chore(release): 0.8.0

.github/release-notes.md

@@ -1,40 +1,40 @@
-<!-- release-version: 0.7.0 -->
+<!-- release-version: 0.8.0 -->
 
 <!-- release-section: highlights:start -->
 
 ## Highlights
 
-Codex Security 0.7.0 adds optional post-scan validation and improves Deep Scan recovery, usage reporting, and saved results. Review the upgrade notes for changes to external imports, hosted verification, and direct helper integrations.
-
-- **Post-scan validation.** Add `--validate` to run a supplemental validation pass after a scan and save a separate `validation.md` report. This pass makes additional model calls, leaves the saved findings and `--fail-on-severity` decision unchanged, and cannot be combined with `--max-cost`, a configured cost cap, `--dry-run`, or `--mock`. See [validation options](https://github.com/openai/codex-security/blob/npm-v0.7.0/sdk/typescript/docs/cli.md#follow-up-finding-validation).
-- **Deep Scan recovery.** Deadline recovery retains unfinished checkpoints and worker coverage, retries keep selected results stable, and the CLI waits for the coordinator to finish before returning. Scan finalization preserves findings and honors project budgets.
-- **Clearer usage and progress.** Scan output distinguishes file inventory from review progress and reports usage timestamps and account allowance. Large usage receipts, policy files, checkpoints, failure diagnostics, and reviewed feedback are retained.
-- **Owner reports and saved results.** Scan owner reports are finalized without an extra model call. Saved findings remain consistent through recovery, SARIF exports retain run warnings, and report rendering preserves literal source paths and text.
+- skip Office owner files in knowledge-base folders ([#1913](https://github.com/openai/codex-security/pull/1913))
+- leave Git-ignored SECURITY.md files out of policy discovery ([#1535](https://github.com/openai/codex-security/pull/1535))
+- retain pre-seal warnings across publication failures ([#1907](https://github.com/openai/codex-security/pull/1907))
+- simplify scan completion and recovery ([#1762](https://github.com/openai/codex-security/pull/1762))
+- bump fast-uri from 3.1.8 to 3.1.9 in /github-action/runtime ([#1914](https://github.com/openai/codex-security/pull/1914))
+- bump fast-uri from 3.1.8 to 3.1.9 in /sdk/typescript ([#2061](https://github.com/openai/codex-security/pull/2061))
+- bump fast-uri from 3.1.8 to 3.1.9 in /plugins/codex-security/mcp-app ([#2062](https://github.com/openai/codex-security/pull/2062))
+- bump fast-uri from 3.1.8 to 3.1.9 in /evals/triage-finding ([#2063](https://github.com/openai/codex-security/pull/2063))
+- stop source excerpts at the end of the file ([#2015](https://github.com/openai/codex-security/pull/2015))
+- update @inquirer/prompts to 8.7.4 in the SDK ([#2072](https://github.com/openai/codex-security/pull/2072))
+- request fields when reading back GitHub issues ([#2048](https://github.com/openai/codex-security/pull/2048))
+- resume deep scans after clearing their instructions ([#2049](https://github.com/openai/codex-security/pull/2049))
+- read completed scan artifacts after checkout removal ([#2050](https://github.com/openai/codex-security/pull/2050))
+- skip container builds for SDK test-only pull requests ([#2069](https://github.com/openai/codex-security/pull/2069))
+- clarify recovery for historical scan entries ([#2027](https://github.com/openai/codex-security/pull/2027))
+- add a local Wolfi build for Linux amd64 ([#2053](https://github.com/openai/codex-security/pull/2053))
+- continue hosted reviews after a missing submission ([#2090](https://github.com/openai/codex-security/pull/2090))
+- count Cloud request bytes without reserializing batches ([#2079](https://github.com/openai/codex-security/pull/2079))
+- avoid redundant SQLite reads and parsing on replay ([#2083](https://github.com/openai/codex-security/pull/2083))
+- map scanner evidence and test cross-provider replay ([#2080](https://github.com/openai/codex-security/pull/2080))
+- distinguish Snyk evidence changes from finding edits ([#2081](https://github.com/openai/codex-security/pull/2081))
+- support OpenGrep reports locally and in Cloud ([#1872](https://github.com/openai/codex-security/pull/1872))
 
 <!-- release-section: highlights:end -->
 
 <!-- release-section: upgrades:start -->
 
 ## Upgrade notes
 
-- **External imports require opt-in.** Set `CODEX_SECURITY_ENABLE_EXTERNAL_IMPORTS=1` before using `publish findings`, `findings imported`, `import github-advisories`, or the corresponding SDK operations. Only the literal value `1` enables these features. SDK callers that supply `dependencies.environment` must include the flag there. Previously imported records are retained. See [external import setup](https://github.com/openai/codex-security/blob/npm-v0.7.0/sdk/typescript/docs/cli.md#import-vendor-findings-locally).
-- **Hosted verification uses the CLI verdict contract.** Remove imports of `FindingVerificationCheck` and replace reads of `verification.checks` with `verification.status` and `verification.evidence`. The original executor report, when supplied, remains available in `execution.finalResponse`. Update custom executors to return the matching finding `id`, a status of `fixed`, `still_vulnerable`, or `inconclusive`, and nonempty evidence. See [the hosted remediation contract](https://github.com/openai/codex-security/blob/npm-v0.7.0/sdk/typescript/docs/hosted-remediation.md).
-- **Direct inventory helper calls move to Node.** Integrations that invoke the removed Python inventory and ranking scripts must use the bundled launcher and its `--helper` commands below. SDK and MCP callers use the new implementation automatically; the inventory and ranking artifact formats are unchanged.
-- **Committed-diff scans require a clean, full checkout.** Check out the requested head revision and commit or stash local changes before running a committed-diff scan, including with `--validate`. A mismatched checkout or local changes now fail before scanning. See [scan options](https://github.com/openai/codex-security/blob/npm-v0.7.0/sdk/typescript/docs/cli.md#scan-options-and-output).
-
-<details>
-<summary>Direct helper migration</summary>
-
-Use `launch_codex_security_mcp` from the bundled plugin's `scripts` directory, or `launch_codex_security_mcp.cmd` on Windows, with the existing arguments after the helper name:
-
-| Removed Python invocation | Launcher arguments |
-| --- | --- |
-| `generate_in_scope_files.py` | `--helper generate-in-scope-files` |
-| `generate_rank_input.py make-repo-scope-input` | `--helper make-repo-scope-input` |
-| `generate_rank_input.py make-diff-rank-input` | `--helper make-diff-rank-input` |
-
-The removed `rank_preview.py` implementation is incorporated into these helpers. See [diff helper examples and Windows quoting](https://github.com/openai/codex-security/blob/npm-v0.7.0/plugins/codex-security/skills/security-scan/references/scan-artifacts-and-ledger.md).
+Review migration steps for these breaking changes:
 
-</details>
+- simplify scan completion and recovery ([#1762](https://github.com/openai/codex-security/pull/1762))
 
 <!-- release-section: upgrades:end -->

.github/release-pr-state.json

@@ -1,14 +1,14 @@
 {
-  "baseVersion": "0.6.0",
-  "baseCommit": "13dcc6fec00aaf4c23a6fa7e375ccc1726b22836",
+  "baseVersion": "0.7.0",
+  "baseCommit": "f05a0b096cc881242ddf34a4d6b3ce0f322f3cf9",
   "sections": {
     "highlights": {
-      "generatedHash": "633ebab121430c0d4a78f5efcaf5c6b52f03a09b7ad0da880c6db84cc147c7bd",
-      "humanOwned": true
+      "generatedHash": "224dbb6af33c8755c91d742f64872e8b9aa18dac218ed0fca3f1bcaec5957e07",
+      "humanOwned": false
     },
     "upgrades": {
-      "generatedHash": "f6f5552982b8aa1de02ec69316fa9bf4c68fa2d858087a31e5e8f21311cec57a",
-      "humanOwned": true
+      "generatedHash": "dba3f33340a5a700d43c6f01b1f3d795b9a3a750328b8040a36965b7e76c6827",
+      "humanOwned": false
     }
   }
 }

examples/github-actions/codex-security.yml

@@ -32,7 +32,7 @@ jobs:
       security-events: write
       actions: read
     env:
-      CODEX_SECURITY_VERSION: "0.7.0"
+      CODEX_SECURITY_VERSION: "0.8.0"
       BEDROCK_MODEL_ID: ${{ vars.BEDROCK_MODEL_ID }}
       # Report-only by default. Set to "high" to fail on high/critical findings.
       FAIL_ON_SEVERITY: ""

github-action/package.json

@@ -1,6 +1,6 @@
 {
   "name": "codex-security-action",
-  "version": "0.7.0",
+  "version": "0.8.0",
   "private": true,
   "type": "module",
   "description": "Run Codex Security in GitHub Actions with explicit scope, budgets, and scan health reporting",

sdk/typescript/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openai/codex-security",
-  "version": "0.7.0",
+  "version": "0.8.0",
   "description": "TypeScript SDK and CLI for Codex Security",
   "license": "Apache-2.0",
   "author": "OpenAI",