From f3eb2a094e83e32e62dce07aaa02d6c58383ea61 Mon Sep 17 00:00:00 2001 From: Sairen Christian Buerano <122254250+sairenchristianbuerano@users.noreply.github.com> Date: Thu, 10 Sep 2026 11:47:50 +0800 Subject: [PATCH] chore: point repo references at the renamed engine repos The COO and CTO renamed two repositories: trustabl/trustabl is now trustabl/agent-reliability-analyzer, and trustabl/trustabl-rules is now trustabl/agent-reliability-rules. The owner is unchanged and no other repo moved. GitHub redirects the old slugs indefinitely, so nothing here was broken, but the action is the surface most people read before they trust it - a Marketplace listing, a README badge, a security policy and an llms.txt that all name a repository that no longer exists by that name reads as staleness. Changed, and only where the target is one of the two renamed repos: - src/install.ts - RELEASE_REPO (the api.github.com/repos lookup for the latest release) and RELEASE_BASE (the release-download base URL). This is the only runtime behaviour in the diff. - dist/index.js - rebuilt with npm ci && npm run build. dist is the artifact GitHub actually executes, so the source edit alone would have changed nothing at runtime. The bundle carries some unrelated churn from dependency modules being re-emitted by a clean ncc build; the only semantic change is the two constants above. Typecheck and the 67 tests pass. - action.yml - the rules-ref and rules-repo descriptions, which render on the Marketplace listing. - README.md - the downloads badge and its link, plus the two rules-repo rows. - SECURITY.md - both links to the scanner repo, including the advisory route. - llms.txt - the three raw.githubusercontent links to the engine's canonical llms.txt, README and COVERAGE. - .github/workflows/download-history.yml and the stats JSON it writes - TARGET_REPO drives an api.github.com/repos releases call. The JSON's "repo" field is rewritten from TARGET_REPO on every run anyway; it is updated here so the committed file does not disagree with the workflow between runs. The recorded download counts are untouched. Deliberately NOT changed: - CHANGELOG.md. Three entries link or name trustabl/trustabl. They record what was true when they were written, and the links still resolve through the redirect. Rewriting them would make a true historical statement false. - Everything named "trustabl" that is not a repository reference: the CLI binary and its release asset filenames (trustabl___.tar.gz, which have no redirect and would 404 on every published tag), the tool-cache entry, the SARIF tool name, the action's own repo trustabl/trustabl-action, the owner, and the product name throughout the prose. The product is not being renamed, only two repositories. No bare find/replace was run on the token "trustabl". --- .github/stats/download-history.json | 2 +- .github/workflows/download-history.yml | 4 +- README.md | 6 +- SECURITY.md | 4 +- action.yml | 4 +- dist/index.js | 292 ++++++++++++------------- llms.txt | 6 +- src/install.ts | 4 +- 8 files changed, 161 insertions(+), 161 deletions(-) diff --git a/.github/stats/download-history.json b/.github/stats/download-history.json index 530b788..679af8d 100644 --- a/.github/stats/download-history.json +++ b/.github/stats/download-history.json @@ -1,5 +1,5 @@ { - "repo": "trustabl/trustabl", + "repo": "trustabl/agent-reliability-analyzer", "unit": "cumulative_release_downloads", "history": [ { diff --git a/.github/workflows/download-history.yml b/.github/workflows/download-history.yml index 1e62ab0..0f3d2ad 100644 --- a/.github/workflows/download-history.yml +++ b/.github/workflows/download-history.yml @@ -1,6 +1,6 @@ name: Download history -# Weekly snapshot of trustabl/trustabl cumulative release-asset downloads. +# Weekly snapshot of trustabl/agent-reliability-analyzer cumulative release-asset downloads. # GitHub exposes only the CURRENT total (download_count) with no history, so we # record one dated point per run and commit it -> a JSON time series to graph. # Same-day reruns overwrite that day's point (no duplicates). @@ -22,7 +22,7 @@ jobs: - name: Record cumulative downloads env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - TARGET_REPO: trustabl/trustabl + TARGET_REPO: trustabl/agent-reliability-analyzer HISTORY_FILE: .github/stats/download-history.json run: | python - <<'PY' diff --git a/README.md b/README.md index 16785d0..68d2183 100644 --- a/README.md +++ b/README.md @@ -1,6 +1,6 @@

Trustabl on GitHub Marketplace - trustabl binary downloads + trustabl binary downloads Used by (repos)

@@ -168,8 +168,8 @@ fixes and open a fix PR on pull requests: | `detectors` | _(all)_ | Comma-separated SDK subset: `claude_sdk`, `openai_sdk`, `google_adk`, `openshell`, `mcp`, `langchain`, `crewai`, `pydantic_ai`, `vercel_ai`, `autogen`. | | `strict` | `false` | Pass `--strict` (fail on any finding). | | `vuln-scan` | `false` | Match dependencies against a pinned OSV snapshot; report known CVEs as findings. | -| `rules-ref` | _(default)_ | Pin a `trustabl-rules` git ref. | -| `rules-repo` | _(default)_ | Override the `trustabl-rules` source repo. | +| `rules-ref` | _(default)_ | Pin an `agent-reliability-rules` git ref. | +| `rules-repo` | _(default)_ | Override the `agent-reliability-rules` source repo. | | `upload-sarif` | `true` | Upload SARIF to Code Scanning. Needs `security-events: write`. | | `sarif-file` | `trustabl.sarif` | SARIF output path. | | `json-file` | `trustabl.json` | JSON `ScanResult` output path. | diff --git a/SECURITY.md b/SECURITY.md index faf0aef..fe6bb3b 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -17,7 +17,7 @@ in the release notes unless you would rather we did not. This repository is a thin GitHub Action around the Trustabl CLI. It downloads the upstream release binary, verifies it, runs a scan, and gates the build. The scanner itself lives in -[trustabl/trustabl](https://github.com/trustabl/trustabl). +[trustabl/agent-reliability-analyzer](https://github.com/trustabl/agent-reliability-analyzer). **In scope here** @@ -35,7 +35,7 @@ scanner itself lives in normal issue - Vulnerabilities in a repository you scanned. Those belong to that repository - Defects in the scanner itself. Report those to - [trustabl/trustabl](https://github.com/trustabl/trustabl/security/advisories/new) so one advisory covers every integration + [trustabl/agent-reliability-analyzer](https://github.com/trustabl/agent-reliability-analyzer/security/advisories/new) so one advisory covers every integration ## Supported versions diff --git a/action.yml b/action.yml index 635d204..75cdea8 100644 --- a/action.yml +++ b/action.yml @@ -34,11 +34,11 @@ inputs: required: false default: "false" rules-ref: - description: Pin trustabl-rules git ref. Empty = engine default. + description: Pin agent-reliability-rules git ref. Empty = engine default. required: false default: "" rules-repo: - description: Override trustabl-rules source repo (owner/name or URL). + description: Override agent-reliability-rules source repo (owner/name or URL). required: false default: "" diff --git a/dist/index.js b/dist/index.js index cacd668..d841fec 100644 --- a/dist/index.js +++ b/dist/index.js @@ -85183,8 +85183,8 @@ const hash_1 = __nccwpck_require__(56495); const version_1 = __nccwpck_require__(311); const process_1 = __nccwpck_require__(34006); const RELEASE_OWNER = 'trustabl'; -const RELEASE_REPO = 'trustabl'; -const RELEASE_BASE = 'https://github.com/trustabl/trustabl/releases/download'; +const RELEASE_REPO = 'agent-reliability-analyzer'; +const RELEASE_BASE = 'https://github.com/trustabl/agent-reliability-analyzer/releases/download'; // MIN_ENGINE_VERSION is the engine release that ships --json-out/--sarif-out, the // Code-Scanning-valid SARIF (no fixes[]), and projected_scores — all introduced // together in v0.1.3. Older binaries still work via the two-scan fallback @@ -101573,6 +101573,24 @@ exports.StorageContextClient = StorageContextClient; /***/ }), +/***/ 83627: +/***/ ((__unused_webpack_module, exports) => { + +"use strict"; + +// Copyright (c) Microsoft Corporation. +// Licensed under the MIT License. +Object.defineProperty(exports, "__esModule", ({ value: true })); +exports.KnownEncryptionAlgorithmType = void 0; +/** Known values of {@link EncryptionAlgorithmType} that the service accepts. */ +var KnownEncryptionAlgorithmType; +(function (KnownEncryptionAlgorithmType) { + KnownEncryptionAlgorithmType["AES256"] = "AES256"; +})(KnownEncryptionAlgorithmType || (exports.KnownEncryptionAlgorithmType = KnownEncryptionAlgorithmType = {})); +//# sourceMappingURL=generatedModels.js.map + +/***/ }), + /***/ 30247: /***/ ((__unused_webpack_module, exports, __nccwpck_require__) => { @@ -111899,6 +111917,132 @@ exports.listType = { /***/ }), +/***/ 56635: +/***/ ((__unused_webpack_module, exports) => { + +"use strict"; + +/* + * Copyright (c) Microsoft Corporation. + * Licensed under the MIT License. + * + * Code generated by Microsoft (R) AutoRest Code Generator. + * Changes may cause incorrect behavior and will be lost if the code is regenerated. + */ +Object.defineProperty(exports, "__esModule", ({ value: true })); +//# sourceMappingURL=appendBlob.js.map + +/***/ }), + +/***/ 68355: +/***/ ((__unused_webpack_module, exports) => { + +"use strict"; + +/* + * Copyright (c) Microsoft Corporation. + * Licensed under the MIT License. + * + * Code generated by Microsoft (R) AutoRest Code Generator. + * Changes may cause incorrect behavior and will be lost if the code is regenerated. + */ +Object.defineProperty(exports, "__esModule", ({ value: true })); +//# sourceMappingURL=blob.js.map + +/***/ }), + +/***/ 17188: +/***/ ((__unused_webpack_module, exports) => { + +"use strict"; + +/* + * Copyright (c) Microsoft Corporation. + * Licensed under the MIT License. + * + * Code generated by Microsoft (R) AutoRest Code Generator. + * Changes may cause incorrect behavior and will be lost if the code is regenerated. + */ +Object.defineProperty(exports, "__esModule", ({ value: true })); +//# sourceMappingURL=blockBlob.js.map + +/***/ }), + +/***/ 15337: +/***/ ((__unused_webpack_module, exports) => { + +"use strict"; + +/* + * Copyright (c) Microsoft Corporation. + * Licensed under the MIT License. + * + * Code generated by Microsoft (R) AutoRest Code Generator. + * Changes may cause incorrect behavior and will be lost if the code is regenerated. + */ +Object.defineProperty(exports, "__esModule", ({ value: true })); +//# sourceMappingURL=container.js.map + +/***/ }), + +/***/ 82354: +/***/ ((__unused_webpack_module, exports, __nccwpck_require__) => { + +"use strict"; + +/* + * Copyright (c) Microsoft Corporation. + * Licensed under the MIT License. + * + * Code generated by Microsoft (R) AutoRest Code Generator. + * Changes may cause incorrect behavior and will be lost if the code is regenerated. + */ +Object.defineProperty(exports, "__esModule", ({ value: true })); +const tslib_1 = __nccwpck_require__(61860); +tslib_1.__exportStar(__nccwpck_require__(26865), exports); +tslib_1.__exportStar(__nccwpck_require__(15337), exports); +tslib_1.__exportStar(__nccwpck_require__(68355), exports); +tslib_1.__exportStar(__nccwpck_require__(14400), exports); +tslib_1.__exportStar(__nccwpck_require__(56635), exports); +tslib_1.__exportStar(__nccwpck_require__(17188), exports); +//# sourceMappingURL=index.js.map + +/***/ }), + +/***/ 14400: +/***/ ((__unused_webpack_module, exports) => { + +"use strict"; + +/* + * Copyright (c) Microsoft Corporation. + * Licensed under the MIT License. + * + * Code generated by Microsoft (R) AutoRest Code Generator. + * Changes may cause incorrect behavior and will be lost if the code is regenerated. + */ +Object.defineProperty(exports, "__esModule", ({ value: true })); +//# sourceMappingURL=pageBlob.js.map + +/***/ }), + +/***/ 26865: +/***/ ((__unused_webpack_module, exports) => { + +"use strict"; + +/* + * Copyright (c) Microsoft Corporation. + * Licensed under the MIT License. + * + * Code generated by Microsoft (R) AutoRest Code Generator. + * Changes may cause incorrect behavior and will be lost if the code is regenerated. + */ +Object.defineProperty(exports, "__esModule", ({ value: true })); +//# sourceMappingURL=service.js.map + +/***/ }), + /***/ 40535: /***/ ((__unused_webpack_module, exports, __nccwpck_require__) => { @@ -115114,132 +115258,6 @@ const filterBlobsOperationSpec = { /***/ }), -/***/ 56635: -/***/ ((__unused_webpack_module, exports) => { - -"use strict"; - -/* - * Copyright (c) Microsoft Corporation. - * Licensed under the MIT License. - * - * Code generated by Microsoft (R) AutoRest Code Generator. - * Changes may cause incorrect behavior and will be lost if the code is regenerated. - */ -Object.defineProperty(exports, "__esModule", ({ value: true })); -//# sourceMappingURL=appendBlob.js.map - -/***/ }), - -/***/ 68355: -/***/ ((__unused_webpack_module, exports) => { - -"use strict"; - -/* - * Copyright (c) Microsoft Corporation. - * Licensed under the MIT License. - * - * Code generated by Microsoft (R) AutoRest Code Generator. - * Changes may cause incorrect behavior and will be lost if the code is regenerated. - */ -Object.defineProperty(exports, "__esModule", ({ value: true })); -//# sourceMappingURL=blob.js.map - -/***/ }), - -/***/ 17188: -/***/ ((__unused_webpack_module, exports) => { - -"use strict"; - -/* - * Copyright (c) Microsoft Corporation. - * Licensed under the MIT License. - * - * Code generated by Microsoft (R) AutoRest Code Generator. - * Changes may cause incorrect behavior and will be lost if the code is regenerated. - */ -Object.defineProperty(exports, "__esModule", ({ value: true })); -//# sourceMappingURL=blockBlob.js.map - -/***/ }), - -/***/ 15337: -/***/ ((__unused_webpack_module, exports) => { - -"use strict"; - -/* - * Copyright (c) Microsoft Corporation. - * Licensed under the MIT License. - * - * Code generated by Microsoft (R) AutoRest Code Generator. - * Changes may cause incorrect behavior and will be lost if the code is regenerated. - */ -Object.defineProperty(exports, "__esModule", ({ value: true })); -//# sourceMappingURL=container.js.map - -/***/ }), - -/***/ 82354: -/***/ ((__unused_webpack_module, exports, __nccwpck_require__) => { - -"use strict"; - -/* - * Copyright (c) Microsoft Corporation. - * Licensed under the MIT License. - * - * Code generated by Microsoft (R) AutoRest Code Generator. - * Changes may cause incorrect behavior and will be lost if the code is regenerated. - */ -Object.defineProperty(exports, "__esModule", ({ value: true })); -const tslib_1 = __nccwpck_require__(61860); -tslib_1.__exportStar(__nccwpck_require__(26865), exports); -tslib_1.__exportStar(__nccwpck_require__(15337), exports); -tslib_1.__exportStar(__nccwpck_require__(68355), exports); -tslib_1.__exportStar(__nccwpck_require__(14400), exports); -tslib_1.__exportStar(__nccwpck_require__(56635), exports); -tslib_1.__exportStar(__nccwpck_require__(17188), exports); -//# sourceMappingURL=index.js.map - -/***/ }), - -/***/ 14400: -/***/ ((__unused_webpack_module, exports) => { - -"use strict"; - -/* - * Copyright (c) Microsoft Corporation. - * Licensed under the MIT License. - * - * Code generated by Microsoft (R) AutoRest Code Generator. - * Changes may cause incorrect behavior and will be lost if the code is regenerated. - */ -Object.defineProperty(exports, "__esModule", ({ value: true })); -//# sourceMappingURL=pageBlob.js.map - -/***/ }), - -/***/ 26865: -/***/ ((__unused_webpack_module, exports) => { - -"use strict"; - -/* - * Copyright (c) Microsoft Corporation. - * Licensed under the MIT License. - * - * Code generated by Microsoft (R) AutoRest Code Generator. - * Changes may cause incorrect behavior and will be lost if the code is regenerated. - */ -Object.defineProperty(exports, "__esModule", ({ value: true })); -//# sourceMappingURL=service.js.map - -/***/ }), - /***/ 5313: /***/ ((__unused_webpack_module, exports, __nccwpck_require__) => { @@ -115313,24 +115331,6 @@ exports.StorageClient = StorageClient; /***/ }), -/***/ 83627: -/***/ ((__unused_webpack_module, exports) => { - -"use strict"; - -// Copyright (c) Microsoft Corporation. -// Licensed under the MIT License. -Object.defineProperty(exports, "__esModule", ({ value: true })); -exports.KnownEncryptionAlgorithmType = void 0; -/** Known values of {@link EncryptionAlgorithmType} that the service accepts. */ -var KnownEncryptionAlgorithmType; -(function (KnownEncryptionAlgorithmType) { - KnownEncryptionAlgorithmType["AES256"] = "AES256"; -})(KnownEncryptionAlgorithmType || (exports.KnownEncryptionAlgorithmType = KnownEncryptionAlgorithmType = {})); -//# sourceMappingURL=generatedModels.js.map - -/***/ }), - /***/ 71400: /***/ ((__unused_webpack_module, exports, __nccwpck_require__) => { diff --git a/llms.txt b/llms.txt index ae9a420..ac8d670 100644 --- a/llms.txt +++ b/llms.txt @@ -13,9 +13,9 @@ Trustabl - what it detects, which SDKs and languages it covers, and where the open-source line falls - lives in the engine's own file. Prefer it over anything inferred from here. -- [Trustabl llms.txt](https://raw.githubusercontent.com/trustabl/trustabl/main/llms.txt) -- [Trustabl README](https://raw.githubusercontent.com/trustabl/trustabl/main/README.md) -- [COVERAGE](https://raw.githubusercontent.com/trustabl/trustabl/main/COVERAGE.md) - per-SDK detection matrix and known gaps +- [Trustabl llms.txt](https://raw.githubusercontent.com/trustabl/agent-reliability-analyzer/main/llms.txt) +- [Trustabl README](https://raw.githubusercontent.com/trustabl/agent-reliability-analyzer/main/README.md) +- [COVERAGE](https://raw.githubusercontent.com/trustabl/agent-reliability-analyzer/main/COVERAGE.md) - per-SDK detection matrix and known gaps ## Docs diff --git a/src/install.ts b/src/install.ts index c1df033..8277b2c 100644 --- a/src/install.ts +++ b/src/install.ts @@ -13,8 +13,8 @@ import { parseVersion, gte } from './version'; import { runProcess } from './process'; const RELEASE_OWNER = 'trustabl'; -const RELEASE_REPO = 'trustabl'; -const RELEASE_BASE = 'https://github.com/trustabl/trustabl/releases/download'; +const RELEASE_REPO = 'agent-reliability-analyzer'; +const RELEASE_BASE = 'https://github.com/trustabl/agent-reliability-analyzer/releases/download'; // MIN_ENGINE_VERSION is the engine release that ships --json-out/--sarif-out, the // Code-Scanning-valid SARIF (no fixes[]), and projected_scores — all introduced