v1.1.4

One line changed for anyone using the tool. The rest is the repository telling the truth about itself, which is most of what this release is.

The user-visible change

Pushing a tag printed this:

commitlore: notes mirror (origin) failed: spawnSync git ETIMEDOUT. The branch was
pushed; the records for these commits are still only local. …

Nothing was wrong with the transport, and the rest of the line already said what to do. But naming the call that returned rather than the decision that was made reads as git having failed, and sends whoever gets it to look at a remote that is fine.

The two seconds are this hook's — a notes mirror is auxiliary to a branch push, and declining to wait is the hook working. Now:

commitlore: notes mirror (origin) failed: the 2s this hook waits for the remote ran
out. The branch was pushed; …

The value is interpolated from the constant, so the sentence cannot drift from what it describes. Every other failure detail is untouched: a refused connection still reports as a refused connection, because that one really is about the transport.

A contributor no longer needs a Linux Docker build

dist/ is committed, because a first-class install is a git clone. The cost fell on contributors: every pull request touching source had to carry a rebuilt bundle from docker linux/amd64, and someone whose machine cannot produce one waited on a maintainer twice in a single pull request.

A source-only pull request now becomes a product commit without anyone rebuilding by hand. The canonical workflow merges the source onto main, runs the canonical build, and opens a second pull request carrying the result — so every required check runs on the tree that lands, not one resembling it.

Observed rather than argued: a source-only pull request went in, the rebuilt commit came out matching its own source with the bundle authored by the build App, and a hand-tampered bundle was refused by the same path.

The job holding the credential checks what it was handed

The rebuild executes a contributor's package.json and every lifecycle script npm ci pulls in. The publishing job now recomputes the merge itself from main and the pull request ref, pins both parents, and allows a difference only inside dist/ and the manifest. It refuses a pull request that moved while the rebuild ran, reads the pushed branch back by sha rather than trusting the push's exit code, and mints a token scoped to this repository with two permissions instead of whatever the installation happens to hold.

The canonical builder is pinned by digest. node:24-bookworm is a mutable tag, so building twice in one job proved the builder deterministic that morning and nothing about next month.

Documents that were wrong

• The readiness statement named a release two versions old, said no feature work was planned on a day feature work shipped, and listed a defect as current that had been fixed and closed. It now owns the product contract and nothing that moves on its own.
• The upgrade contract was two generations and is three. A hook installed between v1.0.2 and v1.1.2 follows current and still refuses the commit under the PATH git gives a hook — which the compatibility page denied. All four READMEs now carry the same table.
• Three translated READMEs said nothing about upgrading at all, in the release whose predecessor's first line was an upgrade instruction.
• The generated benchmark block lived in four files and was compared in one. It has a single owner now, and a README that grows a second copy fails.

Compatibility

Nothing here changes what a record is, how one is validated, or what any command outputs on success.

If this repository was set up before v1.1.3, run commitlore hooks install in it once — that is unchanged from the previous release and still true.

Install

curl -fsSL https://raw.githubusercontent.com/MongLong0214/commitlore/v1.1.4/install.sh | sh -s v1.1.4

Full notes: CHANGELOG.md