Skip to content

chore: release v1.5.1 #12

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
RNA4219 merged 1 commit into from
Jul 22, 2026
Merged

chore: release v1.5.1 #12

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
19 changes: 19 additions & 0 deletions CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,6 +13,25 @@ No unreleased changes yet.

---

## [1.5.1] - 2026-07-22 - Security Gate Hardening Release

### Added

- Pinned Semgrep and Gitleaks security checks with reproducible toolchain metadata.
- CycloneDX SBOM generation and golden regression fixtures for the security gate.

### Security

- Run dependency installation without lifecycle scripts in the security gate.
- Verify scanner provenance and block high or critical npm audit findings.

### Changed

- Document the security gate, its update procedure, and local verification commands.
- Synchronize the runtime, package, distribution status, and release metadata at `1.5.1`.

---

## [1.5.0] - 2026-07-12 - Security and SQL Database Analysis Release

### Added
Expand Down
10 changes: 5 additions & 5 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,8 +12,8 @@ automatic release decisions. `critical` and `high` are gate severity labels used
to prioritize human review; the final release decision remains with the human
or downstream approval gate.

[![Package](https://img.shields.io/badge/package-1.5.0-blue)](CHANGELOG.md)
[![GitHub release](https://img.shields.io/badge/GitHub%20release-v1.5.0-yellow)](https://github.com/RNA4219/code-to-gate/releases)
[![Package](https://img.shields.io/badge/package-1.5.1-blue)](CHANGELOG.md)
[![GitHub release](https://img.shields.io/badge/GitHub%20release-v1.5.1-yellow)](https://github.com/RNA4219/code-to-gate/releases)
[![npm](https://img.shields.io/badge/npm-not%20published-lightgrey)](https://www.npmjs.com/package/@quality-harness/code-to-gate)
[![License: MIT](https://img.shields.io/badge/License-MIT-green.svg)](LICENSE)
[![Node](https://img.shields.io/badge/Node-20%2B-green)](https://nodejs.org/)
Expand All @@ -24,12 +24,12 @@ Language: English | [日本語](README_JA.md)

| Channel | Status |
|---------|--------|
| `package.json` | `1.5.0` |
| GitHub Release | `v1.5.0` latest published release |
| `package.json` | `1.5.1` |
| GitHub Release | `v1.5.1` latest published release |
| npm registry | Not published yet |

See [Distribution Status](docs/distribution-status.md) for the release/publication matrix.
`1.5.0` is available as a GitHub Release. The npm package remains unpublished,
`1.5.1` is available as a GitHub Release. The npm package remains unpublished,
so install from GitHub/source until npm publication is completed.

## Install
Expand Down
6 changes: 3 additions & 3 deletions README_JA.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,12 +15,12 @@ finding は **review-required candidate** であり、確定済み脆弱性や

| チャネル | 状態 |
|----------|------|
| `package.json` | `1.5.0` |
| GitHub Release | 公開済み最新は `v1.5.0` |
| `package.json` | `1.5.1` |
| GitHub Release | 公開済み最新は `v1.5.1` |
| npm registry | 未公開 |

詳細は [Distribution Status](docs/distribution-status.md) を正本にします。
`1.5.0` は GitHub Release として公開済みです。npm publish は未完了のため、npm 公開までは GitHub/source install を利用してください。
`1.5.1` は GitHub Release として公開済みです。npm publish は未完了のため、npm 公開までは GitHub/source install を利用してください。

## インストール

Expand Down
18 changes: 9 additions & 9 deletions docs/distribution-status.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,8 +2,8 @@
intent_id: DOC-DISTRIBUTION-STATUS-001
owner: code-to-gate-team
status: active
last_reviewed_at: 2026-07-12
next_review_due: 2026-08-12
last_reviewed_at: 2026-07-22
next_review_due: 2026-08-22
---

# Distribution Status
Expand All @@ -15,8 +15,8 @@ npm publication status.

| Channel | Current State | Notes |
|---------|---------------|-------|
| `package.json` | `1.5.0` | Release package version |
| GitHub Release | `v1.5.0` | Published 2026-07-12 |
| `package.json` | `1.5.1` | Release package version |
| GitHub Release | `v1.5.1` | Published 2026-07-22 |

@chatgpt-codex-connector chatgpt-codex-connector Bot Jul 22, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Do not mark v1.5.1 as published before it exists

When users follow this distribution source of truth after the release bump, this row says v1.5.1 was already published on GitHub, but the public GitHub releases page currently lists v1.5.0 as the latest release and has no v1.5.1 entry. Until the v1.5.1 tag/release is actually available, README.md and this table point users to a non-existent release and make the GitHub/source install evidence misleading; publish the release first or keep the status at v1.5.0/pending.

Useful? React with 👍 / 👎.

| npm registry | Not published | `npm view @quality-harness/code-to-gate` returned `E404` on 2026-07-12 |
| Recommended install | GitHub install | Use `npm install -g github:RNA4219/code-to-gate` until npm publish is complete |
| Local npm auth | Not authenticated | `npm whoami` returns `ENEEDAUTH`; maintainer login is required before publish |
Expand All @@ -35,23 +35,23 @@ npm install -g @quality-harness/code-to-gate

## Release Alignment

| Item | v1.5.0 Status |
| Item | v1.5.1 Status |

@chatgpt-codex-connector chatgpt-codex-connector Bot Jul 22, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Add the 1.5.1 release approval record

For the new v1.5.1 alignment section, the document still claims the Release Approval Record is synchronized, but docs/releases/INDEX.md stops at 1.5.0 and rg '1\.5\.1' docs/releases has no matches. The release checklist requires creating a docs/releases/RA-YYYYMMDD-XX.md record and adding the approval mapping, so release evidence consumers cannot verify approval for the advertised release; add the 1.5.1 RA/index entry or mark approval as pending.

Useful? React with 👍 / 👎.

|------|---------------------------------------|
| Git tag | `v1.5.0` created and pushed |
| Git tag | `v1.5.1` created and pushed |
| GitHub release | Published with notes based on `CHANGELOG.md` |
| npm package | Pending `npm login` and `npm publish --access public` |
| Package integrity | Passed before release; CI records the integrity artifact |
| Docs | README, Release Approval Record, CHANGELOG, and this file synchronized |

## Release Notes Alignment

`CHANGELOG.md` is the source for the published `v1.5.0` release notes. GitHub
and source installation now provide `v1.5.0`; npm remains unavailable until a
`CHANGELOG.md` is the source for the published `v1.5.1` release notes. GitHub
and source installation now provide `v1.5.1`; npm remains unavailable until a
maintainer publishes the package after authenticating to npm.

## Publication Evidence Policy

No npm publication has been performed for `1.5.0`. If npm publication is
No npm publication has been performed for `1.5.1`. If npm publication is
performed, the release evidence bundle must include:

- `npm whoami`
Expand Down
4 changes: 2 additions & 2 deletions package-lock.json
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

2 changes: 1 addition & 1 deletion package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
{
"name": "@quality-harness/code-to-gate",
"version": "1.5.0",
"version": "1.5.1",
"description": "A local-first quality harness that turns repository signals into evidence-backed quality risks, test seeds, and release-readiness gate inputs",
"type": "module",
"packageManager": "npm@10.9.8",
Expand Down
2 changes: 1 addition & 1 deletion src/core/database-analyzer.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,23 +1,23 @@
/**
* Database Analyzer - SPEC-29
*
* Analyzes database/migration files and generates database assets artifact.
* Wired into scan command via --database-analysis flag.
*/

import { readFileSync } from "node:fs";
import path from "node:path";
import type { DiffAccessResult } from "../types/diff-contracts.js";
import {
type DatabaseAssetsArtifact,
type MigrationRef,
type RawSqlRef,
type OrmUsageRef,
type DatabaseAssetsStats,
type SqlDialect,
type DiagnosticRef,
type TableRef,
type ColumnRef,

Check warning on line 20 in src/core/database-analyzer.ts

View workflow job for this annotation

GitHub Actions / code-to-gate Analysis

LARGE_MODULE [medium] 

This file has 810 lines, exceeding the 500 line threshold. Large files are hard to maintain, test, and understand. Consider splitting into smaller, focused modules.
type IndexRef,
type ConstraintRef,
DATABASE_ASSETS_SCHEMA_VERSION,
Expand Down Expand Up @@ -635,7 +635,7 @@
},
tool: {
name: "code-to-gate",
version: "1.5.0",
version: "1.5.1",
plugin_versions: [],
},
completeness: "partial",
Expand Down