From 741176f48d98995b1be8ed9cda9701c14fd5ea5d Mon Sep 17 00:00:00 2001 From: Aji Anaz Date: Sun, 7 Jun 2026 23:15:24 +0700 Subject: [PATCH] =?UTF-8?q?release:=20v0.4.6=20=E2=80=94=20changelog,=20do?= =?UTF-8?q?cs,=20version=20bump?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - Cargo.toml: 0.4.5 → 0.4.6 - CHANGELOG.md: full v0.4.6 entry (secrets scanner, diff parser, README redesign) - README.md: add secrets scanner mention - docs/changelog.md: v0.4.6 entry - docs/installation.md: version pin v0.4.6 - docs/roadmap.md: mark v0.4.6 items done - docs/configuration.md: add Secrets Pre-Scan section - docs/cli-reference.md: add config show --global/--project --- CHANGELOG.md | 26 +++++++++++++++++++++++++- Cargo.lock | 2 +- Cargo.toml | 2 +- README.md | 2 +- docs/changelog.md | 21 +++++++++++++++++++++ docs/cli-reference.md | 3 +++ docs/configuration.md | 16 ++++++++++++++++ docs/installation.md | 2 +- docs/roadmap.md | 4 ++-- 9 files changed, 71 insertions(+), 7 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 87052549..6c55c392 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -5,6 +5,29 @@ All notable changes to cora-cli are documented in this file. The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html). +## [0.4.6] - 2026-06-07 + +### Changed + +- **README redesigned** — 568 → 148 lines, professional layout with star badge, docs index table, links to docs/ for details (#162) +- **All docs updated for v0.4.5+** — changelog, getting-started, usage, roadmap, examples, installation + +### Added + +- **Deterministic secrets pre-scan** — 12 built-in patterns (AWS, GitHub, OpenAI, Anthropic, Groq, xAI, Slack, Stripe, Google, JWT, Private Key) run before AI review (#204) + - Masked output: `AKIA****CDEF` (first 4 + last 4 chars shown) + - Auto-skip test/spec/fixture/mock/example files + - Secrets findings injected into LLM context for consistent summary + - Fallback path blocks on critical findings even when LLM fails +- **Diff parser hardening** — hunk line count validation, broader binary detection (GIT binary patch, singular form), graceful truncated diff handling (#195 Phase 1) +- **`.agent.md` release checklist** — pre-release checklist to prevent docs drift between versions + +### Fixed + +- `cora config show --global` / `--project` documented in cli-reference.md (was missing) +- `cora auth login` path corrected from `config.toml` to `auth.toml` in cli-reference.md +- CI example in docs now includes CORA_BASE_URL and CORA_MODEL secrets + ## [Unreleased] ## [0.4.5] - 2026-06-07 @@ -330,7 +353,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 - **Cross-platform** — Linux (x86_64, ARM64), macOS (Apple Silicon), Windows (x86_64) - **MIT License** — fully open source -[Unreleased]: https://github.com/codecoradev/cora-cli/compare/v0.4.5...develop +[Unreleased]: https://github.com/codecoradev/cora-cli/compare/v0.4.6...develop +[0.4.6]: https://github.com/codecoradev/cora-cli/compare/v0.4.5...v0.4.6 [0.4.5]: https://github.com/codecoradev/cora-cli/compare/v0.4.4...v0.4.5 [0.4.4]: https://github.com/codecoradev/cora-cli/compare/v0.4.3...v0.4.4 [0.4.3]: https://github.com/codecoradev/cora-cli/compare/v0.4.2...v0.4.3 diff --git a/Cargo.lock b/Cargo.lock index 92a49b9d..21173895 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -263,7 +263,7 @@ dependencies = [ [[package]] name = "cora-cli" -version = "0.4.5" +version = "0.4.6" dependencies = [ "anyhow", "assert_cmd", diff --git a/Cargo.toml b/Cargo.toml index 94a235cb..2074bfb0 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -1,6 +1,6 @@ [package] name = "cora-cli" -version = "0.4.5" +version = "0.4.6" edition = "2024" description = "CLI-first AI code review — BYOK, diff/scan/branch, pre-commit hooks" license = "MIT" diff --git a/README.md b/README.md index af408b90..35bec9c5 100644 --- a/README.md +++ b/README.md @@ -22,7 +22,7 @@ - ⚡ **Native Rust** — fast binary, no runtime dependencies, cross-platform - 🪝 **Pre-commit hooks** — catch issues before they reach CI - 📋 **SARIF output** — upload to GitHub Code Scanning -- 🛡️ **Deterministic rules** — regex-based pre-scan that always catches known patterns +- 🛡️ **Deterministic rules + secrets scanner** — regex-based pre-scan that always catches known patterns and leaked credentials - 💾 **Diff-hash caching** — skip repeat reviews automatically - 🔧 **Configurable** — per-project `.cora.yaml`, global `~/.cora/config.yaml`, or env vars diff --git a/docs/changelog.md b/docs/changelog.md index 1f22fa34..f7283476 100644 --- a/docs/changelog.md +++ b/docs/changelog.md @@ -6,6 +6,27 @@ title: Changelog For the full changelog, see the [repository](https://github.com/codecoradev/cora-cli/blob/develop/CHANGELOG.md). +## [0.4.6] - 2026-06-07 + +### Changed + +- **README redesigned** — 568 → 148 lines, professional layout with star badge and docs index (#162) +- **All docs updated** — changelog, getting-started, usage, roadmap, examples, installation + +### Added + +- **Deterministic secrets pre-scan** — 12 built-in patterns (AWS, GitHub, OpenAI, Anthropic, Groq, xAI, Slack, Stripe, Google, JWT, Private Key) (#204) + - Masked output, auto-skip test files, injected into LLM context + - Fallback blocks on critical findings when LLM fails +- **Diff parser hardening** — hunk line count validation, broader binary detection, truncated diff handling (#195 Phase 1) +- **`.agent.md` release checklist** — prevents docs drift between versions + +### Fixed + +- `cora config show` flags documented in cli-reference.md +- `cora auth login` path corrected in cli-reference.md +- CI example includes all required secrets + ## [0.4.5] - 2026-06-07 ### Changed diff --git a/docs/cli-reference.md b/docs/cli-reference.md index 559a83a8..d8b23921 100644 --- a/docs/cli-reference.md +++ b/docs/cli-reference.md @@ -35,6 +35,9 @@ Complete command reference for the cora CLI. | `cora scan` `` | Scan files for issues | | `cora scan .` `[--incremental]` | Scan only changed files | | `cora config show` | Show resolved configuration | +| `cora config show --global` | Show global config (`~/.cora/config.yaml`) | +| `cora config show --project` | Show project config (`.cora.yaml`) | +| `cora config set` `` `` | Set a config value | | `cora hook install` | Install pre-commit hook | | `cora hook uninstall` | Remove pre-commit hook | | `cora auth login` | Save API key to `~/.cora/auth.toml` | diff --git a/docs/configuration.md b/docs/configuration.md index 5254f142..019895dc 100644 --- a/docs/configuration.md +++ b/docs/configuration.md @@ -151,3 +151,19 @@ cora uses two mechanisms to prevent the LLM from fabricating findings: - **File path injection** — Actual file paths are embedded in the prompt, anchoring the LLM to real files in the diff. - **Post-parse filtering** — After parsing, any reported file paths or line numbers that don't exist in the actual diff are discarded. + +## Secrets Pre-Scan + +cora runs a deterministic secrets scan before the AI review. 12 built-in patterns detect leaked credentials: + +| Pattern | Severity | +|---------|----------| +| AWS Access Key (`AKIA...`) | Critical | +| GitHub Token (`ghp_`/`gho_`/`ghu_`) | Critical | +| OpenAI API Key (`sk-`/`sk-proj-`) | Critical | +| Anthropic API Key (`sk-ant-`) | Critical | +| Private Key Block | Critical | +| JWT Token | Major | +| And more (Groq, xAI, Slack, Stripe, Google) | Varies | + +Secrets are automatically **masked** in output (e.g. `AKIA****CDEF`). Test/spec/fixture files are auto-skipped. diff --git a/docs/installation.md b/docs/installation.md index aadf3652..c29a5530 100644 --- a/docs/installation.md +++ b/docs/installation.md @@ -21,7 +21,7 @@ echo 'export PATH="$HOME/.local/bin:$PATH"' >> ~/.bashrc Pin a specific version: ```bash -$ CORA_VERSION=v0.4.5 curl -fsSL https://raw.githubusercontent.com/codecoradev/cora-cli/main/install.sh | sh +$ CORA_VERSION=v0.4.6 curl -fsSL https://raw.githubusercontent.com/codecoradev/cora-cli/main/install.sh | sh ``` ## Install via Cargo diff --git a/docs/roadmap.md b/docs/roadmap.md index ef18e450..62c9e4ed 100644 --- a/docs/roadmap.md +++ b/docs/roadmap.md @@ -60,8 +60,8 @@ Demand-gated — we build what people actually need. Track progress on [GitHub I ## v0.4.6 — Polish & Docs - [#162](https://github.com/codecoradev/cora-cli/issues/162) README overhaul — market-facing copy — ✓ Done -- [#204](https://github.com/codecoradev/cora-cli/issues/204) Deterministic secrets pre-scan — ◎ Planned -- [#195](https://github.com/codecoradev/cora-cli/issues/195) Diff parser hardening — ◎ Planned +- [#204](https://github.com/codecoradev/cora-cli/issues/204) Deterministic secrets pre-scan — ✓ Done +- [#195](https://github.com/codecoradev/cora-cli/issues/195) Diff parser hardening Phase 1 — ✓ Done ## v0.5 — Agent & Quality