verimu 0.0.9 → 0.0.13

package/README.md

@@ -11,19 +11,22 @@ The NPM package for `verimu`, a tool for producing CRA-compliant SBOMs via CI /
 The core scanning pipeline is CI-agnostic — it works in any environment with Node.js 20+.
 Example CI configs are provided in the `ci-examples/` directory.
 
-- [x] GitHub Actions (`.github/workflows/release.yml`)
+- [x] GitHub Actions (`.github/workflows/ci.yml`, `.github/workflows/publish-npm.yml`)
 - [x] GitLab CI (`ci-examples/gitlab-ci.yml`)
 - [x] Bitbucket Pipelines (`ci-examples/bitbucket-pipelines.yml`)
 
 ## Supported Package Ecosystems
 
 - [x] npm (package-lock.json)
+- [x] yarn (yarn.lock)
+- [x] pnpm (pnpm-lock.yaml)
 - [x] NuGet (packages.lock.json)
 - [x] pip (requirements.txt, Pipfile.lock)
 - [x] Cargo (Cargo.lock)
 - [x] Maven (pom.xml + dependency-tree.txt or `mvn` on PATH)
 - [x] Go (go.sum)
 - [x] Ruby (Gemfile.lock)
+- [x] Composer (composer.lock)
 
 ## Development
 
@@ -38,13 +41,13 @@ npm test
 `verimu` can publish from GitHub Actions, GitLab CI, and Bitbucket Pipelines when a semver tag is pushed.
 Each pipeline validates:
 
-- tag is semver (`v1.2.3` or `1.2.3`)
-- tag version matches `package.json` version
+- tag is semver (i.e. `1.2.3` without a `v` prefix)
+- tag version must match `package.json` version
 - tagged commit exists on `main`
 
 ### Publish credentials
 
-- GitHub Actions (`.github/workflows/release.yml`): uses npm Trusted Publishing (OIDC), so no `NPM_TOKEN` secret is required.
+- GitHub Actions (`.github/workflows/publish-npm.yml`): uses npm Trusted Publishing (OIDC), so NO `NPM_TOKEN` secret is required.
 - GitLab and Bitbucket pipelines in this repo still use `NPM_TOKEN` (`.gitlab-ci.yml`, `bitbucket-pipelines.yml`).
 
 ### Recommended release flow
@@ -78,6 +81,6 @@ The Maven scanner needs resolved dependencies. Since Maven has no lockfile, it u
 
 ## Three CI / CD Pipelines as Self Check on the `verimu` package itself
 
-There is a `bitbucket-pipelines.yml` and `.gitlab-ci.yml` in the root of the project, as well as a `.github/workflows/release.yml` file, all of which would run `verimu` against itself in each of the 3 frameworks we support (GitHub Actions, GitLab CI, Bitbucket Pipelines). The tests should pass in all 3 environments, confirming that `verimu` can successfully scan its own dependencies and produce a report.
+There is a `bitbucket-pipelines.yml` and `.gitlab-ci.yml` in the root of the project, as well as a `.github/workflows/ci.yml` file, all of which run `verimu` against itself in each of the 3 frameworks we support (GitHub Actions, GitLab CI, Bitbucket Pipelines). The tests should pass in all 3 environments, confirming that `verimu` can successfully scan its own dependencies and produce a report.
 
-The same three provider configs now also include tag-based npm release automation, so this repo is a working cross-provider reference for both scanning and publishing.
+Tag-based npm release automation in GitHub Actions is handled by `.github/workflows/publish-npm.yml`, so this repo remains a working cross-provider reference for both scanning and publishing.