shopify-upgrade-guard 0.2.2 → 0.2.4

package/README.md

@@ -4,9 +4,9 @@
 
 [![npm](https://img.shields.io/npm/v/shopify-upgrade-guard?logo=npm)](https://www.npmjs.com/package/shopify-upgrade-guard)
 [![npm downloads](https://img.shields.io/npm/dm/shopify-upgrade-guard?logo=npm)](https://www.npmjs.com/package/shopify-upgrade-guard)
-[![CI](https://github.com/efegokdemir/shopify-upgrade-guard/actions/workflows/ci.yml/badge.svg)](https://github.com/efegokdemir/shopify-upgrade-guard/actions/workflows/ci.yml)
-[![CodeQL](https://github.com/efegokdemir/shopify-upgrade-guard/actions/workflows/codeql.yml/badge.svg)](https://github.com/efegokdemir/shopify-upgrade-guard/actions/workflows/codeql.yml)
-[![license](https://img.shields.io/github/license/efegokdemir/shopify-upgrade-guard)](LICENSE)
+[![CI](https://github.com/RexCode-Digital/shopify-upgrade-guard/actions/workflows/ci.yml/badge.svg)](https://github.com/RexCode-Digital/shopify-upgrade-guard/actions/workflows/ci.yml)
+[![CodeQL](https://github.com/RexCode-Digital/shopify-upgrade-guard/actions/workflows/codeql.yml/badge.svg)](https://github.com/RexCode-Digital/shopify-upgrade-guard/actions/workflows/codeql.yml)
+[![license](https://img.shields.io/github/license/RexCode-Digital/shopify-upgrade-guard)](LICENSE)
 
 Shopify Upgrade Guard is an offline, evidence-backed CLI and GitHub Action for Shopify developers. It scans a repository for documented upgrade and deprecation risks, evaluates them against a target Shopify API version, and gives you migration guidance backed by official Shopify sources.
 
@@ -14,6 +14,10 @@ Shopify Upgrade Guard is an offline, evidence-backed CLI and GitHub Action for S
 
 > Unofficial open-source developer tooling. Not affiliated with, endorsed by, or certified by Shopify.
 
+Maintained by RexCode Digital Ltd.
+
+Part of the **RexCode Shopify developer tools** suite. Requires Node.js 20 or later for the CLI. [Releases](https://github.com/RexCode-Digital/shopify-upgrade-guard/releases) · [npm](https://www.npmjs.com/package/shopify-upgrade-guard) · [Marketplace](https://github.com/marketplace/actions/shopify-upgrade-guard)
+
 ## Quick start
 
 Run it without installing anything globally:
@@ -58,16 +62,19 @@ jobs:
   upgrade-guard:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 0
+          persist-credentials: false
 
-      - uses: efegokdemir/shopify-upgrade-guard@05221e7582b701b5399b4f27d35ed92257f5ef0c # v0.2.1
+      - uses: RexCode-Digital/shopify-upgrade-guard@4e288cbc58a3186a7304785615f7255c0e3d0155 # v0.2.3
         with:
           target: 2026-10
           fail-on: warning
           fail-on-new: 'true'
 ```
 
-For convenience, workflows may use the movable minor release alias `efegokdemir/shopify-upgrade-guard@v0.2`. For high-assurance production workflows, pin the full reviewed commit SHA shown above; minor aliases are not immutable.
+Use the immutable patch release tag or a reviewed full commit SHA. Existing minor aliases are retained for compatibility and are not moved by future releases.
 
 ### Action inputs
 
@@ -77,6 +84,7 @@ For convenience, workflows may use the movable minor release alias `efegokdemir/
 | `fail-on` | Policy threshold: `never`, `error`, `warning`, or `info` |
 | `fail-on-new` | Apply the failure threshold only to findings introduced by the PR |
 | `path` | Repository path to scan |
+| `base-ref` | Explicit Git base for comparison; defaults to origin/PR-base for new-only pull-request checks |
 
 ### Action outputs
 
@@ -86,7 +94,7 @@ The Action is bundled and runs on the current GitHub `node24` JavaScript Action
 
 ## What it catches today
 
-The rule pack is intentionally small and high-precision.
+The rule pack is intentionally focused. Existing lexical checks report review signals; the `automaticDiscounts` removal check parses literal GraphQL root selections.
 
 | Rule | Detects | Evidence |
 | --- | --- | --- |
@@ -98,7 +106,8 @@ The rule pack is intentionally small and high-precision.
 | `UG-CUSTOMER-001` | Customer Account checkout removals relevant to 2026-10 | [Shopify changelog](https://shopify.dev/changelog/customer-account-api-last-incomplete-checkout-and-checkout-types-removed) |
 | `UG-POS-001` | Removed POS `session.currentSession.staffMemberId` usage | [Shopify changelog](https://shopify.dev/changelog/removed-session-currentsession-staffmemberid-from-pos-ui-extensions-2026-10) |
 | `UG-ADMIN-001` | Legacy Admin GraphQL `priceRule` usage | [2026-10 release notes](https://shopify.dev/release-notes/2026-10) |
-| `UG-SCRIPT-001` | Script Tag create/update usage | [Script Tag deprecation](https://shopify.dev/changelog/online-store-script-tags-deprecation) |
+| `UG-ADMIN-002` | Literal GraphQL root `automaticDiscounts` removed in 2027-01 | [Official removal](https://shopify.dev/changelog/posts/automaticdiscounts-query-is-removed-in-api-version-2027-01) |
+| `UG-SCRIPT-001` | Cross-version Script Tag write restrictions; REST resource references require method review | [Script Tag deprecation](https://shopify.dev/changelog/online-store-script-tags-deprecation) |
 
 Supported inventory surfaces include Admin REST, Admin GraphQL, Checkout UI extensions, Customer Account UI extensions, POS UI extensions, Functions, Shopify app TOML, and recognized Shopify client configuration.
 
@@ -125,7 +134,7 @@ npx shopify-upgrade-guard scan --target 2026-10 --format json
 npx shopify-upgrade-guard scan --target 2026-10 --format sarif
 
 # Fail only when the PR introduces new warning-or-higher findings
-npx shopify-upgrade-guard scan --target 2026-10 --fail-on warning --fail-on-new
+npx shopify-upgrade-guard scan --target 2026-10 --fail-on warning --fail-on-new --base-ref origin/main
 ```
 
 Exit codes: `0` means the scan completed and policy passed; `1` means active findings exceeded the configured policy; `2` means the scanner could not complete.
@@ -141,6 +150,10 @@ npx shopify-upgrade-guard baseline check
 
 Baselined findings remain reviewable while new fingerprints stay actionable.
 
+`--fail-on-new` requires a valid Git base comparison. Fetch full history and provide `--base-ref`, or use the pull-request Action. Missing refs/history exit 2 instead of passing an incomplete comparison.
+
+The bundled snapshot, verified 4 October 2026, lists `2026-10` as latest stable and `2027-01` as release candidate. The RC is for testing. Shopify lists `2025-10` as unsupported while its accessibility table runs until 16 October 2026; support status and accessibility are distinct. Future version names do not imply verified rule coverage.
+
 ## Configuration
 
 Commit `.upgradeguard.json` to set repository defaults:
@@ -176,10 +189,13 @@ See [SECURITY.md](SECURITY.md) and the [threat model](docs/threat-model.md).
 
 Building or maintaining Shopify apps?
 
-- **[ChangeGuard](https://github.com/efegokdemir/shopify-app-changeguard)** — Review meaningful `shopify.app*.toml` configuration changes before they reach production.
-- **[Shopify Scope Guard](https://github.com/efegokdemir/shopify-scope-guard)** — Audit whether declared Shopify permissions are supported by offline code evidence.
+- **[ChangeGuard](https://github.com/RexCode-Digital/shopify-app-changeguard)** — Review meaningful `shopify.app*.toml` configuration changes before they reach production.
+- **[Shopify Scope Guard](https://github.com/RexCode-Digital/shopify-scope-guard)** — Audit whether declared Shopify permissions are supported by offline code evidence.
+- **[Shopify App Review Guard](https://github.com/RexCode-Digital/shopify-app-review-guard)** — Run deterministic preflight checks for Shopify App Store and production readiness.
+
+GitHub Marketplace: [Shopify Upgrade Guard](https://github.com/marketplace/actions/shopify-upgrade-guard)
 
-Both tools are offline, open-source, and require no Shopify credentials.
+All four tools run offline and require no Shopify credentials.
 
 ## Contributing
 
@@ -193,7 +209,7 @@ A Shopify-specific rule should include:
 4. migration guidance
 5. positive and false-positive tests
 
-Start with [the contribution guide](CONTRIBUTING.md) or browse the [open issues](https://github.com/efegokdemir/shopify-upgrade-guard/issues).
+Start with [the contribution guide](CONTRIBUTING.md) or browse the [open issues](https://github.com/RexCode-Digital/shopify-upgrade-guard/issues).
 
 ## Roadmap
 
@@ -204,3 +220,15 @@ See [ROADMAP.md](ROADMAP.md).
 ## License
 
 MIT — see [LICENSE](LICENSE).
+
+## Immutable SHA usage
+
+The Action example pins the reviewed v0.2.3 release commit. Verify the release reference with:
+
+```bash
+gh api repos/RexCode-Digital/shopify-upgrade-guard/git/ref/tags/v0.2.3 --jq .object.sha
+```
+
+Published patch tags and existing minor aliases are retained. Future releases do not move minor aliases; use an immutable patch tag or a reviewed full commit SHA.
+
+The Action `base-ref` input selects an explicit Git comparison base. With `fail-on-new: true`, pull-request events default to `origin/<base branch>`; other events must supply `base-ref`. Ordinary scans do not infer a comparison from GitHub environment variables.

package/action.yml

@@ -1,6 +1,6 @@
 name: Shopify Upgrade Guard
 description: Detect documented Shopify API and platform upgrade risks in your repository
-author: Efegokdemir
+author: RexCode Digital Ltd (Efe Gökdemir)
 branding:
   icon: shield
   color: purple
@@ -16,6 +16,9 @@ inputs:
     description: Apply fail-on only to findings introduced by the pull request
     required: false
     default: 'false'
+  base-ref:
+    description: Git base reference for new-only comparison; defaults to origin/PR-base on pull requests
+    required: false
   path:
     description: Repository path to scan
     required: false

package/data/versions.json

@@ -1,14 +1,60 @@
 {
-  "verifiedAt": "2026-10-01",
+  "verifiedAt": "2026-10-04",
   "source": "https://shopify.dev/docs/api/usage/versioning",
   "versions": [
-    { "version": "2025-01", "releaseDate": "2025-01-01", "accessibleUntil": "2026-01-16T15:00:00Z", "status": "unsupported" },
-    { "version": "2025-04", "releaseDate": "2025-04-01", "accessibleUntil": "2026-04-16T15:00:00Z", "status": "unsupported" },
-    { "version": "2025-07", "releaseDate": "2025-07-01", "accessibleUntil": "2026-07-16T15:00:00Z", "status": "unsupported" },
-    { "version": "2025-10", "releaseDate": "2025-10-01", "accessibleUntil": "2026-10-16T15:00:00Z", "status": "stable" },
-    { "version": "2026-01", "releaseDate": "2026-01-01", "accessibleUntil": "2027-01-16T15:00:00Z", "status": "stable" },
-    { "version": "2026-04", "releaseDate": "2026-04-01", "accessibleUntil": "2027-04-16T15:00:00Z", "status": "stable" },
-    { "version": "2026-07", "releaseDate": "2026-07-01", "accessibleUntil": "2027-07-16T15:00:00Z", "status": "stable" },
-    { "version": "2026-10", "releaseDate": "2026-10-01", "accessibleUntil": "2027-10-16T15:00:00Z", "status": "latest-stable" }
+    {
+      "version": "2025-01",
+      "releaseDate": "2025-01-01",
+      "accessibleUntil": "2026-01-16T15:00:00Z",
+      "status": "unsupported"
+    },
+    {
+      "version": "2025-04",
+      "releaseDate": "2025-04-01",
+      "accessibleUntil": "2026-04-16T15:00:00Z",
+      "status": "unsupported"
+    },
+    {
+      "version": "2025-07",
+      "releaseDate": "2025-07-01",
+      "accessibleUntil": "2026-07-16T15:00:00Z",
+      "status": "unsupported"
+    },
+    {
+      "version": "2025-10",
+      "releaseDate": "2025-10-01",
+      "accessibleUntil": "2026-10-16T15:00:00Z",
+      "status": "unsupported"
+    },
+    {
+      "version": "2026-01",
+      "releaseDate": "2026-01-01",
+      "accessibleUntil": "2027-01-16T15:00:00Z",
+      "status": "stable"
+    },
+    {
+      "version": "2026-04",
+      "releaseDate": "2026-04-01",
+      "accessibleUntil": "2027-04-16T15:00:00Z",
+      "status": "stable"
+    },
+    {
+      "version": "2026-07",
+      "releaseDate": "2026-07-01",
+      "accessibleUntil": "2027-07-16T15:00:00Z",
+      "status": "stable"
+    },
+    {
+      "version": "2026-10",
+      "releaseDate": "2026-10-01",
+      "accessibleUntil": "2027-10-16T15:00:00Z",
+      "status": "latest-stable"
+    },
+    {
+      "version": "2027-01",
+      "releaseDate": "2027-01-01",
+      "accessibleUntil": "2028-01-16T15:00:00Z",
+      "status": "release-candidate"
+    }
   ]
 }