrets       1 potential secret detected
+  ⚠               1 possible secret detected (lower confidence)
+  ⚠ Code hygiene  2 TODO/FIXME comments found
+  ⚠               1 console.log call found
+  ⚠ .gitignore    .gitignore missing entries: .env, .env.local, .next
 
   Next steps
-    1. Purge leaked secrets from git history (BFG or git filter-repo) and rotate them
-    2. Add .env to .gitignore
-    3. Create .env.example (run: shipready fix)
-    4. Remove debug logs and debugger statements before shipping
+    1. Rotate and remove hardcoded secrets immediately
+    2. Expand README with installation and usage sections
+    3. Add missing entries to .gitignore (run: shipready fix)
+    4. Add missing package.json scripts (build/test/lint)
+    5. Remove debug logs and debugger statements before shipping
+    6. Resolve TODO/FIXME comments or track them as issues
+
+  Run with --verbose to see file locations.
 ```
 
+Run `shipready fix` and the hardcoded key moves to `.env`, `.gitignore` gets patched, and the score jumps to 80 - see the [secret autofix](#secret-autofix) section.
+
 ## What it checks
 
 | Check | What it looks for |
@@ -381,24 +391,6 @@ Catch secrets **before** they enter history at all — see [`shipready staged`](
 
 Use `--json` to feed the report into other tooling, or `--sarif` for anything that speaks SARIF.
 
-## Scoring
-
-Every project starts at 100 and loses points for issues:
-
-| Issue | Deduction |
-| --- | --- |
-| Missing package.json | -20 |
-| Missing README | -15 |
-| Weak README | -8 |
-| Missing build script | -8 |
-| Missing test script | -6 |
-| Missing .env.example (when env vars exist) | -10 |
-| .env not gitignored | -15 |
-| Possible secret | -25 each (max -50) |
-| TODO/debug leftovers | -2 each (max -15) |
-
-The score never goes below 0.
-
 ## Development
 
 ```bash

package/dist/cli.js

@@ -54,7 +54,10 @@ async function applyFixes(root, force, dryRun = false) {
     const results = [
         ...secretFix.results,
         ...[fixEnvExample(root, envUsages, force, dryRun)].filter((r) => !(r.action === "skipped" && handled.has(r.file))),
-        fixGitignore(root, dryRun),
+        fixGitignore(root, dryRun, project.framework, {
+            hasBuildScript: Boolean(project.scripts["build"]),
+            usesEnv: envUsages.length > 0 || secretFix.envAdditions.length > 0,
+        }),
         ...fixAgentFiles(root, project, force, dryRun),
     ];
     for (const { finding, reason } of secretFix.manual) {

package/dist/fixers/gitignore.js

@@ -1,13 +1,13 @@
-import { importantIgnoresFor, missingIgnoreEntries } from "../checks/gitignore.js";
+import { importantIgnoresFor, missingIgnoreEntries, } from "../checks/gitignore.js";
 import { readTextFile, writeTextFile } from "../utils/files.js";
 /** Adds missing important entries to .gitignore (creates it if absent). */
-export function fixGitignore(root, dryRun = false, framework) {
+export function fixGitignore(root, dryRun = false, framework, ctx) {
     const file = ".gitignore";
     const existing = readTextFile(root, file);
     if (existing === null) {
         const content = [
             "# Added by shipready",
-            ...importantIgnoresFor(framework),
+            ...importantIgnoresFor(framework, ctx),
             "",
         ].join("\n");
         if (!dryRun) {
@@ -15,7 +15,7 @@ export function fixGitignore(root, dryRun = false, framework) {
         }
         return { file, action: "created", dryRun, preview: content };
     }
-    const missing = missingIgnoreEntries(existing, framework);
+    const missing = missingIgnoreEntries(existing, framework, ctx);
     if (missing.length === 0) {
         return { file, action: "skipped", reason: "already complete" };
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "shipready",
-  "version": "1.8.0",
+  "version": "1.8.1",
   "description": "Pre-flight check for your repo before shipping. Scans AI-coded projects for secrets, env issues, debug leftovers, and generates AI-agent instruction files.",
   "type": "module",
   "license": "MIT",