# Changelog

## Score

- CAI 59 → 58 (-1.0)
- Rubric changed (rubric-2026.10.1 → rubric-2026.10.5) — scores are not directly comparable.

## Lenses

- Code Health 93 → 72 (-20.8)
- Architecture 100 → 100 (+0.0)
- Maturity 54 → 52 (-1.9)
- Readiness 50 → 52 (+2.6)
- Security 70 → 70 (+0.0)

## Resolved (4)

- Documentation: no installation or build instructions (README.md)
- Documentation: no usage examples (README.md)
- Off-boarding risk: anonymized user #1
- Workflow holding a long-lived secret is unscoped

## New (5)

- Method naming inconsistency: 'compileList' vs 'compileListOfSimpleDicts'. The first method name is generic and could imply any list, while the second is verbose and specific. If both are list-compilation helpers, they should follow a consistent naming pattern (e.g., `compileList` and `compileMapList` or `compileDictList`).
- Naming inconsistency between 'Build' and 'Publish' workflows. While these are distinct domains, the parallel structure suggests a unified naming convention for workflow generation keys. However, the more significant issue is the lack of a unified 'Workflow' key that encompasses both, or a consistent suffix pattern if they are meant to be separate. Given the extensive list of `githubWorkflow*` keys, this is a minor stylistic point rather than a functional redundancy.
- Off-boarding risk: anonymized user #1
- Orphaned file (src/main/scala/sbtghactions/GitHubActionsPlugin.scala)
- Workflow holding a long-lived secret is unscoped (.github/workflows/ci.yml)

## Changes since last survey

- 4 commits — 4 feature/other, 0 fixes

## By area

- (repo) — 2 commits
- src/main — 1 commit
- src/sbt-test — 1 commit

## Notable commits

- change: Dereference symlinks when archiving target directories
- change: Keep sbt launcher options out of the joined command string
- change: Merge pull request #234 from nafg/dereference-target-symlinks
- change: Merge pull request #235 from nafg/launcher-options-outside-command-string