
Security News
Happy Birthday, Shai-Hulud
It has been one year since Shai-Hulud made its first appearance on npm.
BoardReady checks KiCad hardware repositories for production readiness before fabrication.
CI preflight for production-ready PCBs.
BoardReady checks KiCad hardware repositories for production readiness before fabrication. It runs locally as a CLI and in CI as a GitHub Action, producing JSON, SARIF, Markdown, JUnit, and workflow annotation output.
npm i -g boardready
boardready --help
boardready check .
npx boardready --help also works when npm can resolve the package.
name: BoardReady
on:
pull_request:
push:
branches: [main]
jobs:
boardready:
runs-on: ubuntu-latest
permissions:
contents: read
pull-requests: write
security-events: write
steps:
- uses: actions/checkout@v6
- uses: oaslananka/boardready@v1
with:
config: boardready.yml
mode: enforce
fail-on: high
SARIF upload requires security-events: write. Pull request comments require pull-requests: write.
boardready run --json build/findings.json --sarif build/findings.sarif.json .
boardready check .
boardready check manufacturing.jobset-outputs .
boardready doctor
boardready schema config
The npm package exposes the boardready binary from the committed CLI bundle in dist/cli/index.cjs.
Create boardready.yml:
version: 1
mode: warn
projects:
- path: .
pinmap: firmware/pins.yml
bom: bom/board.csv
variants:
- name: production
bom: bom/prod.csv
rules:
bom.missing-mpn:
enabled: true
severity: high
ignore-refs: ["TP*", "FID*"]
bom.variant-consistency:
enabled: true
manufacturing.jobset-outputs:
enabled: true
manufacturing.outputs-present:
enabled: true
required: [gerber, drill, position, pdf]
fail-on: high
report:
sarif: build/boardready.sarif.json
json: build/boardready.findings.json
markdown: build/boardready.report.md
The config schema is committed at schemas/config.schema.json.
corepack pnpm install --frozen-lockfile
corepack pnpm run lint
corepack pnpm run typecheck
corepack pnpm run test
corepack pnpm run build
corepack pnpm run verify:dist
corepack pnpm run docs
The repository intentionally versions dist/action/index.cjs and dist/cli/index.cjs so the GitHub Action and npm package can run without a consumer build step.
MIT.
FAQs
BoardReady checks KiCad hardware repositories for production readiness before fabrication.
We found that boardready demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
It has been one year since Shai-Hulud made its first appearance on npm.

Research
/Security News
Operators behind PolinRider used a compromised GitHub account to plant malware in four development versions of a Packagist package with 700,000+ downloads.

Security News
GitHub Actions now supports cache-mode, a least-privilege control on the Actions cache aimed at the cache poisoning technique behind recent compromises.