chore(release): bump to v0.8.3#149
Merged
Merged
Conversation
Headline change in this release is github-action/ cloud variant default-flip from severity-threshold: high to severity-threshold: none (report-only). See CHANGELOG.md for the full entry and the infrastructure improvements that accumulated since 0.8.2. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Three pure-bash test scripts exercise the exact code paths touched by the severity-threshold: high -> none default flip: - test-threshold-eval.sh: 30 assertions across all 6 threshold values (critical/high/medium/low/none/unknown-fallback) and finding-count permutations. Confirms 'none' never fails the build regardless of findings, and that critical/high/medium/low still fail as before. - test-pr-comment-tip.sh: 9 assertions on the new report-only-tip block. Confirms the tip appears exactly when (findings > 0) AND (threshold == 'none'). - test-action-yml-defaults.sh: drift detector. Asserts (1) the severity-threshold default is literally 'none', (2) the env var passthrough on the Comment-on-PR step is intact (the GitHub-recommended template-injection mitigation), (3) the tip block is gated on both conditions, (4) the 'none' branch of the threshold-eval doesn't set FAIL=1. Each check independently verified against a mutated copy of action.yml. Wired into a new test-github-action.yml workflow that runs on PRs + main pushes touching github-action/**. The Rafter API is not exercised here; that's a future addition that would need an injectable RAFTER_API_KEY secret and a fixture repo. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Cuts v0.8.3. Headline change: the
github-action/cloud variant'sseverity-thresholddefault flips fromhightononeso first installs no longer break CI on day one (#148). All four version sites bumped (node/package.json,python/pyproject.toml, bothrafter-security-skill.mdfrontmatter copies) —validate-release.ymlenforces parity. CHANGELOG entry added.How this ships
Standard prod-branch flow:
main.main→prod.publish.yamlfires on the prod push: tests → npm Trusted Publishing → PyPI (--skip-existing) → ClawHub → GitHub Release taggedv0.8.3→ smoke-tests against the live registries.v0.8.3is what GitHub Marketplace picks up to republish the root/action.ymllisting entry.Contents of this release (since v0.8.2)
User-facing:
github-action/cloud:severity-thresholddefaulthigh→none(report-only). PR comment surfaces the opt-in enforcement hint when findings exist under the default.Infrastructure:
publish.yml→publish.yaml+--skip-existingon PyPI upload.node/package.jsonmetadata (repository,homepage,bugs,license,author).--local.Test plan
validate-release.yml(this PR's CI) passes — version parity + CHANGELOG entry present.publish.yamlsucceeds end-to-end,v0.8.3tag created, GitHub Release rendered, npm + PyPI smoke-tests pass.npm view @rafter-security/cli@0.8.3andpip index versions rafter-clishow 0.8.3 within ~3 minutes of publish.Raftersecurity/rafter-cli/github-action@mainwith noseverity-thresholdset → scan runs, PR comment + SARIF emitted, build does not fail.🤖 Generated with Claude Code