feat: default to Shannon 3.0.0 for agentic SAST support

README.md

@@ -110,7 +110,7 @@ with:
 | `api-key` | | - | LLM provider API key (`SHANNON_AI_API_KEY`) for any non-Bedrock provider, including the default Anthropic model. |
 | `aws-bearer-token-bedrock` | | - | Amazon Bedrock bearer token (`AWS_BEARER_TOKEN_BEDROCK`). Required for `model: amazon-bedrock:...`. |
 | `aws-region` | | - | AWS region for Bedrock (`AWS_REGION`). Required for `model: amazon-bedrock:...`. |
-| `version` | | `2.6.0` | Version of the `@keygraph/shannon` npm package to run. |
+| `version` | | `3.0.0` | Version of the `@keygraph/shannon` npm package to run. |
 | `pipeline-testing` | | `false` | Minimal prompts for fast pipeline testing. |
 | `fail-on-severity` | | `none` | Fail the job if any exploited finding is at or above this severity: `none`, `low`, `medium`, `high`, `critical`. See [Pass / fail](#pass--fail). |
 | `upload-sarif` | | `false` | Upload `report.sarif` (when produced) to GitHub code scanning. Requires `security-events: write`. |

action.yml

@@ -49,7 +49,7 @@ inputs:
   version:
     description: 'Version of the @keygraph/shannon npm package to run.'
     required: false
-    default: '2.6.0'
+    default: '3.0.0'
   pipeline-testing:
     description: 'Run with minimal prompts for fast pipeline testing.'
     required: false