Skip to content

v0.84.1

Choose a tag to compare

View all tags
@LeanAndMean LeanAndMean released this 26 Aug 22:30
· 12 commits to main since this release
v0.84.1
59250b5
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Scramjet 0.84.1 makes trusted-OIDC releases tolerate normal multi-minute npm registry and provenance propagation, enabling corrected forward recovery from the partial v0.84.0 publication.

Recovery release: v0.84.0 remains immutable and will not be rerun. This release preserves fail-closed artifact verification while completing recovery through the normal OIDC path.

Highlights

  • Allow npm propagation time: Poll registry visibility, latest tags, and provenance for up to 31 attempts at ten-second intervals without republishing.
  • Keep recovery fail-closed: Continue verifying package identity, exact artifacts, provenance, dependency order, and dist-tags before advancing.
  • Clarify forward recovery: Document the partial v0.84.0 outcome and require a corrected forward release rather than rerunning its immutable tag.
  • Exercise delayed visibility: Add multi-minute registry, tag, provenance, and polling-exhaustion coverage.

Fixes #503.

Reviewed by GPT-5.6 Sol

Assets 2
Loading