ci: run tests on every branch, add provenance, and gate publishing

CI only ran on pushes to main and develop, so a feature branch was checked by
nothing until it became a PR. It now runs on every branch, cancels superseded
runs, tests on Node 24 as well as 20 and 22, and runs `pnpm test` — which the
mongo and postgres workflows never did because there were no tests.

publish.yml had no `id-token: write`, so releases carried no npm provenance,
and nothing verified that the tag matched package.json — a mismatched tag would
have published the wrong version. It now checks that first, lints, builds and
tests before publishing, publishes with `--provenance`, and reads the release
notes from CHANGELOG.md with awk taking the version from the environment rather
than interpolating it into the script. The job is gated on an `npm`
environment so an irreversible publish can require approval.

Adds the missing SECURITY.md — with the operational notes this tool needs,
since it takes database credentials and can change server state — plus
CODE_OF_CONDUCT.md and CODEOWNERS. Bumps the version to 1.1.0 with a changelog
entry.

Author: deniscuciuc

CHANGELOG.md

@@ -7,6 +7,46 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [1.1.0] - 2026-09-10
+
+### Added
+
+- A programmatic API. `PostgresAnalyzer` is exported from the package root, alongside the
+  analyzers, collectors, reporters and every report type. Importing the package now has
+  no side effects — previously `require("@deniscuciuc/pg-analyzer")` connected to the
+  database and ran an analysis, because the CLI was the package entry point and
+  `main`/`types` pointed at it. The CLI moved to `src/cli/main.ts` and is still reached
+  through the `pg-analyzer` binary.
+- A test suite. `pnpm test` runs it, and CI runs it on Node 20, 22 and 24.
+- `SECURITY.md` and `CODE_OF_CONDUCT.md`.
+
+### Fixed
+
+- `--watch -1` was mistaken for a flag and silently replaced by the default interval
+  instead of being rejected.
+- Numeric flags were parsed with no validation, so `--port abc` produced `NaN` and
+  surfaced as a confusing driver error far from the actual mistake. Each flag now reports
+  its own name.
+- A flag at the end of the argument list stored `undefined` rather than failing.
+- An unknown flag was silently ignored, so a typo like `--jsno` produced human-readable
+  output instead of JSON.
+- The connection is no longer torn down by an unhandled `error` event: with no listener
+  attached, an idle-connection failure terminated the process, which was near-certain in
+  `--watch` mode.
+- Ctrl+C during a query did nothing, and a second Ctrl+C did nothing either, so the CLI
+  appeared to hang. A second signal now exits, and `SIGTERM` is handled so `docker stop`
+  reaches the connection cleanup.
+- `process.exitCode` is set instead of calling `process.exit`, which could truncate
+  buffered output when piping `--json` to a file.
+
+### Changed
+
+- The npm tarball no longer contains the compiled tests.
+- Stricter TypeScript (`noUncheckedIndexedAccess` and friends) and Biome rules; unused
+  variables and imports are errors rather than warnings.
+- CI runs on every branch, not just `main` and `develop`, and cancels superseded runs.
+- Publishing now emits npm provenance and verifies the tag matches `package.json`.
+
 ## [1.0.0] - 2026-06-13
 
 ### Added

CONTRIBUTING.md

@@ -37,7 +37,7 @@ pnpm lint:fix
 
 ## Coding standards
 
-- TypeScript strict mode - no `any`
+- TypeScript strict mode, with `noUncheckedIndexedAccess` — and no `any`, which Biome enforces
 - Biome formatting (tab indent, enforced by CI)
 - No new runtime dependencies without discussion in an issue first
 

package.json

@@ -1,6 +1,6 @@
 {
   "name": "@deniscuciuc/pg-analyzer",
-  "version": "1.0.0",
+  "version": "1.1.0",
   "description": "CLI tool that analyzes PostgreSQL databases for performance issues \u2014 indexes, slow queries, table bloat, connections and cache health.",
   "keywords": [
     "postgresql",