Every release. Every change.

CLI reliability update

Rorix.Cli 0.1.2 fixes omitted optional policy handling in automated pipeline scans.

• Published through NuGet Trusted Publishing with GitHub OIDC
• NuGet repository signature verified on the release runner
• Clean-installed from the public NuGet feed after publication
• Added a regression canary for scans that do not provide --policy

Azure DevOps public preview

The Rorix Security Scanner is now publicly available in the Azure DevOps Marketplace.

• Marketplace extension and task version 0.1.2
• Uses the Azure Pipelines Node20_1 handler
• Installs the pinned public Rorix.Cli 0.1.2 release on the hosted agent
• Passed a clean installed-organization pipeline smoke using RorixScan@0
• Keeps the API key masked and passes it only through the task process environment

Rorix remains a capacity-limited public preview while the remaining production operations, security, legal, and support gates are completed.

Public CLI release

Rorix.Cli 0.1.1 is publicly available as a .NET global tool.

• Published through NuGet Trusted Publishing with GitHub OIDC; no long-lived NuGet API key is stored
• NuGet repository signature verified after public registration
• Clean installation and command smoke test completed from the public NuGet feed
• Supports NuGet and npm manifest scanning, CycloneDX/SPDX SBOM generation, and policy evaluation

Public GitHub Actions

• Published rorix-io/rorix-scan-action@v1 for scan, SBOM, policy, and SARIF workflows
• Published rorix-io/rorix-pentest@v1 for existing DNS-verified pentest targets
• The scan Action release smoke installs the public CLI and verifies exit-code propagation on a clean GitHub runner
• The pentest bundle smoke verifies self-containment and fail-closed credential behavior; teams must exercise it against their own verified target before requiring the check

The Azure DevOps extension, GitHub App, and trusted registry remain under their separate preview and release gates.

Features

This entry records the initial source release. CLI and marketplace distribution remained unpublished; see the current documentation status before using an integration.

• NuGet vulnerability scanning with CVE/CVSS/EPSS enrichment
• SBOM generation (CycloneDX and SPDX formats)
• License compliance checking with allowlist/blocklist policies
• Interactive dependency graph visualization
• Docker/container security analysis
• Packable CLI tool source (Rorix.Cli)
• GitHub Action source for CI/CD integration
• Azure DevOps pipeline task source
• Policy enforcement via .rorix.yml
• GitHub webhook integration for automatic scanning