[efegokdemir]

Summary

Adds versioned baselines for explicit TOML comparisons and Git reviews, so CI can report new, existing and resolved findings. Existing --fail-on and --fail-on-risk policies still apply to all findings; --fail-on-new is an independent gate.

User-facing capabilities

Use changeguard baseline create to save a reviewed comparison, then baseline check --fail-on-new to fail only for newly introduced findings. The GitHub Action accepts baseline_path and fail_on_new and exposes lifecycle counts.

Implementation

Schema v1 stores bounded finding counts, repository-relative paths and SHA-256 fingerprints over stable, redacted finding identity. Baseline reads validate schema and paths; creation is exclusive and will not overwrite an existing file. Renames use the new path as a new identity, with the old finding reported as resolved. Baseline entries use deterministic ordering across locales.

Evidence

No Shopify rule was added. The existing coordinated Action example now pins the latest published release commits; it does not point at these unreleased feature branches.

Compatibility

The CLI minimum is now Node.js 22; the Action remains on Node.js 24. The package version stays at 0.6.0 on this feature branch. Proposed next version: 0.7.0.

Testing

Node.js 22.18.0 and 24.21.0: npm ci --ignore-scripts, npm test (119/119 each), npm run coverage (92.89% statements/lines, 83.24% branches, 98.48% functions), npm run lint, npm run package:check, npm run package:smoke, npm run action:check, npm audit --audit-level=high (0 vulnerabilities), and git diff --check passed. The four-tool synthetic CLI integration smoke test passed on both versions. Hosted GitHub Actions passed: Node.js 22/24 CI, cross-platform Action fixtures on Ubuntu/macOS/Windows with Node.js 22/24, CodeQL, Dependency Review, ChangeGuard PR Review, and Snyk. Scorecard has no PR-branch result; its workflow is configured for main pushes and weekly runs.

Security

The baseline contains no summaries or configuration values. Baseline input is size-bounded and rejects unsupported schemas, symlinks, traversal and out-of-repository paths. The Action remains read-only and adds no permissions, telemetry or Shopify network calls.

Limitations

A baseline represents one selected comparison and can only be checked against the same comparison kind. It does not store commit IDs or transient checkout paths. Unsupported or incomplete Git reviews continue to fail closed under the selected policy.

Release impact

Recommend 0.7.0 after review and hosted CI. The Node.js 22 minimum is a documented compatibility break. No version was bumped on this branch.

Review checklist

• Sensitive values remain out of baseline files and reports.
• Existing risk thresholds continue to evaluate existing findings.
• Action and package checks passed locally on Node.js 22 and 24.
• Hosted CI, CodeQL, Dependency Review, ChangeGuard PR Review, cross-platform Action fixtures, and Snyk passed on the pushed branch.

Safety and semantics

• No credentials, telemetry, Shopify network calls or unsafe shell interpolation were added.
• No new Shopify semantic rule was introduced.

Validation

Local checks and hosted results are reported above.