Installs threatcrush-scan@1.1.0 from the sh1pt Actions Store.
Scans pull requests for hardcoded credentials, injection, SSRF, unsafe
deserialisation and dependency tampering; uploads SARIF to the Security
tab.
Report-only — it will not fail a pull request. Set the pack's failOn
input to critical,high once the existing findings are triaged.
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
The 'test' workflow ran 'npm test' without building, so dependents could not
resolve @logicsrc/plugin-core / @logicsrc/validators (they publish from dist/).
Build first. Also document PUBLIC_URL (canonical site URL) in .env.example.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
