feat: v5.0 multi-language analysis format

.github/workflows/ci.yml

@@ -86,7 +86,7 @@ jobs:
       - name: lychee (offline link check)
         uses: lycheeverse/lychee-action@v2
         with:
-          args: --offline --no-progress --exclude-path languages/_overlay docs/**/*.md contrib/**/*.md languages/**/*.md AGENTS.md CLAUDE.md
+          args: --offline --no-progress --exclude-path plugins/_overlay docs/**/*.md contrib/**/*.md plugins/**/*.md AGENTS.md CLAUDE.md
           fail: true
       - name: markdownlint
         # Argless — globs and rules come from .markdownlint-cli2.jsonc.

.github/workflows/code-ranker.yml

@@ -1,11 +1,17 @@
+# Dogfood: run the PUBLIC code-ranker-ci scripts on this repo, but build
+# code-ranker from these branch sources (not the released binary).
 name: code-ranker
 on:
   pull_request:
-  push: { branches: [main] }
+  push:
 jobs:
-  report:
-    uses: ffedoroff/code-ranker-ci/.github/workflows/report.yml@v1
+  code-ranker:
+    uses: ffedoroff/code-ranker-ci/.github/workflows/report.yml@main
+    with:
+      install_from_source: true   # build code-ranker from this checkout
+      do_check: false             # advisory on our own PRs (don't red the build)
     permissions:
       id-token: write
       contents: read
       pull-requests: write
+      security-events: write

.github/workflows/crates-io.yml

@@ -37,12 +37,12 @@ jobs:
           # right before publishing; cargo auto-detects a package-root README.md
           # when no `readme` field is set. `--allow-dirty` tolerates the copy.
           for d in crates/*/; do cp README.md "$d/README.md"; done
-          # Same trick for the `--doc` corpus: the languages/ tree lives at the
+          # Same trick for the `--doc` corpus: the plugins/ tree lives at the
           # repo root (outside the crate, so not in the published tarball by
           # default). Copy it into the CLI crate so `cargo publish` packs it and
           # `cargo install code-ranker` embeds the full corpus; build.rs prefers
           # this package-local copy over the repo-root tree. `--allow-dirty` covers it.
-          cp -R languages crates/code-ranker-cli/languages
+          cp -R plugins crates/code-ranker-cli/plugins
           for c in code-ranker-plugin-api code-ranker-graph code-ranker-plugins code-ranker-viewer code-ranker; do
             echo "==> publishing $c"
             attempt=0

.markdownlint-cli2.jsonc

@@ -18,13 +18,13 @@
   "globs": [
     "docs/**/*.md",
     "contrib/**/*.md",
-    "languages/**/*.md",
+    "plugins/**/*.md",
     "AGENTS.md",
     "CLAUDE.md"
   ],
   "ignores": [
     "node_modules/**",
     "target/**",
-    "languages/_overlay/**"
+    "plugins/_overlay/**"
   ]
 }

Cargo.toml

@@ -3,7 +3,7 @@ members = ["crates/*"]
 resolver = "3"
 
 [workspace.package]
-version = "4.0.0"
+version = "5.0.0"
 edition = "2024"
 rust-version = "1.88"
 license = "Apache-2.0"
@@ -12,10 +12,10 @@ keywords = ["dependency-graph", "coupling", "refactoring", "code-quality", "stat
 categories = ["development-tools", "command-line-utilities"]
 
 [workspace.dependencies]
-code-ranker-graph = { path = "crates/code-ranker-graph", version = "4.0.0" }
-code-ranker-plugin-api = { path = "crates/code-ranker-plugin-api", version = "4.0.0" }
-code-ranker-plugins = { path = "crates/code-ranker-plugins", version = "4.0.0" }
-code-ranker-viewer = { path = "crates/code-ranker-viewer", version = "4.0.0" }
+code-ranker-graph = { path = "crates/code-ranker-graph", version = "5.0.0" }
+code-ranker-plugin-api = { path = "crates/code-ranker-plugin-api", version = "5.0.0" }
+code-ranker-plugins = { path = "crates/code-ranker-plugins", version = "5.0.0" }
+code-ranker-viewer = { path = "crates/code-ranker-viewer", version = "5.0.0" }
 
 anyhow = "1.0"
 cel = "0.13"

Makefile

@@ -25,7 +25,7 @@ fmt-check:
 	cargo fmt --all --check
 
 lint-md:
-	lychee --offline --no-progress --exclude-path languages/_overlay 'docs/**/*.md' 'contrib/**/*.md' 'languages/**/*.md' 'AGENTS.md' 'CLAUDE.md'
+	lychee --offline --no-progress --exclude-path plugins/_overlay 'docs/**/*.md' 'contrib/**/*.md' 'plugins/**/*.md' 'AGENTS.md' 'CLAUDE.md'
 	npx --yes markdownlint-cli2
 
 # Unused-dependency check (fast, stable toolchain). FAILS the build on any unused
@@ -86,6 +86,24 @@ clean:
 #   make publish  (phase 2) is the single Release button: after Verify is green it
 #                 dispatches publish.yml to release everywhere
 #                 (crates.io / PyPI / Docker / GitHub Release + npm).
+#
+# GitHub-ONLY prerelease (an alpha for testing — GitHub Release + binaries, and
+# NOTHING on any registry). The registries are SEPARATE workflows that run only
+# from publish.yml, so do NOT use `make publish` here — dispatch release.yml
+# directly and it publishes a GitHub Release + binaries and nothing else. The one
+# registry job baked into release.yml is npm; set `publish-prereleases = false` in
+# dist-workspace.toml and it (and any other publish-job) is SKIPPED for a
+# prerelease tag. Cut it from a THROWAWAY branch so the alpha version bump never
+# lands on main:
+#     git checkout -b release/vX.Y.Z-alpha
+#     # in dist-workspace.toml: publish-prereleases = false
+#     make bump VERSION=X.Y.Z-alpha && git commit -am 'release vX.Y.Z-alpha'
+#     git push -u origin release/vX.Y.Z-alpha
+#     git tag -a vX.Y.Z-alpha -m vX.Y.Z-alpha && git push origin vX.Y.Z-alpha
+#     gh workflow run release.yml --ref release/vX.Y.Z-alpha -f tag=vX.Y.Z-alpha
+# Verify goes RED on the PyPI job for a non-PEP-440 suffix like `-pre-alpha` —
+# expected and harmless: a direct release.yml dispatch is not gated by Verify and
+# never runs the PyPI/crates/Docker workflows. Delete the branch + tag when done.
 
 bump:
 	@if [ -z "$(VERSION)" ]; then echo "usage: make bump VERSION=0.1.0-alpha.12"; exit 1; fi
@@ -96,13 +114,13 @@ bump:
 	  echo "bumping $$CURRENT -> $(VERSION)"; \
 	  LC_ALL=C sed -i '' "s/$$CURRENT/$(VERSION)/g" Cargo.toml README.md; \
 	  RE=$$(printf '%s' "$$CURRENT" | sed 's/[.]/\\./g'); \
-	  for f in $$(grep -rlF "$$CURRENT" docs AGENTS.md CLAUDE.md languages 2>/dev/null || true); do \
+	  for f in $$(grep -rlF "$$CURRENT" docs AGENTS.md CLAUDE.md plugins 2>/dev/null || true); do \
 	    LC_ALL=C sed -i '' -E "/code-ranker|--version/ s/$$RE/$(VERSION)/g" "$$f" && echo "  ✓ fixed doc version refs in $$f"; \
 	  done
 	cargo build --workspace
 	@echo
 	@echo "  remaining stale version mentions in docs (auto-fix only touches code-ranker/--version lines):"
-	@hits=$$(grep -rnE -- '--version[ =]+v?[0-9]+\.[0-9]+\.[0-9]+|[0-9]+\.[0-9]+\.[0-9]+-(alpha|beta|rc)|code-ranker[@:" ]+v?[0-9]+\.[0-9]+\.[0-9]+' docs README.md AGENTS.md CLAUDE.md languages 2>/dev/null | grep -vF "$(VERSION)" || true); \
+	@hits=$$(grep -rnE -- '--version[ =]+v?[0-9]+\.[0-9]+\.[0-9]+|[0-9]+\.[0-9]+\.[0-9]+-(alpha|beta|rc)|code-ranker[@:" ]+v?[0-9]+\.[0-9]+\.[0-9]+' docs README.md AGENTS.md CLAUDE.md plugins 2>/dev/null | grep -vF "$(VERSION)" || true); \
 	  if [ -n "$$hits" ]; then echo "$$hits" | sed 's/^/      /'; echo "      ^ not at $(VERSION) — review (bare numbers off code-ranker/--version lines are left alone on purpose)"; else echo "      (none — all at $(VERSION))"; fi
 	@echo
 	@echo "  ✓ bumped to $(VERSION) — review and commit:"