Skip to content

v0.1.0-beta.2

Pre-release
Pre-release

Choose a tag to compare

View all tags
@github-actions github-actions released this 20 Oct 07:12
· 3 commits to main since this release
v0.1.0-beta.2
71f75b1
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Verified Beta Release

Source: 71f75b12bfd6930ec945ed137546c5e092fc4907 (Go 1.27.3).

  • Native merged-source CI: all nine checks passed, including macOS/Linux/Windows race tests and native archive installation.
  • Release workflow: validation, reachable-vulnerability scan, current owner-contract check, archive preflight, publication, source SPDX SBOM attachment and build provenance all passed.
  • All five downloaded archive checksums and member inventories passed. The installed native executable reports exactly 0.1.0-beta.2 and passes help, isolated profile import/readback and missing-credential checks.
  • All eight downloaded assets passed provenance verification constrained to this repository, release workflow, exact source SHA and tag, with GitHub-hosted runners required. The source SBOM asset is convai-cli-sbom.spdx.json. It is a source SBOM, not a per-binary SBOM or OS code signature.
  • Downloaded macOS ARM64 and Linux ARM64 binaries each passed 42 direct-REST/API-key command mappings plus ten negative cases against an isolated synthetic HTTPS owner. Linux AMD64 passed the same suite under emulation. These are not live SaaS or customer-environment tests. Downloaded Windows and macOS Intel runtime acceptance is not claimed; native source/archive CI and all archive/provenance checks are separate evidence.

This successor preserves the incomplete v0.1.0-beta.1 tag and assets. Use beta.2 rather than the incomplete beta.1 release. No hosted service was deployed.

As of October 20, the repository remains private, so these assets require repository access. Public download availability is pending the owner's visibility/license decision. There is no Homebrew, WinGet, npm or self-updating installer. The executable requires no Go/Node/Python runtime. macOS notarization and Windows code signing are not configured; follow the customer's installation/signing policy without bypassing OS protections.

Actual customer HTTPS/API compatibility, CA/network access, authorization and disposable-resource acceptance remain separate handoff gates. On-prem OAuth/SSO is not required for existing API-key use and remains parked.

Changelog

  • 357d045 Merge pull request #12 from Conv-AI/codex/cli-release-sbom-permissions
  • ff483ea Merge pull request #14 from Conv-AI/codex/cli-current-owner-contract
  • 71f75b1 Merge pull request #15 from Conv-AI/codex/cli-config-read-lock
  • fe99204 Merge remote-tracking branch 'origin/codex/cli-current-owner-contract' into codex/cli-release-sbom-permissions
  • 55a63a0 fix: allow SBOM release artifact download with least privilege
  • 602140e fix: refresh owner contracts and patched release toolchain
  • f433721 fix: serialize config reads with concurrent profile updates
Assets 10
Loading