feat(action): v2.11.0 Core Baseline Alignment to v0.27.0

.bumpversion.toml

@@ -2,7 +2,7 @@
 # SPDX-License-Identifier: Apache-2.0
 
 [tool.bumpversion]
-current_version = "2.10.4"
+current_version = "2.11.0"
 parse = "(?P<major>\\d+)\\.(?P<minor>\\d+)\\.(?P<patch>\\d+)"
 serialize = ["{major}.{minor}.{patch}"]
 
@@ -47,4 +47,4 @@ replace = '''| `{new_version}` (current) | ✅ All security fixes |
 # bump-my-version does NOT manage these files; they are listed here for discoverability.
 # ---------------------------------------------------------------------------
 [tool.bumpversion.custom_variables.core_version]
-current = "0.26.5"
+current = "0.27.0"

CHANGELOG.md

@@ -9,138 +9,223 @@ All notable changes to zenzic-action are documented in this file. The project ad
 
 ## [Unreleased]
 
+*No notable changes pending.*
+
+## [2.11.0] - 2026-08-02
+
+- **Core Baseline Alignment**: Realigned default pinned Zenzic Core dependency to `0.27.0`.
+- **Baseline & Regression Tracking**: Added documentation and example workflows for `--baseline .zenzic-baseline.json` and `--update-baseline`.
+- **New Rule Diagnostic Support**: Automatic SARIF upload and PR annotations for new `Z4xx` (Smart Link Graph), `Z5xx` (Semantic Linting), and `Z1xx` (Configuration Engine) rules.
+
 ## [2.10.4] - 2026-07-29
 
+Patch release — Zenzic Core dependency realignment.
+
 ### Fixed
+
 - **Core Baseline Alignment**: Realigned pinned Zenzic Core dependency to `0.26.5`.
 
 ## [2.10.3] - 2026-07-28
 
+Patch release — Zenzic Core dependency realignment.
+
 ### Fixed
+
 - **Core Baseline Alignment**: Realigned pinned Zenzic Core dependency to `0.26.3`.
 
 ## [2.10.2] - 2026-07-28
 
+Patch release — Zenzic Core dependency realignment with critical URP fixes.
+
 ### Fixed
+
 - **Core Baseline Alignment**: Realigned pinned Zenzic Core dependency to `0.26.2`, integrating critical URP unification and static asset resolution fixes.
 
 ## [2.10.1] - 2026-07-26
 
+Dependency pin update.
+
 ### Changed
 
 - **Dependencies**: Pinned Zenzic Core dependency to version `0.25.3`, inheriting fixes for Zensical framework static asset mapping and PolyglotExtractor AST reference link definition extraction (`CORE-FIX-001`).
 
 
 ## [2.10.0] - 2026-07-25
 
+- *No notable changes. Internal version bump.*
+
 ## [2.9.1] - 2026-07-22
 
+Patch release — strict Zenzic Core dependency pin.
+
 ### Changed
+
 - **Dependencies**: Strictly pinned Zenzic Core dependency to version `0.23.1` (`zenzic == 0.23.1` @ SHA `67b4ee3632681065b304891ef388b99010d999bf`), deploying LSP `codeDescription` links and `[{code}]` diagnostic message prefixing per ADR-089 / ADR-090.
 
 ## [2.9.0] - 2026-07-18
 
+Minor release — incremental VSM validation and Radical Unawareness compliance.
+
 ### Changed
+
 - **Dependencies**: Pinned Zenzic core dependency to version `0.23.0` (introduces `ZenzicDiagnostic` strict typing, incremental VSM validation via `IncrementalAnalysisEngine`, `VirtualBufferOverlay` reverse index, and ADR-075 Radical Unawareness compliance in the Language Server).
 
 ## [2.8.3] - 2026-07-14
 
+Patch release — Zenzic Core dependency pin restoring diagnostic parity.
+
 ### Changed
+
 - **Dependencies**: Pinned Zenzic core dependency to version `0.22.3` (restoring 100% diagnostic parity and URP strict ordering).
 
 ## [2.8.2] - 2026-07-14
 
+- *No notable changes. Internal version bump.*
+
 ## [2.8.1] - 2026-07-14
 
+- *No notable changes. Internal version bump.*
+
 ## [2.8.0] - 2026-07-12
 
+Minor release — Real-Time Virtual Site Map (VSM) integration.
+
 ### Added
+
 - **Core Update**: Pinned Zenzic core dependency to version `0.22.0` (introduces Real-Time Virtual Site Map (VSM) integration and O(1) incremental patching to the Language Server).
 
 ## [2.7.1] - 2026-07-11
 
+- *No notable changes. Internal version bump.*
+
 ## [2.7.0] - 2026-07-11
 
+- *No notable changes. Internal version bump.*
+
 ## [2.6.2] - 2026-07-05
 
+Patch release — English-only governance alignment.
+
 ### Changed
+
 - **Dependencies**: Pinned Zenzic core dependency to version `0.20.3` (eradicates Z602 bilingual parity rules/fixtures, and aligns with English-Only documentation governance).
 
 ## [2.6.1] - 2026-07-04
 
+Patch release — dark mode restoration and Z603 Dead Suppression paradox fix.
+
 ### Changed
+
 - **Dependencies**: Pinned Zenzic core dependency to version `0.20.1` (restores slate-based dark mode and resolves Z603 Dead Suppression paradox).
 
 ## [2.6.0] - 2026-07-04
 
+Minor release — Custom Rules API v2 and auto-fix expansion.
+
 ### Added
+
 - **Core Update**: Bumped Zenzic core dependency to `>=0.20.0` (introduces Custom Rules API v2, deterministic visitation sandbox, and auto-fix expansion for Z121 and Z603).
 
 ### Changed
+
 - **Dependencies**: Pinned Zenzic core to `0.20.0`.
 
 ## [2.5.2] - 2026-07-04
 
+Security patch — critical vulnerability mitigations in Zenzic Core.
+
 ### 🔒 Security Advisory
+
 - **Core Update**: Bumped Zenzic core dependency to `>=0.19.6` to mitigate the DQS Evasion (leading space bypass), TOML Bomb crash, and duplicate suppression consumption vulnerabilities.
 
 ### Changed
+
 - **Dependencies**: Pinned Zenzic core to `0.19.6`.
 - **Automation**: Fixed the `pin-core` recipe in the `justfile` to correctly align the core pin in `action.yml`.
 
 ## [2.5.1] - 2026-07-03
 
+Security patch — Z205 Forbidden Scheme bypass vulnerability fix.
+
 ### 🔒 Security Advisory
+
 - **Core Update**: Bumped Zenzic core dependency to `>=0.19.3` to mitigate the `Z205` (Forbidden Scheme) security gate bypass vulnerability (Double Href & Encoding Evasion).
 
 ### Changed
+
 - **Dependencies**: Pinned Zenzic core to `0.19.3` to restore the deterministic execution environment.
 
 ## [2.5.0] - 2026-07-01
 
+- *No notable changes. Internal version bump.*
+
 ## [2.4.0] - 2026-06-28
 
+Minor release — Nuclear Static compliance and automated release pipeline.
+
 ### Changed
+
 - **Core Update**: Pinned Zenzic core dependency to version `0.18.0` for full "Nuclear Static" compliance.
 - **Automation**: Fully automated the release pipeline, synchronizing `bump-my-version` across `SECURITY.md`, `RELEASE.md`, `CHANGELOG.md`, and `CONTRIBUTING.md` to eliminate manual drift.
 
 ## [2.3.1] - 2026-06-27
 
+Patch release — SourceRank visibility and ecosystem gate improvements.
+
 ### Added
+
 - **SourceRank Visibility**: Added `requirements.txt` to expose Zenzic core dependency to ecosystem crawlers.
 - **Ecosystem Gate**: Upgraded `just versions` to perform parity validation between `action.yml` and `requirements.txt`.
 
 ### Changed
+
 - **Perimeter Hygiene**: Added `requirements.txt` to `excluded_file_patterns` in `.zenzic.toml` to prevent `Z405` violations.
 - **Automation**: Updated `just pin-core` to propagate Zenzic core pins to `requirements.txt`.
 
 ## [2.3.0] - 2026-06-27
 
+Patch release — pull request governance modernisation.
+
 ### Changed
+
 - **Governance**: Modernized pull request template for English-only python ecosystem.
 
 ## [2.2.2] - 2026-06-23
 
+Patch release — Zenzic Core dependency pin.
+
 ### Changed
+
 - **Dependencies**: Pinned Zenzic core to `0.15.1`.
 
 ## [2.2.1] - 2026-06-21
 
+Patch release — SARIF info-level findings count fix.
+
 ### Fixed
+
 - **SARIF**: Filtered out info-level notes from SARIF findings count.
 
 ## [2.2.0] - 2026-06-21
 
+Minor release — Zenzic Core engine upgrade to v0.15.0.
+
 ### Changed
+
 - **Engine Upgrade**: Upgraded Zenzic Core to `v0.15.0`.
 
 ## [2.1.1] - 2026-06-21
 
+Patch release — compatibility adjustments and version bumps.
+
 ### Fixed
+
 - **Core Update**: Compatibility adjustments and version bumps.
 
 ## [2.1.0] - 2026-06-21
 
+Breaking minor release — dropped Docusaurus support, action bumped to v2.
+
 ### Changed (Breaking)
 
 - **Dropped Docusaurus Support**: Upgraded the pinned Zenzic Core to `v0.13.0`, which surgically eradicates the Docusaurus adapter due to ontological incompatibility (React-injected IDs and MDX partial merging). Projects still relying on Docusaurus MUST remain on the `v1` floating tag (`v1.3.x`).

CONTRIBUTING.md

@@ -16,7 +16,7 @@ Thank you for contributing to the official GitHub Action for Zenzic!
 Zenzic is structured across three independent, dedicated repositories:
 
 | Repository | Purpose | Primary Stack |
-|:---|:---|:---|
+| :--- | :--- | :--- |
 | **[zenzic](https://github.com/PythonWoods/zenzic)** | Python Core analysis engine & CLI (`src/zenzic`) | Python 3.10+, `uv`, `pytest`, `mypy` |
 | **[zenzic-vscode](https://github.com/PythonWoods/zenzic-vscode)** | Official VS Code Extension (LSP Thin Client) | TypeScript, Node.js 24+, VS Code API |
 | **[zenzic-action](https://github.com/PythonWoods/zenzic-action)** (this repo) | Official GitHub Action CI/CD Wrapper | YAML, Bash, SARIF Upload |
@@ -95,11 +95,14 @@ Both must pass with zero errors before opening or updating a PR.
 
 ## Maintainer Only: Workflow Hardening & Release Procedure
 
+The following procedures are reserved for repository maintainers with release permissions. They must be executed in the documented sequence to preserve ecosystem integrity.
+
 ### Immutable Pre-Commit Hooks (ADR-089)
 
 All `rev:` keys in `.pre-commit-config.yaml` must point to an **immutable commit hash pin**, never to a semantic tag (`v1.2.3`).
 
 Updating pinned hooks:
+
 ```bash
 uvx pre-commit autoupdate --freeze
 ```
@@ -122,3 +125,7 @@ just audit-release
 # 5. Push commit and tag
 git push && git push --tags
 ```
+
+---
+
+See also: [README](README.md)

README.md

@@ -59,7 +59,7 @@ The minimal configuration — zero Python setup, SARIF to Code Scanning in one s
 - name: Run Zenzic Documentation Quality Gate
   uses: PythonWoods/zenzic-action@v2
   with:
-    version: "0.26.5"
+    version: "0.27.0"
     format: sarif
     upload-sarif: "true"
   permissions:
@@ -71,7 +71,6 @@ Place a `.zenzic.toml` at the root of your repository and the action picks it up
 
 For advanced configuration (Configuration Discovery, Sovereign Override, Quality Gate scoring, nightly audit), see the [Zenzic Action docs](https://zenzic.dev/docs/reference/zenzic-action).
 
-
 ---
 
 ## 🔍 Visual Feedback
@@ -86,7 +85,10 @@ Zenzic Action surfaces findings directly where you work — no digging through C
 
 ## Integration Blueprints
 
+The following ready-to-use GitHub Actions workflow templates cover the four primary integration patterns for `zenzic-action`.
+
 ### 1. Baseline Check (SAST & Topology Verification)
+
 This blueprint provides static application security testing (SAST), link validation, and graph topology verification. It executes during pushes and PRs, ensuring no broken links, credential leaks, or invalid configurations enter the repository.
 
 ```yaml
@@ -114,6 +116,7 @@ jobs:
 ```
 
 ### 2. Security Hardening (SARIF + Upload Integration)
+
 This blueprint runs a security-hardened gate. It executes the secret scanner (`guard-scan`) to catch exposed credentials and path traversals, then uploads the SARIF report directly to the GitHub Code Scanning Security tab.
 
 ```yaml
@@ -145,6 +148,7 @@ jobs:
 ```
 
 ### 3. PR Governance (Inline Annotations & DQS Tracking)
+
 This blueprint implements pull-request governance. It downloads the DQS baseline from the default branch, runs the quality gate comparison, maps issues to inline annotations, and publishes a summary of the Document Quality Score (DQS) to the workflow run.
 
 ```yaml
@@ -173,6 +177,7 @@ jobs:
 ```
 
 ### 4. Sovereign Nightly Audit (Full Unfiltered Audit)
+
 Runs an unsuppressed audit on schedule, reporting hidden technical debt directly to Code Scanning.
 
 ```yaml
@@ -207,7 +212,7 @@ jobs:
 
 | Input | Default | Description |
 |:---|:---|:---|
-| `version` | `0.26.5` | Zenzic Core version to execute. Pin to a specific release (e.g. `0.25.0`) for reproducible CI. |
+| `version` | `0.27.0` | Zenzic Core version to execute. Pin to a specific release (e.g. `0.25.0`) for reproducible CI. |
 
 | `format` | `"text"` | Output format: `text`, `json`, or `sarif` |
 | `upload-sarif` | `"false"` | Automatically upload SARIF output to GitHub Code Scanning |

RELEASE.md

@@ -6,17 +6,17 @@
 
 | Field   | Value      |
 | :------ | :--------- |
-| Version | v2.10.4 |
-| Date    | 2026-07-29 |
+| Version | v2.11.0    |
+| Date    | 2026-08-02 |
 | Status  | Stable     |
 
 ## Release Checklist
 
 Before tagging, every item must be green:
 
-- [ ] `action.yml` — `default:` pin updated to the latest Zenzic core version (`0.26.5`)
-- [ ] `package.json` version bumped to `2.10.4`
-- [ ] `pyproject.toml` — synchronized with core pin (`zenzic==0.26.5`)
+- [ ] `action.yml` — `default:` pin updated to the latest Zenzic core version (`0.27.0`)
+- [ ] `package.json` version bumped to `2.11.0`
+- [ ] `pyproject.toml` — synchronized with core pin (`zenzic==0.27.0`)
 - [ ] `just versions` — returns `✅ Ecosystem alignment verified.`
 - [ ] `just verify` — exits 0
 - [ ] `zenzic check .` — zero findings (DQS 100/100)
@@ -43,15 +43,15 @@ git checkout main
 git pull origin main
 
 # 7. Create the release tag and push
-git tag -s -m "Release v2.10.4" v2.10.4
-git push origin v2.10.4
+git tag -s -m "Release v2.11.0" v2.11.0
+git push origin v2.11.0
 
 # 8. Move the floating v2 tag to the new release:
-git tag -s -fa v2 v2.10.4^{} -m "release: v2.10.4"
+git tag -s -fa v2 v2.11.0^{} -m "release: v2.11.0"
 git push origin v2 --force
 
 # Verification (Atomic Parity Check):
-git rev-parse v2^{} v2.10.4^{}
+git rev-parse v2^{} v2.11.0^{}
 # SUCCESS: Both hashes must be identical.
 ```