feat: v3.1.0 hardening — CI, security, changelog, social by naimkatiman · Pull Request #23 · naimkatiman/continuous-improvement

naimkatiman · 2026-04-11T16:59:18Z

v3.1.0 Hardening — Ship-Ready Polish

What Changed

Infrastructure hardening — every change here closes a credibility gap that was visible to anyone evaluating the repo:

engines.node >= 18 in package.json — CI tests Node 18/20/22 but consumers had zero guidance. Now npm warns on incompatible versions automatically.
Code coverage in CI — 104 tests pass but nobody could prove what they cover. Added --experimental-test-coverage on Node 22. Zero new dependencies.
CodeQL security scanning — this tool runs child_process, reads/writes filesystem, processes user JSONL. CodeQL catches injection risks before they ship. Runs on push, PR, and weekly.
CHANGELOG v3.1.0 entry — package.json said 3.1.0 but CHANGELOG stopped at 3.0.0. Credibility gap closed.
X thread updated to v3.1.0 — 9 tweets (up from 7), current stats (104 tests, 10 expert tools), all platform support listed.
Daily improvement report — automated REPORTS/daily-improvement.md tracking repo evolution.

Why This Matters

The code was already solid. The signals weren't. No engines field = silent broken installs. No coverage = "are these tests real?" No security scanning = liability for a tool that shells out. No changelog = "is this maintained?"

This PR closes every credibility gap identified in the automated daily improvement analysis.

Files Changed

File	Change
`package.json`	Added `engines.node >= 18`
`.github/workflows/ci.yml`	Added coverage step (Node 22)
`.github/workflows/codeql.yml`	New: CodeQL security scanning
`CHANGELOG.md`	Backfilled v3.1.0 entry
`examples/x-thread.md`	Updated to 9-tweet v3.1.0 thread
`REPORTS/daily-improvement.md`	New: automated improvement report

Test Plan

All 104 tests pass locally
Zero dependencies maintained
No breaking changes to public API

npx continuous-improvement install

104 tests | Zero dependencies | Node 18+ | MIT

https://claude.ai/code/session_01WKuvYYRfrqGb3MhiT7pQgY

… content - Add engines.node >= 18 to package.json (matches CI matrix) - Add code coverage step to CI (Node 22, --experimental-test-coverage) - Add CodeQL security scanning workflow (weekly + push/PR) - Backfill missing CHANGELOG entry for v3.1.0 - Update X thread to v3.1.0 (9 tweets, current stats, platform coverage) https://claude.ai/code/session_01WKuvYYRfrqGb3MhiT7pQgY

github-advanced-security · 2026-04-11T17:00:20Z

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.

gemini-code-assist

Code Review

This pull request updates the project to version 3.1.0 by enforcing a Node.js engine constraint in package.json, updating the CHANGELOG.md, and expanding the social media thread examples to include new features like the MCP server and instinct packs. It also introduces an automated REPORTS/daily-improvement.md file. The review feedback correctly identifies that this new report file contains stale information and placeholders, as it describes the missing engine field and out-of-sync changelog as pending issues despite them being resolved within this same PR.

gemini-code-assist · 2026-04-11T17:00:34Z

+
+## 1. One-Line Verdict
+
+**The CHANGELOG is out of sync with the shipped version, and the package.json lacks an `engines` field — your CI tests Node 18/20/22 but consumers have zero guidance on minimum version.**


This verdict is stale as it describes issues (missing engines field and out-of-sync CHANGELOG) that are resolved within this pull request. To maintain the report's value as an accurate record of project health, consider updating this to reflect that the issues have been addressed.

gemini-code-assist · 2026-04-11T17:00:34Z

+
+| Item | Status | Notes |
+|---|---|---|
+| v3.1.0 shipped | Valid | `package.json` updated, but CHANGELOG not updated |


The note here stating that the CHANGELOG is not updated is incorrect in the context of this pull request, which specifically includes the missing CHANGELOG entry.

Suggested change

| v3.1.0 shipped | Valid | `package.json` updated, but CHANGELOG not updated |

| v3.1.0 shipped | Valid | package.json and CHANGELOG updated |

gemini-code-assist · 2026-04-11T17:00:34Z

+## [3.1.0] — 2026-04-11
+
+### Added
+- (document what changed in 3.1.0)
+
+### Changed
+- (document what changed)
+```


This section contains placeholder text (e.g., (document what changed)) and instructions for tasks already completed in this PR. It should be updated to reflect the final status of the v3.1.0 release to avoid committing template content to the repository.

Suggested change

## [3.1.0] — 2026-04-11

### Added

- (document what changed in 3.1.0)

### Changed

- (document what changed)

```

## 7. Status Update

**The `engines` field has been added and the CHANGELOG has been updated.**

These actions resolve the credibility gaps identified in this report. Future scans will track further evolution.

- GitHub Action workflow: auto-posts to X/Twitter when a release is published - bin/generate-social-post.mjs: generates platform-specific posts (X, LinkedIn) - Dynamically pulls version tag, test count, and release URL - One-time setup: add X API secrets to GitHub repo settings https://claude.ai/code/session_01WKuvYYRfrqGb3MhiT7pQgY

- bin/social.mjs: zero-dep local tool for X/Twitter + LinkedIn posting - preview: see post content before sending - post: publish to X, LinkedIn, or both via API - setup: install local cron job (default: daily 10 AM) - uninstall: remove cron job - .env.example: template for API credentials - .gitignore: prevents .env from being committed - Removed .github/workflows/social-post.yml (cloud-based) - Removed bin/generate-social-post.mjs (replaced by social.mjs) Setup: cp .env.example .env && add keys && node bin/social.mjs setup https://claude.ai/code/session_01WKuvYYRfrqGb3MhiT7pQgY

+    Object.keys(params).sort().map(k => `${k}=${encodeURIComponent(params[k])}`).join('&')
+  )}`;
+  const signingKey = `${encodeURIComponent(consumerSecret)}&${encodeURIComponent(tokenSecret)}`;
+  return crypto.createHmac('sha1', signingKey).update(baseString).digest('base64');


- scheduled-tasks/daily-social-improvement/SKILL.md: full task prompt for Claude Code scheduled tasks (pull, test, analyze, report, post, push) - scheduled-tasks/install.sh: one-command installer copies tasks to ~/.claude/scheduled-tasks/ for local Claude Code desktop Setup: bash scheduled-tasks/install.sh && /schedule update daily-social-improvement https://claude.ai/code/session_01WKuvYYRfrqGb3MhiT7pQgY

…ort restructure [2026-04-11] - Restructured REPORTS/ to reports/ (lowercase, matches prompt convention) - Created reports/assets/ with SVG card generator and first visual asset - Updated scheduled-tasks/daily-social-improvement/SKILL.md with full 5-phase execution engine prompt (analyze, implement, generate assets, report, post via Chrome MCP tools to X/LinkedIn/Facebook/DEV.to) - Rewrote reports/daily-improvement.md to match new report format https://claude.ai/code/session_01WKuvYYRfrqGb3MhiT7pQgY

naimkatiman · 2026-04-15T01:23:54Z

@copilot resolve the merge conflicts in this pull request

claude added 2 commits April 11, 2026 16:45

chore: auto-update daily improvement report [2026-04-11]

b2e1541

https://claude.ai/code/session_01WKuvYYRfrqGb3MhiT7pQgY

naimkatiman mentioned this pull request Apr 11, 2026

v3.1.0 Hardening Shipped: CodeQL, Coverage, Engine Constraints #24

Open

gemini-code-assist Bot reviewed Apr 11, 2026

View reviewed changes

claude added 2 commits April 11, 2026 17:07

github-advanced-security AI found potential problems Apr 11, 2026

View reviewed changes

claude added 2 commits April 11, 2026 17:41

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat: v3.1.0 hardening — CI, security, changelog, social#23

feat: v3.1.0 hardening — CI, security, changelog, social#23
naimkatiman wants to merge 6 commits intomainfrom
claude/wizardly-hopper-fOR4J

naimkatiman commented Apr 11, 2026

Uh oh!

github-advanced-security AI commented Apr 11, 2026

Uh oh!

gemini-code-assist Bot left a comment

Uh oh!

gemini-code-assist Bot Apr 11, 2026

Uh oh!

gemini-code-assist Bot Apr 11, 2026

Uh oh!

gemini-code-assist Bot Apr 11, 2026

Uh oh!

naimkatiman commented Apr 15, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants


		## 1. One-Line Verdict

		The CHANGELOG is out of sync with the shipped version, and the package.json lacks an `engines` field — your CI tests Node 18/20/22 but consumers have zero guidance on minimum version.

	\| v3.1.0 shipped \| Valid \| `package.json` updated, but CHANGELOG not updated \|
	\| v3.1.0 shipped \| Valid \| package.json and CHANGELOG updated \|

Conversation

naimkatiman commented Apr 11, 2026

v3.1.0 Hardening — Ship-Ready Polish

What Changed

Why This Matters

Files Changed

Test Plan

Uh oh!

github-advanced-security AI commented Apr 11, 2026

What Enabling Code Scanning Means:

Uh oh!

gemini-code-assist Bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

gemini-code-assist Bot Apr 11, 2026

Choose a reason for hiding this comment

Uh oh!

gemini-code-assist Bot Apr 11, 2026

Choose a reason for hiding this comment

Uh oh!

gemini-code-assist Bot Apr 11, 2026

Choose a reason for hiding this comment

Uh oh!

naimkatiman commented Apr 15, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants