release: 2.0.0 (#13)

* release: 2.0.0

Two things had to land before the meaning of anything froze at stable.

AGF002 carried two unrelated meanings: "configuration file not found" and
"the repository scan stopped early". Different problems, different severities,
and one code. The consequences were user-facing, not cosmetic: `agentfile rule
AGF002` explained the wrong problem, a SARIF ruleId mislabelled it, and a
`severity: AGF002: off` written to quiet truncation noise also silenced
genuine missing-file errors. Truncation is now AGF006. Codes are append-only,
so after 2.0.0 this would have been permanent.

The existing test asserted the word "truncated" appeared in the message, which
is exactly why the overload survived unnoticed. It now pins the code, and a
second test asserts truncation is never reported as AGF002.

The other thing is the release itself. `latest` pointed at the v1 CLI for the
whole beta, so all eighty `npx @agentfile/cli` commands in the README failed
for anyone who followed them — the first one with `error: unknown command
'doctor'`. Publishing 2.0.0 to `latest` is what fixes that, and it is why the
Action's `version` default moves from `next` to `latest` in the same commit.

Verified: AGF006 end to end through discover, JSON and SARIF, with AGF002 no
longer emitted for truncation; the release workflow's own gate simulated green
(three manifests at 2.0.0, CHANGELOG section present, classified stable so it
publishes to `latest`); build, typecheck, lint unchanged from baseline, 930
tests.

* fix(action): a SARIF log we cannot parse is not a clean scan

Flipping the version default to `latest` in the release commit was premature:
`latest` is the v1 CLI until 2.0.0 actually publishes, so the action's own
tests ran a CLI with no `check` and no `--format sarif`. Default back to
`next`; it flips after the tag, when `latest` means what the default claims.

That mistake exposed a real bug worth keeping. v1 exited 1, which the action
read as "findings", wrote an empty file, and reported sarif-file=agentfile.sarif
with findings=0 — a broken scan indistinguishable from a clean one, until
upload-sarif rejected it:

  ##[error]Invalid SARIF. JSON syntax error: Unexpected end of JSON input

The counting snippet had `catch {}` around the parse, which swallowed exactly
this. It now requires a SARIF 2.1.0 log with a results array, and treats
anything else as exit 2 — the tool could not run — with sarif-file left empty
so an `if: always()` upload step skips rather than uploads rubbish.

Verified both ways locally: pinning version to 0.4.0 now exits 2 with
"Version '0.4.0' may not support --format sarif", and the normal path still
exits 0 with findings=1 and a valid log.

---------

Co-authored-by: Dennis Havermans <dennis.havermans@ae.be>

Author: dennishavermans

CHANGELOG.md

@@ -9,6 +9,46 @@ Versioning follows [Semantic Versioning](https://semver.org/).
 
 ## [Unreleased]
 
+## [2.0.0] — 2026-08-31
+
+The 2.0 line, stable. `npm install @agentfile/cli` now resolves to it, which is
+the substantive part of this release: `latest` pointed at the v1 CLI throughout
+the beta, so every command in the README failed for anyone who followed it.
+[docs/migration-v2.md](docs/migration-v2.md) covers what changes for an existing
+repository; the three beta entries below carry the detail of what 2.0 is.
+
+### Breaking
+
+- **Truncation is `AGF006`, not `AGF002`.** One code carried two unrelated
+  meanings: "configuration file not found" and "the repository scan stopped
+  early". They are different problems with different severities, and merging
+  them meant `agentfile rule AGF002` explained the wrong one, a SARIF `ruleId`
+  mislabelled it, and a `severity: AGF002: off` written to quiet truncation
+  noise also silenced genuine missing-file errors. Diagnostic codes are
+  append-only, so this had to land before the meaning froze at stable.
+
+  `AGF002` keeps its registered meaning and is unchanged. Anything matching on
+  the truncation warning by code needs to look for `AGF006`.
+
+### Added
+
+- **A GitHub Action.** `uses: dennishavermans/agentfile@v1` runs `check`, writes
+  SARIF, and fails the step on findings. It deliberately does not upload the
+  SARIF: that needs `security-events: write`, and a job asking for write access
+  to security alerts should say so where a reader can see it rather than acquire
+  it inside a step called "run the linter". The README shows the upload step.
+
+### Fixed
+
+- **`--format sarif` is discoverable.** It has worked on `check`, `validate`,
+  `lint` and `audit` since it landed, but every command's `--help` said
+  `human or json`, so the CLI contradicted the README. Corrected on those four;
+  the rest reject SARIF deliberately and were already accurate.
+
+- **The truncation warning is covered by a test that pins its code.** The
+  existing test asserted the word "truncated" appeared in the message, which is
+  exactly why the `AGF002` overload survived unnoticed.
+
 ## [2.0.0-beta.3] — 2026-08-28
 
 ### Fixed

README.md

@@ -378,7 +378,7 @@ skipped exactly when there is something to upload.
 | --- | --- | --- |
 | `command` | `check` | `check`, `validate`, `lint` or `audit` — the four that produce findings against a file |
 | `root` | `.` | directory to analyse |
-| `version` | `next` | version or dist-tag of `@agentfile/cli`; pin it for a reproducible job |
+| `version` | `next` | version or dist-tag of `@agentfile/cli`; pin an exact version for a job that cannot change under you |
 | `sarif-file` | `agentfile.sarif` | where to write SARIF; empty string skips it |
 | `fail-on-findings` | `true` | whether findings fail the step |
 | `args` | none | extra arguments, e.g. `--strict` or `--max-warnings 5` |
@@ -395,9 +395,6 @@ Running more than one command means more than one upload, and each needs its
 own `category` (`agentfile-check`, `agentfile-audit`) or the second will close
 the first one's alerts.
 
-`version` defaults to `next` because 2.0 is in beta and `latest` still points at
-the v1 CLI. That default becomes `latest` at 2.0 stable.
-
 ---
 
 ## CI output

action.yml

@@ -27,7 +27,7 @@ inputs:
     required: false
     default: .
   version:
-    description: 'Version or dist-tag of @agentfile/cli to run. Pin this for a reproducible job; `next` is the 2.0 line while it is in beta, and becomes `latest` at 2.0 stable.'
+    description: 'Version or dist-tag of @agentfile/cli to run. Pin it to an exact version for a job that cannot change under you.'
     required: false
     default: next
   sarif-file:
@@ -136,13 +136,27 @@ runs:
           fi
           sarif_out="$AGENTFILE_SARIF"
 
-          read -r findings errors warnings < <(node -e '
+          if ! counts=$(node -e '
             const fs = require("node:fs");
-            let results = [];
-            try { results = JSON.parse(fs.readFileSync(process.argv[1], "utf8")).runs?.[0]?.results ?? []; } catch {}
-            const at = (level) => results.filter((r) => r.level === level).length;
-            console.log(results.length, at("error"), at("warning"));
-          ' "$AGENTFILE_SARIF")
+            try {
+              const log = JSON.parse(fs.readFileSync(process.argv[1], "utf8"));
+              const results = log.runs?.[0]?.results;
+              if (log.version !== "2.1.0" || !Array.isArray(results)) throw new Error("not a SARIF 2.1.0 log");
+              const at = (level) => results.filter((r) => r.level === level).length;
+              console.log(results.length, at("error"), at("warning"));
+            } catch (error) {
+              // A stack trace here would bury the one line that explains it.
+              process.stderr.write(error.message + "\n");
+              process.exit(1);
+            }
+          ' "$AGENTFILE_SARIF" 2>&1); then
+            echo "::error::agentfile did not produce a valid SARIF log. Version '$AGENTFILE_VERSION' may not support --format sarif."
+            echo "$counts"
+            echo "exit-code=2" >> "$GITHUB_OUTPUT"
+            echo "sarif-file=" >> "$GITHUB_OUTPUT"
+            exit 2
+          fi
+          read -r findings errors warnings <<< "$counts"
 
           {
             echo "### agentfile $AGENTFILE_COMMAND"

docs/diagnostics.md

@@ -54,6 +54,18 @@ finding it was meant to silence. A warning rather than an error: a stale
 directive is untidy, not broken, and failing a build over one would push people
 towards blanket `agentfile-disable` comments that silence everything.
 
+### `AGF006` scan-truncated · warning · active
+The repository scan hit a limit and stopped early, so agentfile did not read
+every file. Nothing in the configuration is necessarily wrong; the report is
+simply incomplete, and every finding below it that rests on absence — a
+reference that "does not exist", a glob that matches "nothing" — is weaker than
+it looks. Raise the scan limits, or exclude large generated directories, and run
+it again.
+
+Reported under its own code since 2.0.0. Before that it shared `AGF002` with
+"configuration file not found", which meant `agentfile rule AGF002` explained
+the wrong problem and turning one off silenced the other.
+
 Directives are written as a comment in the configuration file itself, in
 whichever comment syntax that file already uses:
 

package-lock.json

@@ -1,6 +1,6 @@
 {
   "name": "@agentfile/agentfile",
-  "version": "2.0.0-beta.3",
+  "version": "2.0.0",
   "description": "Find what is wrong with the AI agent configuration your repository already has",
   "type": "module",
   "bin": {
@@ -42,7 +42,7 @@
     "access": "public"
   },
   "dependencies": {
-    "@agentfile/cli": "^2.0.0-beta.3"
+    "@agentfile/cli": "^2.0.0"
   },
   "devDependencies": {
     "@types/node": "^22.19.0",

packages/agentfile/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@agentfile/cli",
-  "version": "2.0.0-beta.3",
-  "description": "Find what is wrong with the AI agent configuration your repository already has \u2014 doctor, check, lint, audit, adopt, compile, eval",
+  "version": "2.0.0",
+  "description": "Find what is wrong with the AI agent configuration your repository already has — doctor, check, lint, audit, adopt, compile, eval",
   "type": "module",
   "main": "./dist/bin.js",
   "bin": {
@@ -45,7 +45,7 @@
     "access": "public"
   },
   "dependencies": {
-    "@agentfile/core": "^2.0.0-beta.3",
+    "@agentfile/core": "^2.0.0",
     "chalk": "^6.0.0",
     "commander": "^14.0.3",
     "enquirer": "^2.4.1"

packages/cli/package.json

@@ -844,7 +844,25 @@ describe("discover", () => {
     for (let index = 0; index < 20; index++) files[`/repo/file-${index}.md`] = "x";
 
     const result = discover({ root: ROOT, fs: memoryFileSystem(files), maxFiles: 5 });
-    expect(result.diagnostics.some((item) => item.message.includes("truncated"))).toBe(true);
+    const finding = result.diagnostics.find((item) => item.code === "AGF006");
+
+    expect(finding).toBeDefined();
+    expect(finding?.message).toContain("truncated");
+    expect(finding?.severity).toBe("warning");
+  });
+
+  // This assertion is the one that was missing. The truncation warning used to
+  // be emitted as AGF002, "configuration file not found", and no test noticed
+  // because the only assertion was on the word "truncated" in the message. A
+  // code carries its meaning into `agentfile rule`, into a SARIF ruleId, and
+  // into whatever `severity:` entry a user writes to silence it, so the code is
+  // the part worth pinning.
+  it("does not report truncation as a missing configuration file", () => {
+    const files: Record<string, string> = { "/repo/AGENTS.md": "x" };
+    for (let index = 0; index < 20; index++) files[`/repo/file-${index}.md`] = "x";
+
+    const result = discover({ root: ROOT, fs: memoryFileSystem(files), maxFiles: 5 });
+    expect(result.diagnostics.map((item) => item.code)).not.toContain("AGF002");
   });
 
   it("resolves discovered configuration for a path", () => {

packages/core/__tests__/discovery.test.ts

@@ -1,7 +1,7 @@
 {
   "name": "@agentfile/core",
-  "version": "2.0.0-beta.3",
-  "description": "Read, analyse and compile AI agent configuration \u2014 discovery, a normalized IR, a resolver, diagnostics, and static security analysis",
+  "version": "2.0.0",
+  "description": "Read, analyse and compile AI agent configuration — discovery, a normalized IR, a resolver, diagnostics, and static security analysis",
   "type": "module",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",

packages/core/package.json

@@ -85,6 +85,17 @@ export const DIAGNOSTIC_CODES = {
     defaultSeverity: "warning",
     status: "active",
   },
+  AGF006: {
+    name: "scan-truncated",
+    title: "Repository scan stopped early, so the report is incomplete",
+    band: "configuration",
+    // A warning about the report rather than about the repository. Nothing in
+    // the configuration is wrong; agentfile simply did not read all of it, and
+    // every "nothing matches" and "does not exist" below it is weaker as a
+    // result.
+    defaultSeverity: "warning",
+    status: "active",
+  },
 
   // ─── AGF1xx — skills ────────────────────────────────────────────────────
   AGF101: {