Skip to content

v0.84.0

Choose a tag to compare

View all tags
@LeanAndMean LeanAndMean released this 26 Aug 17:34
v0.84.0
8ac8d0e
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Scramjet 0.84.0 replaces stored npm publishing credentials with a tag-driven GitHub Actions OIDC release path and adds explicit release-safety checks.

Publication status: npm package publication for this tag did not complete. A follow-up correction is in progress.

Highlights

  • Move toward trusted publishing: Replace NPM_TOKEN-based publication with GitHub Actions OIDC and pin the release toolchain.
  • Add fail-closed release checks: Validate event and package identity, preflight registry state, publish in dependency order, and reject ambiguous failures.
  • Protect package metadata: Preserve non-latest dist-tags, add canonical repository metadata, and reconcile provenance attestations.
  • Document release operations: Add a maintainer runbook covering trusted-publisher setup, verification, and partial-publication recovery.
  • Exercise the release contract: Add focused helper and workflow tests for validation, publication ordering, provenance, and recovery behavior.

Fixes #162.

Assets 2
Loading