chore: public-readiness cleanup (gitignore internal docs, refresh README, v3)

[loera140]

Summary

Make the public marketplace repo presentable to non-BuildPulse customers browsing the action.

Untrack internal-only docs:

• CLAUDE.md was documenting the whole 9-repo monorepo architecture (DocumentDB migration date, internal Lambda names, AWS region rules). Not for customers — gitignored, kept locally for development.
• GRADES.md was a self-deprecating audit dated 2026-05-09 grading the action "D+" and listing issues like "no tests at all", "secrets not masked", "10 npm vulnerabilities". Most of those have been fixed since (PRs fix: secret masking, upload retries, HTTPS enforcement, drop fast-xml-parser #1, test+fix: bootstrap Jest, accept http://[::1] loopback, rebuild dist #2, upload: stream archive to S3 instead of buffering (L20) #5), but the audit text remained — a confusing first impression for customers. Gitignored.

Delete dead code:

• run.sh (legacy Go-binary downloader) was already unreferenced from action.yml and called out as dead code in GRADES.md.

Refresh README:

• Add "What's New in v3" highlighting secret masking, streaming upload to S3, retries with exponential backoff, real test suite, HTTPS enforcement, removed unused vulnerable deps.
• Add "Upgrading From v2" with the one-line uses: diff for customers on buildpulse/buildpulse-action@v2.
• Tighten Development section to mention npm test (which now actually works) and the dist-rebuild contract.

Version alignment:

• package.json was "buildpulse-action" 2.0.0 while the marketplace tag is v3. Renamed to test-reporter-action and bumped to 3.0.0.

Test plan

• npm test — 31/31 passing
• npm run build — dist/ byte-identical to committed (build is reproducible)
• git status — no untracked sensitive files left
• After merge: confirm marketplace page reflects the refreshed README (24h propagation)

🤖 Generated with Claude Code

[loera140]

Agent code review

Walkthrough

Public-readiness cleanup for the marketplace repo: gitignores and removes internal-only docs (CLAUDE.md, GRADES.md), deletes the unreferenced legacy run.sh Go-binary downloader, refreshes README.md with a Quick Start / What's New in v3 / Upgrading From v2 narrative, and aligns package.json name+version with the published v3 marketplace tag (buildpulse-action@2.0.0 → test-reporter-action@3.0.0). No source code under src/, no action.yml, and no dist/ changes — purely docs and metadata.

Findings

• No issues found. Spot-checked that run.sh was not referenced from action.yml (entrypoint is dist/index.js, using: node20), LICENSE exists for the README link, and the new README claims (secret masking, streaming upload, retries, HTTPS enforcement, real test suite) are framed as already-shipped — they match the PR description's references to prior PRs #1/#2/#5 rather than introducing new behavior in this diff.

Verdict

APPROVE. Docs/cleanup-only PR with no behavioral risk to customers. The package.json name change is cosmetic (GitHub Actions resolves the action by the uses: slug, not the name field), and removing unreferenced files (run.sh, internal .mds) cannot break the published action. Adding CLAUDE.md/GRADES.md to .gitignore is appropriate so they do not get re-committed.

Confidence

HIGH — read every changed file plus action.yml and the repo root listing; the /tmp/review-diff.patch and /tmp/changed-lines.tsv files arrived empty so all diff inspection was done against the GitHub API directly.