v0.5.1

Patch release. The v0.5.0 crate published to crates.io was incomplete
and would not compile, so cargo install jarvy and the cargo path of
jarvy update both failed. This fixes that and hardens the release
pipeline so package managers actually receive each release.

Fixes:

• Fix cargo install jarvy failing to compile with couldn't read .../assets/wizard-skill/SKILL.md. The wizard embeds that file via
  include_str!, but it fell outside the Cargo.toml include
  allowlist, so cargo publish stripped it from the tarball. Local and
  CI builds passed because the file exists in the working tree — only
  the published crate was broken. If you hit this on v0.5.0, install
  v0.5.1 (or a prebuilt binary / Homebrew / the install script).
• Add a package-verify CI job that compiles the packaged crate via
  cargo publish --dry-run, so a missing embedded asset now fails at
  pull-request time instead of after publishing an immutable release.

Release automation:

• Auto-publish to package managers on every stable release. crates.io,
  Homebrew, and Chocolatey were being skipped because the release: published event does not trigger downstream workflows when the
  release is cut by CI's built-in token; the release workflow now
  dispatches the publish workflow explicitly (stable tags only).
• Fix the release job's downstream dispatches, which had been failing
  with a permissions error and silently skipping the post-release
  validation and publish workflows.
• Raise the release test-gate poll budget from 15 to 40 minutes so a
  slow Windows test leg no longer times the release out before it goes
  green.

Full Changelog: v0.5.0...v0.5.1

Installation

Quick Install (Unix)

curl -fsSL https://raw.githubusercontent.com/Cliftonz/jarvy/main/dist/scripts/install.sh | bash

Quick Install (Windows PowerShell)

irm https://raw.githubusercontent.com/Cliftonz/jarvy/main/dist/scripts/install.ps1 | iex

Homebrew

brew install Cliftonz/tap/jarvy

Cargo

cargo install jarvy

Early-Release Channel

Pre-release tags (-rc.N, -beta.N) are routed through the beta channel.
Opt in: JARVY_CHANNEL=beta on the install script, or jarvy update --channel beta.
See docs/release-testing.md.

See installation docs for more options.

Security

Verify Signatures

All release artifacts are signed with Sigstore keyless OIDC. Verify any artifact:

# Substitute a triple that matches your platform, e.g.
# aarch64-apple-darwin, x86_64-unknown-linux-musl,
# aarch64-unknown-linux-gnu, x86_64-pc-windows-msvc (.zip).
ARTIFACT=jarvy-v0.5.1-x86_64-unknown-linux-musl.tar.gz
BASE=https://github.com/Cliftonz/jarvy/releases/download/v0.5.1
curl -LO $BASE/$ARTIFACT
curl -LO $BASE/$ARTIFACT.sig
curl -LO $BASE/$ARTIFACT.pem
cosign verify-blob \
  --signature $ARTIFACT.sig \
  --certificate $ARTIFACT.pem \
  --certificate-identity-regexp '^https://github\.com/Cliftonz/jarvy/\.github/workflows/release\.yml@refs/tags/v[0-9.]+(-[A-Za-z0-9.]+)?$' \
  --certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
  $ARTIFACT

Tag Signature

This release was cut from a signed git tag. Verify with:

git -c gpg.ssh.allowedSignersFile=.github/allowed_signers tag --verify v0.5.1

SBOM

Software Bill of Materials in SPDX 2.3 (sbom.spdx.json) and CycloneDX 1.4 (sbom.cdx.json).

Checksums

SHA256 checksums for all artifacts are in SHA256SUMS.txt.