release: v0.0.8

[tonychang04]

First fully-automated release — tag will ship binaries + GitHub Release + npm (OIDC trusted publishing, provenance). Carries: agent one-liner (#16), observe-hook fix (#17), repo skill (#19, #20, #21 pipeline).

🤖 Generated with Claude Code

https://claude.ai/code/session_01GMbAe5K1RfwaAcge5inX7P

---

Summary by cubic

Release v0.0.8 with the first fully automated pipeline: tagging now builds and ships binaries, creates a GitHub Release, and publishes to npm using OIDC trusted publishing with provenance. This release includes the agent one-liner, observe-hook fix, repo skill, and the auto-publish pipeline.

^{Written for commit 8ba8c71. Summary will update on new commits.}

[jwfing]

LGTM - approved.

[jwfing]

Review: release: v0.0.8

Summary: A single-line patch version bump (0.0.7 → 0.0.8 in package.json:3) that serves as the source-change to cut the v0.0.8 release; no logic changes.

Requirements context: No /docs/superpowers/ (or docs/specs/) directory exists in this repo — no matching spec/plan found, so I assessed against the PR description and the release pipeline (.github/workflows/release.yml, landed in #20/#21) alone. The PR body accurately describes this as the first release to run the fully-automated tag → binaries + GitHub Release + npm (OIDC trusted publishing, provenance) flow.

Findings

Critical: (none)

Suggestion: (none)

Information

• Software engineering — package.json:3 version bump is correct and monotonic over the existing tags (v0.0.3…v0.0.7), valid semver patch increment. No tests are warranted for a version string.
• Software engineering / release hygiene — package-lock.json:2-9 root entry is "name": "insta-cli", "version": "0.0.0", which drifts from package.json's "name": "insta", "version": "0.0.8". This is pre-existing (unchanged by this PR, and prior releases v0.0.3–v0.0.7 shipped with it) and harmless to the release: npm publish reads package.json, so it publishes insta@0.0.8 regardless, and ci.yml runs npm ci on every push with this same lockfile state (green), so the pipeline's npm ci step won't newly break. Worth tidying in a future housekeeping PR (npm version/npm install would re-sync name + version), but not a blocker for this release.
• Functionality — Confirmed the version bump is the complete source change: install.sh resolves the release via INSTA_VERSION (default latest), and the README install instructions reference main/install.sh with only an illustrative pin example — no hardcoded version strings elsewhere that a release must keep in sync. Note the actual release still requires pushing the v0.0.8 tag (the release.yml push: tags: ['v*'] trigger); this PR only bumps the manifest, as intended.
• Security — No security-relevant changes in this diff (a version string). For context, the out-of-scope publish job correctly uses OIDC trusted publishing (no NPM_TOKEN secret) with --provenance; the stale inline comment at release.yml:94 still referencing a "GRANULAR AUTOMATION token / NPM_TOKEN" is contradicted by the OIDC steps below it — cosmetic, and out of scope for this PR, but worth cleaning up when that file is next touched.
• Performance — Not applicable (no runtime code changed).

Verdict

approved — trivial, correct patch bump with no Critical findings. (Informational verdict; explicit GitHub approval remains a separate human action.)