docs: update bilingual portal for published GitHub Action v1.0.0

README.md

@@ -20,7 +20,7 @@ The ecosystem has four integration surfaces:
 - `ComplexityAnalysis.Analyzers`: Roslyn diagnostics during builds and IDE analysis.
 - `ComplexityAnalysis.Tool`: a .NET CLI for reports, snapshots, comparison, duplicate detection, and opt-in quality gates.
 - `ComplexityAnalysis.Mcp`: a local, read-only MCP server for compatible AI tools.
-- [Complexity Analysis Action](docs/en/github-action.md): a separately versioned GitHub Action for CI quality gates, JSON/SARIF reports, and pull-request regression checks.
+- [Complexity Analysis Action](https://github.com/rodri-oliveira-dev/complexity-analysis-action/releases/tag/v1.0.0): a separately versioned GitHub Action for CI quality gates, JSON/SARIF reports, and pull-request regression checks. [Install it](https://github.com/rodri-oliveira-dev/complexity-analysis-action#quick-start) or read the [technical guide](docs/en/github-action.md).
 
 The portal source and local development instructions live in [`website/`](website/README.md).
 
@@ -40,6 +40,36 @@ dotnet add package ComplexityAnalysis.Analyzers
 
 The package works as a compile-time analyzer. After installation, Roslyn loads it during builds and IDE analysis; application code does not call the analyzer and does not take a runtime dependency on it. For local package creation and repository-based consumption, see [Getting Started](docs/en/getting-started.md).
 
+## GitHub Action v1.0.0
+
+The separately maintained [Complexity Analysis Action v1.0.0](https://github.com/rodri-oliveira-dev/complexity-analysis-action/releases/tag/v1.0.0) was released on October 30, 2026. It runs the published CLI in GitHub Actions on supported Ubuntu runners; its version is independent of the Analyzer, CLI, and MCP versions.
+
+Add this workflow to `.github/workflows/complexity.yml` in the consuming repository and replace `MySolution.slnx` with your C# project or solution path:
+
+```yaml
+name: Complexity Analysis
+
+on:
+  pull_request:
+
+permissions:
+  contents: read
+
+jobs:
+  complexity:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+        with:
+          persist-credentials: false
+      - name: Analyze complexity
+        uses: rodri-oliveira-dev/complexity-analysis-action@2d807ef29ca03c685d224543a135d8c30dfe2c67
+        with:
+          path: MySolution.slnx
+```
+
+The example pins the reviewed `v1.0.0` commit for reproducibility. The published tag `@v1.0.0` is also available, but the moving `@v1` alias has not been created; do not use it until that reference exists. See the [Action installation instructions](https://github.com/rodri-oliveira-dev/complexity-analysis-action#quick-start) and [release notes](https://github.com/rodri-oliveira-dev/complexity-analysis-action/releases/tag/v1.0.0).
+
 ## Quick example
 
 ```csharp
@@ -376,7 +406,7 @@ See [Architecture](docs/en/architecture.md).
 - [C# Halstead Metrics](docs/en/halstead-metrics.md)
 - [Project-Level Tooling](docs/en/project-tooling.md)
 - [Local MCP Server](docs/en/mcp-server.md)
-- [GitHub Action for CI and pull requests](docs/en/github-action.md)
+- [GitHub Action v1.0.0 release](https://github.com/rodri-oliveira-dev/complexity-analysis-action/releases/tag/v1.0.0) and [installation](https://github.com/rodri-oliveira-dev/complexity-analysis-action#quick-start) · [Technical guide](docs/en/github-action.md)
 - [Runnable sample](samples/ComplexityAnalysis.Sample/README.md)
 - [Release Quality Governance](docs/en/development/quality-gates.md)
 - [Documentação em português](README.pt-BR.md)

README.pt-BR.md

@@ -20,7 +20,7 @@ O ecossistema possui quatro formas de integração:
 - `ComplexityAnalysis.Analyzers`: diagnósticos Roslyn durante builds e análise na IDE.
 - `ComplexityAnalysis.Tool`: CLI .NET para relatórios, snapshots, comparação, detecção de duplicação e quality gates opt-in.
 - `ComplexityAnalysis.Mcp`: servidor MCP local e somente leitura para ferramentas de IA compatíveis.
-- [Complexity Analysis Action](docs/pt-BR/github-action.md): GitHub Action com versionamento independente para quality gates no CI, relatórios JSON/SARIF e análise de regressões em PRs.
+- [Complexity Analysis Action](https://github.com/rodri-oliveira-dev/complexity-analysis-action/releases/tag/v1.0.0): GitHub Action com versionamento independente para quality gates no CI, relatórios JSON/SARIF e análise de regressões em PRs. Veja a [instalação](https://github.com/rodri-oliveira-dev/complexity-analysis-action#quick-start) ou o [guia técnico](docs/pt-BR/github-action.md).
 
 O código-fonte do portal e as instruções de desenvolvimento local ficam em [`website/`](website/README.md).
 
@@ -40,6 +40,36 @@ dotnet add package ComplexityAnalysis.Analyzers
 
 O pacote funciona como um analyzer de tempo de compilação. Depois da instalação, o Roslyn o carrega durante builds e análise na IDE; o código da aplicação não chama o analyzer e não assume uma dependência de runtime nele. Para criação local do pacote e consumo a partir do repositório, veja [Primeiros Passos](docs/pt-BR/getting-started.md).
 
+## GitHub Action v1.0.0
+
+A [Complexity Analysis Action v1.0.0](https://github.com/rodri-oliveira-dev/complexity-analysis-action/releases/tag/v1.0.0) foi publicada em 30 de outubro de 2026. Ela executa a CLI publicada no GitHub Actions, em runners Ubuntu suportados, e possui versionamento independente do Analyzer, da CLI e do MCP.
+
+Crie o workflow `.github/workflows/complexity.yml` no repositório consumidor e substitua `MySolution.slnx` pelo caminho do projeto ou solução C#:
+
+```yaml
+name: Complexity Analysis
+
+on:
+  pull_request:
+
+permissions:
+  contents: read
+
+jobs:
+  complexity:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+        with:
+          persist-credentials: false
+      - name: Analyze complexity
+        uses: rodri-oliveira-dev/complexity-analysis-action@2d807ef29ca03c685d224543a135d8c30dfe2c67
+        with:
+          path: MySolution.slnx
+```
+
+O exemplo utiliza o SHA revisado da `v1.0.0` para maior reprodutibilidade. A tag publicada `@v1.0.0` também está disponível, mas a referência móvel `@v1` ainda não foi criada; não a utilize até que esse alias exista. Consulte as [instruções de instalação](https://github.com/rodri-oliveira-dev/complexity-analysis-action#quick-start) e as [notas da release](https://github.com/rodri-oliveira-dev/complexity-analysis-action/releases/tag/v1.0.0).
+
 ## Exemplo rápido
 
 ```csharp
@@ -379,7 +409,7 @@ Veja [Arquitetura](docs/pt-BR/architecture.md).
 - [Métricas Halstead para C#](docs/pt-BR/halstead-metrics.md)
 - [Ferramentas em Nível de Projeto](docs/pt-BR/project-tooling.md)
 - [Servidor MCP Local](docs/pt-BR/mcp-server.md)
-- [GitHub Action para CI e pull requests](docs/pt-BR/github-action.md)
+- [Release da GitHub Action v1.0.0](https://github.com/rodri-oliveira-dev/complexity-analysis-action/releases/tag/v1.0.0) e [instalação](https://github.com/rodri-oliveira-dev/complexity-analysis-action#quick-start) · [Guia técnico](docs/pt-BR/github-action.md)
 - [Sample executável](samples/ComplexityAnalysis.Sample/README.md)
 - [Governança de Qualidade de Release](docs/pt-BR/development/quality-gates.md)
 - [Documentation in English](README.md)

docs/en/github-action.md

@@ -4,7 +4,12 @@
 
 `Complexity Analysis Action` makes the existing [ComplexityAnalysis.Tool](project-tooling.md) available in GitHub Actions workflows. It **does not** implement a second analyzer. Use the Roslyn package for diagnostics in your IDE/build, the CLI for local or custom automation, the MCP server for AI-tool integrations, and the GitHub Action when you want reusable CI checks and pull-request feedback.
 
-The Action lives in a **separate repository** and has its own release cycle. The planned first stable Action release is `v1.0.0`; **as of this documentation update it has not been published**, so `@v1` and `@v1.0.0` must not be treated as existing tags. Review the [Action repository](https://github.com/rodri-oliveira-dev/complexity-analysis-action) for current status before adopting it.
+The Action lives in a **separate repository** and has its own release cycle.
+Its first stable version, [`v1.0.0`](https://github.com/rodri-oliveira-dev/complexity-analysis-action/releases/tag/v1.0.0),
+was published on October 30, 2026. The `@v1.0.0` version tag exists and
+points to the reviewed commit `2d807ef29ca03c685d224543a135d8c30dfe2c67`. The moving
+`@v1` major-version alias has **not** been created yet. GitHub Release
+publication does not by itself confirm a public Marketplace listing.
 
 ## What it offers
 
@@ -18,13 +23,21 @@ A complexity estimate is **not** a runtime benchmark or proof of actual latency.
 
 ## Requirements and versioning
 
-The current release candidate supports Ubuntu runners with Bash, Python 3, and access to NuGet.org. It installs the .NET 10 SDK and the **exact** published `ComplexityAnalysis.Tool` version specified by `tool-version` (currently `1.0.1` by default). The CLI, Action, Analyzer, and MCP packages have **independent versions**.
+The published `v1.0.0` supports Ubuntu runners with Bash, Python 3, and
+access to NuGet.org. It installs .NET SDK `10.0.403` and uses the exact
+published `ComplexityAnalysis.Tool` version supplied by `tool-version`
+(`1.0.1` by default). Windows and macOS have not been validated as supported
+runners. The CLI, Action, Analyzer, and MCP have **independent versions**.
 
-Before the first stable release, use a **reviewed full 40-character commit SHA** from the Action repository in `uses:`. The placeholder below is intentionally not executable. When a stable version is published, a specific release tag such as `@v1.0.0` or a full SHA may be used; `@v1` is only available when the maintainers create that major-version reference.
+For reproducible consumption, prefer the full 40-character reviewed release
+commit SHA in `uses:`; the published `@v1.0.0` tag is also available.
+Do not use `@v1` until its compatibility reference is created and verified.
+The public release-tag ruleset and GitHub Release immutability are separate
+controls; do not assume the latter is enabled.
 
 ## Example: analyze a pull request
 
-Save the following as `.github/workflows/complexity.yml` in the **consumer** repository, after replacing `REVIEWED_FULL_40_CHARACTER_SHA` and `MySolution.slnx`:
+Save the following as `.github/workflows/complexity.yml` in the **consumer** repository. It is pinned to the published Action release commit; replace only `MySolution.slnx` with the path to your `.csproj`, `.sln`, or `.slnx`:
 
 ```yaml
 name: Complexity analysis
@@ -39,11 +52,11 @@ jobs:
   analyze:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
         with:
           persist-credentials: false
       - id: complexity
-        uses: rodri-oliveira-dev/complexity-analysis-action@REVIEWED_FULL_40_CHARACTER_SHA
+        uses: rodri-oliveira-dev/complexity-analysis-action@2d807ef29ca03c685d224543a135d8c30dfe2c67
         with:
           path: MySolution.slnx
           max-cyclomatic-complexity: "15"
@@ -53,7 +66,17 @@ jobs:
           fail-on-regression: "true"
 ```
 
-This example is **read-only**; it does not post comments, upload SARIF, or expose a write-capable token. The Action reports comparison problems separately from confirmed regressions. To retain report files after the job, add an `actions/upload-artifact` step using the Action's output paths.
+This example uses **read-only** permissions: it does not post comments, upload
+SARIF to Code Scanning, or expose a write-capable token. The Action reports
+unavailable comparisons separately from confirmed regressions; a missing
+baseline is not proof of no regressions. To retain reports after the job,
+add a SHA-pinned `actions/upload-artifact` step using the Action's output paths.
+
+For additional runnable workflows, use the
+[updated examples on the Action's `main` branch](https://github.com/rodri-oliveira-dev/complexity-analysis-action/tree/main/examples).
+The `v1.0.0` tag preserves its original release snapshot, including
+documentation examples that still contain pre-publication placeholders;
+the corrected, executable examples were committed to `main` after the release.
 
 ## Inputs and outputs
 
@@ -90,15 +113,15 @@ The Action exposes `report-path`, `sarif-path`, `analysis-status`, `quality-gate
 | Optional direct PR comment in a trusted same-repository workflow | `contents: read`, `pull-requests: write` |
 | Fork PR feedback | Read-only analysis plus a separate privileged `workflow_run` publisher |
 
-Never analyze untrusted pull-request code under `pull_request_target`, and never give write-capable credentials or secrets to a job loading untrusted projects. MSBuild project evaluation may execute project-controlled logic; the Action is **not** a sandbox. For fork PRs, keep analysis read-only and use the Action's [isolated publisher example](https://github.com/rodri-oliveira-dev/complexity-analysis-action/blob/feature/release-readiness/examples/secure-pr-publish.yml) if comments are required. Avoid copying that privileged workflow without reviewing the artifact-provenance restrictions.
+Never analyze untrusted pull-request code under `pull_request_target`, and never give write-capable credentials or secrets to a job loading untrusted projects. MSBuild project evaluation may execute project-controlled logic; the Action is **not** a sandbox. For fork PRs, keep analysis read-only and use the Action's [isolated publisher example](https://github.com/rodri-oliveira-dev/complexity-analysis-action/blob/main/examples/secure-pr-publish.yml) if comments are required. Avoid copying that privileged workflow without reviewing the artifact-provenance restrictions.
 
 ## Troubleshooting
 
-- **Action not found at `@v1` or `@v1.0.0`:** the initial release and tag alias may not exist. Check [releases](https://github.com/rodri-oliveira-dev/complexity-analysis-action/releases) and pin a reviewed commit SHA during evaluation.
-- **Unsupported runner:** the current release candidate documents Ubuntu only; Windows/macOS have not passed equivalent end-to-end validation.
+- **Action not found at `@v1`:** that moving alias has not yet been created. Use the published `@v1.0.0` tag or approved release commit SHA above. If `@v1.0.0` fails, confirm the repository reference and the [published release](https://github.com/rodri-oliveira-dev/complexity-analysis-action/releases/tag/v1.0.0).
+- **Unsupported runner:** `v1.0.0` supports Ubuntu only; Windows/macOS have not passed equivalent end-to-end validation.
 - **Missing project or unexpected comparison failure:** confirm the path exists and the entry point can be resolved at both base and head revisions. A missing baseline is **not** “no regressions.”
 - **NuGet/tool installation error:** check network access, the .NET 10 requirement, and that `tool-version` is an exact published version.
 - **SARIF upload or comment denied:** review token permissions, Code Scanning availability, fork restrictions, and the security split between analysis and publishing.
 - **Configured gates fail:** a quality-gate failure is separate from a proven regression; inspect `quality-gate-status`, `comparison-status`, and the JSON reports.
 
-For complete workflow examples, visit the [Action repository](https://github.com/rodri-oliveira-dev/complexity-analysis-action/tree/feature/release-readiness/examples). For standalone CLI commands, use [Project-Level Tooling](project-tooling.md).
+For complete workflow examples, visit the [Action repository](https://github.com/rodri-oliveira-dev/complexity-analysis-action/tree/main/examples). For standalone CLI commands, use [Project-Level Tooling](project-tooling.md).

docs/en/project-tooling.md

@@ -306,4 +306,21 @@ those dependencies are not exposed to analyzer package consumers.
 
 ## GitHub Actions integration
 
-For ready-to-use CI configuration built on this CLI, see the [GitHub Action guide](github-action.md). The separately maintained Action invokes the published CLI; it does not change metric semantics, quality-gate defaults, or snapshot comparison behavior. Action and CLI releases are independent. Do not assume the planned Action `v1.0.0` exists until it is publicly released.
+For reusable GitHub CI analysis, use the separately maintained
+[Complexity Analysis Action](https://github.com/rodri-oliveira-dev/complexity-analysis-action#quick-start). Its
+[stable `v1.0.0` release](https://github.com/rodri-oliveira-dev/complexity-analysis-action/releases/tag/v1.0.0)
+was published on 2026-10-30 and installs the exact published
+`ComplexityAnalysis.Tool` version `1.0.1` by default.
+
+Choose the CLI directly for local execution or custom CI orchestration; choose
+the Action for reusable GitHub Actions workflows with JSON/SARIF reporting,
+opt-in quality gates, and pull-request regression comparison. Both invoke the
+same analysis engine and preserve identical metric and snapshot semantics.
+Their versions are independent of each other and of the Analyzer and MCP.
+
+For reproducibility, pin the Action to the reviewed `v1.0.0` release commit
+`2d807ef29ca03c685d224543a135d8c30dfe2c67`; the published `@v1.0.0` tag is another
+supported option. The moving `@v1` alias has not been created yet. See the
+[GitHub Action guide](github-action.md) and
+[published examples](https://github.com/rodri-oliveira-dev/complexity-analysis-action/tree/main/examples) for
+supported inputs and security considerations.