Skip to content

v0.0.12

Choose a tag to compare

View all tags
@github-actions github-actions released this 08 Oct 22:26
· 49 commits to main since this release
Immutable release. Only release title and notes can be modified.
v0.0.12
d4269c5
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Tapid 0.0.12 release notes

Tapid 0.0.12 adds npm workspace links and member operations, clearer install diagnostics, stronger installer replay protection, and Apache-2.0 licensing.

Licensing

  • License the Tapid CLI and its supporting crates in this repository under Apache-2.0.
  • Include the full license text in all crate packages.
  • Add tapid license to print the complete license and LimeTip AB copyright attribution offline, without requiring a project.
  • Keep contributions under Apache-2.0 with contributors retaining copyright ownership.

npm workspaces

  • Discover workspace members through supported root declarations and bounded glob patterns. Reject duplicate member names and paths outside the canonical workspace root.
  • Link local workspace packages for ordinary semver dependencies and workspace:*, workspace:^, and workspace:~. Missing or incompatible local targets fail before mutation, without registry fallback.
  • Resolve workspace members' registry dependencies and validate member peers against local members or compatible direct root providers.
  • Support root and selected-member install and lifecycle operations with a root-owned lockfile and managed node_modules activation. prune --workspace replays the workspace-root lockfile without changing the member manifest.
  • Persist workspace identities, dependency edges, and member manifest digests. Revalidate local members during offline and frozen replay.
  • Run explicitly selected workspace scripts from the member directory while keeping containment rooted at the workspace.

Workspace support remains bounded. Glob matching does not implement full npm minimatch semantics. Incompatible ranges for the same registry package across members fail instead of producing separate member-specific versions. Nested peer placement and full npm workspace compatibility remain unsupported. See the compatibility matrix.

Install and lifecycle diagnostics

  • Print categorized diagnostic: codes for install and lifecycle failures, including missing lockfiles, registry credentials, resolution errors, and integrity failures.
  • Distinguish rollback, committed changes with pending cleanup, and recovery-required failures. Explain when changes have already committed so users do not repeat an operation unnecessarily.
  • Report contention retry guidance, bound diagnostic messages, and redact HTTP URL credentials, query values, and fragments.

Operational failures continue to exit with code 1. These changes do not introduce a JSON command protocol.

Installer and workspace security

  • Apply durable release-version and archive-digest checks before installer replacement. Reject downgrades and different executable bytes at the same version, and preserve verified recovery data for interrupted installation.
  • Prevent historical installers from replacing an existing installation with different bytes or bypassing managed release state. Use tapid upgrade for existing managed installations.
  • Reject workspace symlink escapes during discovery, validation, and managed-tree handling. Validate selected script working directories beneath the canonical workspace root.

Release automation

  • Prepare release pull requests containing versions, lockfiles, notes, and an exact release intent. Require preparation to match the current base commit before merge.
  • Bind candidate approval to the source commit, archive and installer digests, and dependency-ordered crate publication plan.
  • Coordinate signing, draft verification, public installation and upgrade checks, and crates.io publication after independent approval.
  • Allow draft verification to read unpublished GitHub assets and retain exact tag and source-commit checks before executing release source.

The automated release lane requires the repository, environment, App, and registry configuration described in release automation.

Changed package versions

All 18 workspace crates have changed packaged license metadata and documentation. Each advances to a new patch version, and internal dependency requirements select the corresponding new versions.

Package Previous published version Version
tapid-archive 0.0.4 0.0.5
tapid-attestations 0.0.3 0.0.4
tapid-core 0.0.6 0.0.7
tapid-linker 0.0.6 0.0.7
tapid-lockfile 0.0.10 0.0.11
tapid-manifest 0.0.8 0.0.9
tapid-policy 0.0.3 0.0.4
tapid-protocol 0.0.4 0.0.5
tapid-publish 0.0.4 0.0.5
tapid-registry-client 0.0.6 0.0.7
tapid-release-client 0.0.4 0.0.5
tapid-resolver 0.0.6 0.0.7
tapid-runner 0.0.5 0.0.6
tapid-signatures 0.0.3 0.0.4
tapid-store 0.0.6 0.0.7
tapid-test-support 0.0.2 0.0.3
tapid-transparency 0.0.3 0.0.4
tapid 0.0.11 0.0.12

Supporting crates retain independent version numbers. Previously published package versions are not replaced.

Assets 14
Loading