feat: bump versions and release pipeline.

[s4keeiyuan]

Summary by CodeRabbit

• New Features

  • Added automated release workflow to build, detect distribution changes, and publish semantic-versioned releases
  • Added build script to produce distributable assets
  • Bumped package version to 1.0.2

• Documentation

  • Completely revised README with usage examples, security guidance, and troubleshooting
  • Introduced comprehensive SECURITY policy and reporting guidance

• Bug Fixes

  • Fixed typo in password input description

• Chores

  • Updated core dependencies and dev tools

_{✏️ Tip: You can customize this high-level summary in your review settings.}

[coderabbitai]

Important

Review skipped

Review was skipped due to path filters

⛔ Files ignored due to path filters (1)

• package-lock.json is excluded by !**/package-lock.json

CodeRabbit blocks several paths by default. You can override this behavior by explicitly including those paths in the path filters. For example, including **/dist/** will override the default block on the dist directory, by removing the pattern from both the lists.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Walkthrough

Adds a release GitHub Actions workflow for semantic-version tags, expands README and adds SECURITY.md, fixes a typo in action.yml, and updates dependencies plus a build script in package.json.

Changes

Cohort / File(s)	Summary
Continuous Integration .github/workflows/release.yml	New workflow triggered on semantic version tags; checks out repo with full history, sets up Node v20, installs deps, syncs package.json version to tag, builds dist, commits/pushes changes if any, and creates a GitHub Release with generated notes.
Documentation README.md, SECURITY.md	Major README rewrite: expanded inputs, usage examples, security guidance, troubleshooting, contributing, license. New SECURITY.md with reporting channels, response timelines, best practices, and disclosure policy.
Action configuration & Dependencies action.yml, package.json	Typo fix in password input description. Bumped package version to 1.0.2, added build script (ncc build index.js --license licenses.txt), and updated @actions/core, @actions/github, ssh2-sftp-client, and @vercel/ncc versions.

Sequence Diagram

sequenceDiagram
    participant GH as GitHub (Tag event)
    participant Runner as Self-hosted Runner
    participant Repo as Repository
    participant Node as Node.js/npm
    participant API as GitHub API

    GH->>Runner: Trigger on semantic version tag
    Runner->>Repo: Checkout repository (full history)
    Runner->>Node: Setup Node v20 and cache
    Runner->>Node: npm ci (install)
    Runner->>Repo: Sync package.json version to tag
    Runner->>Node: npm run build (generate dist/)
    Runner->>Repo: Detect changes in dist/
    alt Changes detected
        Runner->>Repo: Commit package.json, package-lock.json, dist/
        Runner->>Repo: Push to tag ref
    end
    Runner->>API: Create Release from tag and generate notes
    API-->>GH: Release published

Loading

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~25 minutes

Possibly related PRs

• Update version 1.0.0 to 1.0.1 in package json #14 — Related package.json version bump history (previous version bump to 1.0.1).

Poem

🐰 I hopped in code and stitched a flow,

Tags now spark a release on show,
Docs and safety seeds I sowed,
Dependencies polished, build bestowed,
A tiny rabbit celebrates the go! 🎉

🚥 Pre-merge checks | ✅ 3

✅ Passed checks (3 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately captures the main changes: version bumps in package.json and a new release pipeline workflow in .github/workflows/release.yml.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[Copilot]

Pull request overview

This PR bumps dependency versions to their latest releases and introduces a release automation pipeline. The update includes major version upgrades for GitHub Actions dependencies and adds comprehensive documentation.

Changes:

• Updated dependencies: @actions/core (1.10.1 → 2.0.2), @actions/github (6.0.0 → 7.0.0), ssh2-sftp-client (10.0.3 → 12.0.1), and minor version bumps for related packages
• Added automated release workflow with build and GitHub release creation
• Added comprehensive SECURITY.md with vulnerability reporting guidelines and security best practices
• Significantly expanded README.md with detailed usage examples, troubleshooting guide, and security considerations
• Fixed typo in action.yml: "Passwort" → "Password"

Reviewed changes

Copilot reviewed 5 out of 6 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
package.json	Bumped dependency versions and added build script for distribution compilation
package-lock.json	Updated lockfile to reflect new dependency versions and transitive dependency changes
action.yml	Fixed spelling error in password input description
SECURITY.md	Added comprehensive security policy with vulnerability reporting process and user best practices
README.md	Expanded documentation with detailed usage examples, security guidelines, and troubleshooting section
.github/workflows/release.yml	Added automated release workflow for tag-based releases with version bumping and GitHub release creation

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[coderabbitai]

Actionable comments posted: 3

🤖 Fix all issues with AI agents

In @.github/workflows/release.yml:
- Around line 46-53: The workflow currently force-pushes the tag in the "Commit
package.json and rebuilt dist if changed" step by running `git push origin
HEAD:refs/tags/${{ github.ref_name }} --force`; remove the `--force` and stop
rewriting existing tags — instead ensure the version bump and dist commit happen
before creating the tag (commit package.json/package-lock.json and dist/, push
the branch normally with `git push origin HEAD`, then create a new lightweight
or signed tag pointing to that commit and push that tag without `--force`), or
switch to a release flow that performs bump/build/commit first (e.g.,
workflow_dispatch) and then creates and pushes the tag so tags are never
rewritten.

In @README.md:
- Around line 3-5: The GitHub release badge URL references the wrong repository
name; update the badge string
"https://img.shields.io/github/v/release/wearesection/sftp-action" to use the
correct repository "sftp-remote" so it becomes
"https://img.shields.io/github/v/release/wearesection/sftp-remote", leaving the
other badges unchanged.

In @SECURITY.md:
- Around line 22-25: Update the GitHub Security Advisories URL string that
currently points to "https://github.com/wearesection/sftp-action/security" to
the correct repository "https://github.com/wearesection/sftp-remote/security" in
SECURITY.md so the Security tab link points to the sftp-remote repo.

🧹 Nitpick comments (3)

SECURITY.md (1)

75-85: Consider clarifying the SSH key authentication example.

The example under "Prefer SSH Key Authentication" includes both password and privateKey. While this is technically valid (the action may support both), it could confuse users about which authentication method takes precedence. Consider either:

1. Removing the password field from this example to emphasize key-only auth, or
2. Adding a note explaining when both might be needed (e.g., for the SSH key passphrase vs. server password)

README.md (2)

71-71: Consider documenting version pinning strategy.

Examples use @1.0.1, but as new versions are released, these will become outdated. Consider either:

1. Using @v1 (major version) for stability with updates
2. Adding a note that users should check for the latest version
3. Keeping a placeholder like @latest-version with instructions

This is a minor concern as the current pinned version is valid.

---

96-106: Clarify private key authentication example.

Similar to the SECURITY.md example, this shows both password and privateKey together. For users new to SSH authentication, it would be clearer to show:

1. Private key only (when the key is not password-protected)
2. Private key with passphrase (when the key is encrypted)

The current example might confuse users about whether password refers to the server password or the key passphrase.

📜 Review details

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between af8de19 and 4aee8e6.

⛔ Files ignored due to path filters (1)

• package-lock.json is excluded by !**/package-lock.json

📒 Files selected for processing (5)

• .github/workflows/release.yml
• README.md
• SECURITY.md
• action.yml
• package.json

🧰 Additional context used

🪛 LanguageTool

SECURITY.md

[style] ~28-~28: Consider using “email”.
Context: ...ut the vulnerability 2. Email - Send an email to the repository maintainers - Include...

(SEND_AN_EMAIL)

README.md

[style] ~44-~44: Three successive sentences begin with the same word. Consider rewording the sentence or use a thesaurus to find a synonym.
Context: ...Hub Secrets). ### privateKeyIsFile Optional Set to "true" if privateKey is a ...

(ENGLISH_WORD_REPEAT_BEGINNING_RULE)

---

[style] ~234-~234: Consider using a less common alternative to make your writing sound more unique and professional.
Context: ...ontributing Contributions are welcome! Please feel free to submit a Pull Request. 1. Fork the rep...

(FEEL_FREE_TO_STYLE_ME)

---

[style] ~238-~238: Consider using a more formal and expressive alternative to ‘amazing’.
Context: ...azing-feature) 3. Commit your changes (git commit -m 'feat: add amazing feature') 4. Push to the branch (git ...

(AWESOME)

⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (1)

• GitHub Check: Agent

🔇 Additional comments (7)

action.yml (1)

20-21: LGTM!

Good catch on the typo fix from "Passwort" to "Password". The description is now correct.

package.json (2)

7-8: LGTM!

The build script using ncc is properly configured and aligns with the release workflow that calls npm run build.

---

14-16: Do not upgrade @actions/core to v2.0.2 — this version does not exist. The latest release is v1.11.1. The review's claim about "@actions/core: ^1.10.1 → ^2.0.2" is incorrect.

Additionally, @actions/github is not imported or used in the codebase, so the v7 breaking changes are not applicable.

For ssh2-sftp-client v12.0.1, the package removed automatic connection retry support, but the codebase does not rely on this feature—it connects once without retry logic.

Likely an incorrect or invalid review comment.

SECURITY.md (1)

1-156: Well-structured security policy.

The SECURITY.md is comprehensive and covers essential areas: vulnerability reporting, best practices, and disclosure policy. The examples effectively demonstrate secure vs. insecure patterns.

.github/workflows/release.yml (2)

10-10: Note: Self-hosted runner usage.

Using self-hosted runners requires ensuring the runner environment is properly maintained with Node.js 20 and npm available. If public contributors might trigger this workflow, ensure the self-hosted runner is secured appropriately.

---

55-61: LGTM on release creation.

The GitHub release creation step properly uses GITHUB_TOKEN and auto-generates release notes, which is a good practice for maintaining changelogs.

README.md (1)

1-254: Excellent documentation overhaul.

The README transformation from minimal to comprehensive is well done. Key improvements include:

• Clear feature highlights
• Multiple usage examples covering common scenarios
• Security considerations with actionable guidance
• Troubleshooting section for common issues
• Proper contributing guidelines

This significantly improves the developer experience for users of this action.

[coderabbitai]

Actionable comments posted: 1

🤖 Fix all issues with AI agents

In @README.md:
- Line 20: Update the inputs in action.yml so that host, username, and password
do not declare both a default and required:true—either remove the defaults or
set required:false; prefer setting required:false for inputs host, username, and
password (currently defaulted to "localhost", "root", "password") and then
change README.md entries for host, username, and password from "**Required**" to
"**Optional**" and add a security note about insecure defaults to encourage
explicit overrides.

🧹 Nitpick comments (1)

README.md (1)

105-105: Clarify the password fallback comment.

The comment # password: ${{ secrets.SFTP_PASSWORD }} # Optional: only if you want to allow password fallback in the private key authentication example may confuse users about whether mixing authentication methods is supported or recommended.

Suggestion: Either remove this comment if mixing auth methods isn't a best practice, or expand it to explain when/why a password fallback might be needed (e.g., for passphrase-protected keys vs. alternative auth).

📜 Review details

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between 4aee8e6 and 663fd14.

📒 Files selected for processing (1)

• README.md

🧰 Additional context used

🪛 LanguageTool

README.md

[style] ~44-~44: Three successive sentences begin with the same word. Consider rewording the sentence or use a thesaurus to find a synonym.
Context: ...Hub Secrets). ### privateKeyIsFile Optional Set to "true" if privateKey is a ...

(ENGLISH_WORD_REPEAT_BEGINNING_RULE)

---

[style] ~234-~234: Consider using a less common alternative to make your writing sound more unique and professional.
Context: ...ontributing Contributions are welcome! Please feel free to submit a Pull Request. 1. Fork the rep...

(FEEL_FREE_TO_STYLE_ME)

---

[style] ~238-~238: Consider using a more formal and expressive alternative to ‘amazing’.
Context: ...azing-feature) 3. Commit your changes (git commit -m 'feat: add amazing feature') 4. Push to the branch (git ...

(AWESOME)

🔇 Additional comments (3)

README.md (3)

171-199: Excellent security guidance!

The Security Considerations section provides comprehensive, actionable best practices:

• Clear GitHub Secrets setup instructions
• Strong recommendation for private key authentication over passwords
• Use of modern ed25519 key algorithm
• Practical key rotation guidance (90-day cycle)

This aligns well with the new SECURITY.md policy and will help users deploy securely.

---

201-230: Well-structured troubleshooting section.

The troubleshooting guidance covers the most common SFTP deployment issues with clear, actionable steps for diagnosis and resolution. This will significantly reduce support burden and help users self-serve.

---

71-71: Create the 1.0.1 release tag before merging this PR, or update README examples to use a more stable reference.

The 1.0.1 tag does not exist in this repository. All usage examples in the README (lines 71, 97, 125, 161) reference wearesection/sftp-action@1.0.1, but this tag cannot be resolved by users until it is created and released. This will cause GitHub Actions workflows to fail if they copy these examples before the release is published.

Options:

• Create and push the 1.0.1 git tag before merging this PR (recommended for a release PR)
• Update examples to use @v1 (major version tag, updates with releases) or @main
• Add a note to the README indicating that users should use the latest release version

[coderabbitai]

Actionable comments posted: 5

🤖 Fix all issues with AI agents

In @README.md:
- Line 125: The README example pins the GitHub Action to
wearesection/sftp-action@1.0.1 which is out of sync with package.json; update
the version reference in the README (the uses: wearesection/sftp-action@...
line) to wearesection/sftp-action@1.0.2 so it matches package.json.
- Line 97: Update the GitHub Action version reference from the outdated string
"wearesection/sftp-action@1.0.1" to match package.json by replacing it with
"wearesection/sftp-action@1.0.2" wherever that exact
"wearesection/sftp-action@1.0.1" line appears (e.g., the README example),
ensuring the version tag is consistent with package.json.
- Line 161: Update the version reference in the README example from "uses:
wearesection/sftp-action@1.0.1" to match package.json by changing it to "uses:
wearesection/sftp-action@1.0.2"; locate the exact line containing the string
"uses: wearesection/sftp-action@1.0.1" and replace the version suffix so the
README and package.json stay consistent.
- Line 71: The README example references wearesection/sftp-action@1.0.1 but
package.json was bumped to 1.0.2; update every occurrence of the action version
in README.md (search for the string "wearesection/sftp-action@") to use @1.0.2
and ensure any related usage examples or badges reflect the same version to keep
docs consistent with package.json.

In @SECURITY.md:
- Line 105: Update the version reference in SECURITY.md where it currently reads
"uses: wearesection/sftp-action@1.0.1" to match package.json by changing it to
"uses: wearesection/sftp-action@1.0.2"; locate the string "uses:
wearesection/sftp-action@1.0.1" and replace the version suffix to "@1.0.2" so
the docs and package.json stay consistent.

🧹 Nitpick comments (2)

SECURITY.md (1)

79-85: Clarify authentication method in the example.

The example shows both password and privateKey being used simultaneously. Typically, SFTP authentication uses either password OR private key, not both. This might confuse users about which authentication method to use.

Consider revising the example to show only private key authentication, or add a comment explaining that password serves as a fallback.

📝 Suggested revision

 ```yaml
 with:
   host: ${{ secrets.SFTP_HOST }}
   username: ${{ secrets.SFTP_USER }}
-  password: ${{ secrets.SFTP_PASSWORD }}
   privateKey: ${{ secrets.SSH_PRIVATE_KEY }}
+  # password: ${{ secrets.SFTP_PASSWORD }}  # Optional: fallback if key auth fails

</details>

</blockquote></details>
<details>
<summary>README.md (1)</summary><blockquote>

`105-105`: **Clarify the password fallback comment.**

The comment suggests using password as an optional fallback, which might confuse users. If private key authentication is the primary method (as recommended), the comment could be clearer about when and why a password fallback would be used.

Consider rephrasing to: `# Optional: fallback to password auth if private key fails`

</blockquote></details>

</blockquote></details>

<details>
<summary>📜 Review details</summary>

**Configuration used**: Repository UI

**Review profile**: CHILL

**Plan**: Pro

<details>
<summary>📥 Commits</summary>

Reviewing files that changed from the base of the PR and between 663fd1473c1845f814234e9bd60a79c50038eae0 and 8ebb301489f2a236a010f4c7fdf609d9eae3cc72.

</details>

<details>
<summary>⛔ Files ignored due to path filters (5)</summary>

* `dist/build/Release/cpufeatures.node` is excluded by `!**/dist/**`
* `dist/index.js` is excluded by `!**/dist/**`
* `dist/lib/protocol/crypto/build/Release/sshcrypto.node` is excluded by `!**/dist/**`
* `dist/licenses.txt` is excluded by `!**/dist/**`
* `package-lock.json` is excluded by `!**/package-lock.json`

</details>

<details>
<summary>📒 Files selected for processing (4)</summary>

* `.github/workflows/release.yml`
* `README.md`
* `SECURITY.md`
* `package.json`

</details>

<details>
<summary>🚧 Files skipped from review as they are similar to previous changes (2)</summary>

* .github/workflows/release.yml
* package.json

</details>

<details>
<summary>🧰 Additional context used</summary>

<details>
<summary>🪛 LanguageTool</summary>

<details>
<summary>SECURITY.md</summary>

[style] ~28-~28: Consider using “email”.
Context: ...ut the vulnerability  2. **Email**    - Send an email to the repository maintainers    - Include...

(SEND_AN_EMAIL)

</details>
<details>
<summary>README.md</summary>

[style] ~44-~44: Three successive sentences begin with the same word. Consider rewording the sentence or use a thesaurus to find a synonym.
Context: ...Hub Secrets).  ### `privateKeyIsFile` **Optional** Set to `"true"` if `privateKey` is a ...

(ENGLISH_WORD_REPEAT_BEGINNING_RULE)

---

[style] ~234-~234: Consider using a less common alternative to make your writing sound more unique and professional.
Context: ...ontributing  Contributions are welcome! Please feel free to submit a Pull Request.  1. Fork the rep...

(FEEL_FREE_TO_STYLE_ME)

---

[style] ~238-~238: Consider using a more formal and expressive alternative to ‘amazing’.
Context: ...azing-feature`) 3. Commit your changes (`git commit -m 'feat: add amazing feature'`) 4. Push to the branch (`git ...

(AWESOME)

</details>

</details>

</details>

</details>

<!-- This is an auto-generated comment by CodeRabbit for review status -->

[coderabbitai]

⚠️ Potential issue | 🟡 Minor

Update version reference to match package.json.

The example references wearesection/sftp-action@1.0.1, but the package.json was bumped to version 1.0.2 in this PR. Update all version references to maintain consistency.

🤖 Prompt for AI Agents

In @README.md at line 71, The README example references
wearesection/sftp-action@1.0.1 but package.json was bumped to 1.0.2; update
every occurrence of the action version in README.md (search for the string
"wearesection/sftp-action@") to use @1.0.2 and ensure any related usage examples
or badges reflect the same version to keep docs consistent with package.json.

[coderabbitai]

⚠️ Potential issue | 🟡 Minor

Update version reference to match package.json.

Same as the previous example, this references version 1.0.1 instead of 1.0.2.

🤖 Prompt for AI Agents

In @README.md at line 97, Update the GitHub Action version reference from the
outdated string "wearesection/sftp-action@1.0.1" to match package.json by
replacing it with "wearesection/sftp-action@1.0.2" wherever that exact
"wearesection/sftp-action@1.0.1" line appears (e.g., the README example),
ensuring the version tag is consistent with package.json.

[coderabbitai]

⚠️ Potential issue | 🟡 Minor

Update version reference to match package.json.

This example also references version 1.0.1 instead of 1.0.2.

🤖 Prompt for AI Agents

In @README.md at line 125, The README example pins the GitHub Action to
wearesection/sftp-action@1.0.1 which is out of sync with package.json; update
the version reference in the README (the uses: wearesection/sftp-action@...
line) to wearesection/sftp-action@1.0.2 so it matches package.json.

[coderabbitai]

⚠️ Potential issue | 🟡 Minor

Update version reference to match package.json.

This example also references version 1.0.1 instead of 1.0.2.

🤖 Prompt for AI Agents

In @README.md at line 161, Update the version reference in the README example
from "uses: wearesection/sftp-action@1.0.1" to match package.json by changing it
to "uses: wearesection/sftp-action@1.0.2"; locate the exact line containing the
string "uses: wearesection/sftp-action@1.0.1" and replace the version suffix so
the README and package.json stay consistent.

[coderabbitai]

⚠️ Potential issue | 🟡 Minor

🧩 Analysis chain

🏁 Script executed:

cat package.json | jq -r '.version'

Repository: wearesection/sftp-remote

Length of output: 73

---

Update version reference in SECURITY.md to match package.json.

The example on line 105 references version 1.0.1, but package.json is at version 1.0.2. Update uses: wearesection/sftp-action@1.0.1 to uses: wearesection/sftp-action@1.0.2.

🤖 Prompt for AI Agents

In @SECURITY.md at line 105, Update the version reference in SECURITY.md where
it currently reads "uses: wearesection/sftp-action@1.0.1" to match package.json
by changing it to "uses: wearesection/sftp-action@1.0.2"; locate the string
"uses: wearesection/sftp-action@1.0.1" and replace the version suffix to
"@1.0.2" so the docs and package.json stay consistent.