Release 0.8.5: migrate to ATRAPS LLC, ship the licence, update dependencies - #262
Merged
Conversation
Record ATRAPS LLC as copyright holder following the executed IP assignment. Two packaging defects surfaced while doing it. No licence text has ever shipped with this crate. LICENSE and NOTICE live at the workspace root, but the package root is dotscope/, and cargo only packages files under the package directory — so every published version declares `license = "Apache-2.0"` while shipping neither the licence nor the NOTICE. Both files now exist inside each member and are included in the packaged crate. LICENSE was also a symlink to LICENSE-APACHE rather than a file. Symlinks do not survive packaging cleanly, so LICENSE is now a regular file and the duplicate LICENSE-APACHE is removed. The README badge, the README link, and the crate-level doc badge in dotscope/src/lib.rs are repointed at it — that doc badge additionally pointed at a `main` branch that did not exist, so it was already dead. - LICENSE / NOTICE: "Copyright 2025-2026 ATRAPS LLC", the year range the commit history actually spans - Cargo.toml: drop `authors` from both members; point workspace `repository` / `homepage` at the org - README: name the holder and repoint badges and links at the org
Prepares for the default-branch rename. `master` appeared in eight places in ci.yml — not only the push and pull_request triggers, but the job conditions gating fuzzing and the security audit, which compare against `refs/heads/master` and the PR base ref. Renaming the branch without these would leave those jobs silently never running.
Upgrade `analyssa` 0.4.1 -> 0.5.0. That release fixes SSA rebuild and phi-transform correctness upstream: on a 125 MB reference binary its pass rollbacks went from 6,094 to 0 and verifier-reported undefined uses from ~28,960 to 0. No API changes were needed here. Upgrade `comfy-table` 7.2.2 -> 8.0.0. v8 removed the preset-string API entirely, so `Table::load_preset(presets::NOTHING)` becomes `Table::load_style(presets::NOTHING)`; presets are now `TableStyle` constants. `NOTHING` is still an empty style, so rendering is unchanged. Refresh everything else with `cargo update`.
Replace the long-lived CARGO_REGISTRY_TOKEN repo secret with a short-lived OIDC token minted per run by crates-io-auth-action and revoked when the job ends. Grafted into the existing publish job rather than replacing the workflow, since release.yml also resolves the version, runs tests, and uploads binary artifacts. The containment check uses `git rev-parse HEAD` rather than $GITHUB_SHA because this job checks out the release tag explicitly.
0.8.4 is already published and its metadata is immutable, so the shipped licence text, corrected copyright holder, dropped `authors` field, and organisation URLs only reach crates.io in a new version. Both workspace members move to 0.8.5. Only `dotscope` is published; `dotscope-cli` has never been on crates.io and stays that way.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Migration of this workspace to ATRAPS LLC ownership, per TRANSFER.md. Two real packaging defects surfaced along the way.
chore: assign copyright and ship the licenceLICENSEandNOTICElive at the workspace root, but the package root isdotscope/, and cargo only packages files under the package directory. Every published version declareslicense = "Apache-2.0"while shipping neither — verified by unpackingdotscope0.8.4 from crates.io: 1,002 files, no licence among them. Both files now exist inside each member and are included in the packaged crate.LICENSEwas a symlink toLICENSE-APACHE, not a duplicate. Symlinks do not survive packaging cleanly, soLICENSEis now a regular file andLICENSE-APACHEis removed. The README badge, README link, and the crate-level doc badge were repointed at it — that doc badge also pointed at amainbranch that did not exist yet, so it was already dead.Copyright 2025-2026 ATRAPS LLC— the year range this history actually spans.authorsdropped from both members; workspacerepository/homepagerepointed; README badges and links repointed.ci: retarget workflows from master to main—masterappeared in eight places inci.yml: not just the triggers, but the job conditions gating fuzzing and the security audit, which comparerefs/heads/masterand the PR base ref. Renaming without these would leave those jobs silently never running.build: update dependenciesanalyssa0.4.1 → 0.5.0, which fixes SSA rebuild and phi-transform correctness upstream (pass rollbacks 6,094 → 0, undefined uses ~28,960 → 0 on a 125 MB reference binary). No API changes needed here.comfy-table7.2.2 → 8.0.0. v8 removed the preset-string API;load_preset(presets::NOTHING)becomesload_style(presets::NOTHING), presets now beingTableStyleconstants.NOTHINGis still an empty style, so rendering is unchanged.cargo update.ci: trusted publishing— grafted into the existing publish job rather than replacingrelease.yml, since that workflow also resolves the version, runs tests, and uploads binaries. The containment check usesgit rev-parse HEADrather than$GITHUB_SHA, because this job checks out the release tag explicitly.chore: release 0.8.5— both members move to 0.8.5. Onlydotscopeis published;dotscope-clihas never been on crates.io and stays that way.Verified locally with this repo’s own CI commands:
cargo fmt --all -- --check,cargo check --workspace --all-features,cargo clippy --workspace --all-features --all-targets -- -D warnings,cargo doc -p dotscope --all-features --no-deps— all clean.cargo package -p dotscope --listnow includesLICENSEandNOTICE.CODECOV_TOKENis retained; onlyCARGO_REGISTRY_TOKENbecomes redundant.