fix(action): bind installer to CLI v1

.github/CODEOWNERS

@@ -0,0 +1,4 @@
+* @metalagman
+
+/.github/ @metalagman
+/action.yml @metalagman

.github/ISSUE_TEMPLATE/bug.yml

@@ -0,0 +1,25 @@
+name: Bug report
+description: Report a reproducible action defect
+title: "bug: "
+labels: [bug]
+body:
+  - type: textarea
+    id: behavior
+    attributes:
+      label: Observed behavior
+    validations:
+      required: true
+  - type: textarea
+    id: reproduce
+    attributes:
+      label: Minimal workflow and logs
+      description: Remove credentials and private source before posting.
+    validations:
+      required: true
+  - type: input
+    id: version
+    attributes:
+      label: Action reference
+      placeholder: diffpal/action@v1 or commit SHA
+    validations:
+      required: true

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,5 @@
+blank_issues_enabled: true
+contact_links:
+  - name: Security report
+    url: https://github.com/diffpal/action/security/advisories/new
+    about: Report vulnerabilities privately.

.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,9 @@
+## Summary
+
+<!-- What changes, why, and which dp- issue tracks it? -->
+
+## Validation
+
+- [ ] The action smoke and staged CLI contract tests pass.
+- [ ] Input, output, and compatibility changes are documented.
+- [ ] Security and secret-handling impact has been considered.

.github/workflows/ci.yml

@@ -9,6 +9,26 @@ jobs:
   smoke:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
       - name: Smoke test action scripts
         run: bash scripts/smoke-test.sh
+
+      - name: Check out DiffPal CLI contract
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+        with:
+          repository: diffpal/diffpal
+          ref: develop
+          path: .tmp/diffpal
+
+      - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6
+        with:
+          go-version-file: .tmp/diffpal/go.mod
+
+      - name: Build staged DiffPal CLI
+        working-directory: .tmp/diffpal
+        run: go build -o "$RUNNER_TEMP/diffpal" ./cmd/diffpal
+
+      - name: Verify CLI v1 contract
+        env:
+          DIFFPAL_BIN: ${{ runner.temp }}/diffpal
+        run: bash scripts/contract-test.sh

README.md

@@ -18,7 +18,7 @@ the review flow stays the same.
 First generate and commit a DiffPal config:
 
 ```bash
-npx -y @diffpal/diffpal@latest init --wizard --setup codex-api-key --platform github
+npx -y @diffpal/diffpal@1.0.0 init --wizard --setup codex-api-key --platform github
 ```
 
 This creates `.config/diffpal/config.yaml` with a visible `ci` profile. Existing
@@ -87,7 +87,7 @@ they configure.
 | Input | Default | Use |
 | --- | --- | --- |
 | `install` | `true` | Install `@diffpal/diffpal` before review. |
-| `diffpal-version` | `latest` | npm version or dist-tag. Pin for reproducible CI. |
+| `diffpal-version` | `1` | npm version or dist-tag. Use an exact v1 release for reproducible CI. |
 | `diffpal-path` | `diffpal` | Existing binary path. Custom paths skip install. |
 
 ### Config Selection

SECURITY.md

@@ -0,0 +1,11 @@
+# Security Policy
+
+Security fixes are provided for the latest released major version.
+
+Do not open a public issue for a suspected vulnerability. Report it through
+[GitHub private vulnerability reporting](https://github.com/diffpal/action/security/advisories/new)
+with reproduction steps and impact. We aim to acknowledge reports within three
+business days and coordinate remediation and disclosure with the reporter.
+
+Issues in the DiffPal CLI itself should be reported to the
+[core repository](https://github.com/diffpal/diffpal/security/advisories/new).

action.yml

@@ -12,7 +12,7 @@ inputs:
   diffpal-version:
     description: npm version or dist-tag for @diffpal/diffpal. Use an exact version for reproducible CI.
     required: false
-    default: latest
+    default: "1"
   diffpal-path:
     description: Path to an existing diffpal binary. Custom paths skip automatic installation.
     required: false

scripts/contract-test.sh

@@ -0,0 +1,28 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+diffpal_bin="${DIFFPAL_BIN:?DIFFPAL_BIN is required}"
+help="$($diffpal_bin review github --help)"
+
+for flag in \
+  --base \
+  --head \
+  --profile \
+  --block-on \
+  --gate \
+  --feedback \
+  --summary-overview \
+  --out \
+  --repo \
+  --review-id \
+  --review-channel \
+  --language \
+  --instructions \
+  --instructions-file; do
+  if ! grep -Fq -- "$flag" <<<"$help"; then
+    echo "DiffPal CLI contract is missing $flag" >&2
+    exit 1
+  fi
+done
+
+echo "DiffPal CLI v1 contract passed"

scripts/install-diffpal.sh

@@ -14,7 +14,7 @@ truthy() {
 
 install_requested="${INPUT_INSTALL:-true}"
 diffpal_path="${INPUT_DIFFPAL_PATH:-diffpal}"
-version="${INPUT_DIFFPAL_VERSION:-latest}"
+version="${INPUT_DIFFPAL_VERSION:-1}"
 
 if [[ "$diffpal_path" != "diffpal" ]]; then
   echo "Using custom diffpal-path: $diffpal_path"
@@ -36,7 +36,7 @@ fi
 install_root="${RUNNER_TEMP:-/tmp}/diffpal-action"
 mkdir -p "$install_root"
 
-npm install --global --prefix "$install_root" "@diffpal/diffpal@$version" --omit=dev --no-audit --no-fund
+npm install --global --prefix "$install_root" "@diffpal/diffpal@$version" --omit=dev --ignore-scripts --no-audit --no-fund
 
 diffpal_bin="$install_root/bin/diffpal"
 if [[ ! -x "$diffpal_bin" ]]; then

scripts/smoke-test.sh

@@ -97,9 +97,48 @@ SCRIPT
     "$repo_root/scripts/install-diffpal.sh"
 
   assert_contains "$npm_args" "@diffpal/diffpal@0.1.2"
+  assert_contains "$npm_args" "--ignore-scripts"
   assert_contains "$github_env" "DIFFPAL_BIN=$runner_temp/diffpal-action/bin/diffpal"
 }
 
+test_installer_defaults_to_cli_v1() {
+  local dir="$1"
+  local fake_bin="$dir/fake-bin"
+  local runner_temp="$dir/runner"
+  local github_env="$dir/github-env"
+  local npm_args="$dir/npm-args"
+  mkdir -p "$fake_bin" "$runner_temp"
+
+  cat > "$fake_bin/npm" <<'SCRIPT'
+#!/usr/bin/env bash
+printf '%s\n' "$@" > "$NPM_ARGV_FILE"
+prefix=""
+while [[ "$#" -gt 0 ]]; do
+  if [[ "$1" == "--prefix" ]]; then
+    prefix="$2"
+    shift 2
+    continue
+  fi
+  shift
+done
+mkdir -p "$prefix/bin"
+printf '#!/usr/bin/env bash\nexit 0\n' > "$prefix/bin/diffpal"
+chmod +x "$prefix/bin/diffpal"
+SCRIPT
+  chmod +x "$fake_bin/npm"
+
+  PATH="$fake_bin:$PATH" \
+    RUNNER_TEMP="$runner_temp" \
+    GITHUB_ENV="$github_env" \
+    NPM_ARGV_FILE="$npm_args" \
+    INPUT_INSTALL=true \
+    INPUT_DIFFPAL_PATH=diffpal \
+    "$repo_root/scripts/install-diffpal.sh"
+
+  assert_contains "$npm_args" "@diffpal/diffpal@1"
+  assert_contains "$npm_args" "--ignore-scripts"
+}
+
 test_installer_selects_custom_path() {
   local dir="$1"
   local github_env="$dir/github-env-custom"
@@ -250,6 +289,7 @@ tmpdir="$(mktemp -d)"
 trap 'rm -rf "$tmpdir"' EXIT
 
 test_installer_installs_requested_version "$tmpdir/install"
+test_installer_defaults_to_cli_v1 "$tmpdir/default-v1"
 test_installer_selects_custom_path "$tmpdir/custom"
 test_installer_selects_path_when_install_disabled "$tmpdir/disabled"
 test_wrapper_uses_installed_binary_and_feedback "$tmpdir/wrapper-installed"