0.1.19: the comparison travels with the report

--against scored two trees and then threw one of them away. The movement is the whole point of a ratchet, and anything reading the JSON had to score the base itself to find it — work this command had already done.

The report now carries against: the ref, its category scores, and its line count.

cqx as an action, and an installer instead of a filename

deka already had a cqx workflow and its download was broken: it asks for cqx-linux-x86_64, which the release renamed to cqx-linux-x64 at v0.1.15. Both its jobs fail on that, and have been.

The pull request job becomes two lines. The publish job stops naming the binary it wants and uses the installer, which picks the right one for the runner and checks it against the sums published beside it.

Reporting only to begin with: a gate that fails the author teaches the author to turn it off.

Score deka with cqx on every pull request

Reporting only to begin with: a gate that fails people before anybody has agreed what the number should be teaches them to turn it off.

On a pull request it scores the branch, scores the commit the branch is based on, and says what moved. Findings go to code scanning, so each one lands on its own line in Files changed.

Score zega with cqx on every pull request

Reporting only to begin with: a gate that fails people before anybody has agreed what the number should be teaches them to turn it off.

On a pull request it scores the branch, scores the commit the branch is based on, and says what moved. Findings go to code scanning, so each one lands on its own line in Files changed.

cqx as an action, and an installer instead of a filename

The pull request job was fifty lines of bash and python doing what the action now does in two: score the branch, score its base, say what moved, and put each finding on its own line in Files changed. Reporting only to begin with — dsc's score moves every day, and a gate that fails the author teaches the author to turn it off.

The publish job stops naming the binary it wants. That is what broke: the release renamed cqx-linux-x86_64 to cqx-linux-x64 at v0.1.15 and this went on asking for a file that no longer exists. The installer picks the right one for the runner and checks it against the sums published beside it.

Claude-Session: https://claude.ai/code/session_01XHuN9xFKcoJaoTJfBwxsb1

Score cqx with cqx

The tool has to hold its own standard before it is worth asking anybody else to, and this is where the action is proved: if it breaks, it breaks here first.

Reporting only, for now. cqx is being written quickly and its own score moves every day; a gate that fails the author of the gate teaches the author to turn it off.

0.1.18

cqx scan --report, and a --min-score that is actually read

Two things the action found by trying to use them.

--min-score was registered by cqx score and silently ignored by cqx scan: the floor is read out of the resolved configuration, and nothing was putting the flag there. It is now applied to the report rather than carried beside it, so the gate, the summary and anything reading the JSON all see the same number.

--report <file> writes the whole report as JSON as well as everything else, because the action wanted the numbers and the human output from one run. It was scoring the tree twice to get both — twice the time, and two answers that could disagree.

Both are written before the gate decides. A run that was refused is exactly the one somebody wants the numbers from.

0.1.17: cqx scan, and an installer that finds the right binary

The front page has always shown cqx scan. There was no such command — the name was an undocumented alias for extract, so cqx scan . printed a fact stream, and the registry accepted a second command by that name without a word. Now it is the command the page promised: read a tree, score it, and say whether it may merge.

Nothing here is new analysis. It is the same extractor, the same scorer and the same report, held in memory rather than written to a file between the two — the only reason that file existed is that two commands cannot hand each other a value.

It can refuse a merge two ways. --min-score is a floor, which a team sets once and mostly passes. --against <ref> is a ratchet: score the branch, score what it will merge into, refuse anything that makes a category worse. The ref is materialised into a scratch directory rather than checked out, because a CI job's working tree is the thing being measured and moving HEAD under it corrupts the run.

--sarif writes the findings where GitHub shows them on the line they are on, which is somewhere other than a pull request comment nobody reads. Levels come from what a rule actually cost here rather than from its weight: the weights are close enough that mapping them directly made every finding an error, which is the same as having no levels at all.

--summary writes the Markdown a job summary renders, scores and movement only — the findings are already on their lines.

The installer picks the binary for the machine it is running on and takes it from the release bucket, now served at releases.cqx.bio. Not the GitHub API: sixty requests an hour per address is a ceiling a shared CI runner can reach without ever having heard of this project.

0.1.16

The rule card needs two fields from the scorer, so the scorer has to ship before the card can show them: every rule names its language, and every finding names the item it sits inside.