v0.4.0

Highlights

• Automatically publishes the matching public npm package from a published GitHub release using npm trusted publishing and provenance.
• Adds reproducible browser-obstruction evidence and expanded built-CLI failure coverage.
• Updates the C2PA runtime, Commander, Zod, TypeScript, and Vitest dependency lines.
• Uses unzipper@0.12.5 for the repository and tagged Action runtime installation.
• Requires Node.js 22.12.0 or later.

Validation

The release commit passed all 90 tests, the isolated composite-action smoke test, C2PA fixture integrity checks, npm packaging validation, and a zero-finding repository audit. The published npm CLI was installed from the public registry and reports version 0.4.0. npm published SLSA provenance for the 49-file tarball.

Known limitation

npm does not propagate a dependency package's overrides into the consuming project's resolution. Consequently, projects installing the npm CLI can still see four high-severity audit findings in @contentauth/c2pa-node's install-time unzipper@0.10.14 → fstream → rimraf → glob → minimatch → brace-expansion chain. The tagged Action and repository lockfile use unzipper@0.12.5; fully removing the warnings for npm consumers requires an upstream C2PA dependency-range update.

art50-ci v0.3.0 — zero-setup GitHub Action

Zero-setup GitHub Action

Practical guides:

• Regression-test a declared Article 50 AI disclosure in CI
• Test whether C2PA Content Credentials survive CDN delivery

Use art50-ci in a GitHub-hosted Linux job without adding it to the caller's package manifest:

- uses: actions/checkout@v6
- uses: Rubiss/art50-ci@v0.3.0
  with:
    config: .art50-ci.yml

The composite action installs its runtime under GITHUB_ACTION_PATH and installs Chromium by default. For a completed audit, it uploads the validated JSON/HTML/screenshot/provenance report directory before propagating exit code 0 or 1. Configuration or execution errors return 2; an error before report creation may produce no artifact.

Inspect the public released-version C2PA pass and stripped-delivery proof.

Release safeguards

• JavaScript dependencies are installed from the tagged lockfile with lifecycle scripts disabled.
• The platform-specific C2PA native archive is verified against a release-pinned SHA-256 digest before extraction.
• Nested setup and artifact actions are pinned to full commit SHAs.
• The report output must be a new or empty repository-relative directory; escaping symlinks and generated symlinks are rejected.
• CI proves pass and intentional-failure behavior in an isolated non-Node consumer workspace, including evidence retention before exit 1.

Report and provenance schemas remain version 2. Configuration remains version 1; no configuration migration is required. The action currently supports GitHub-hosted Linux runners.

Local install

npm install --save-dev art50-ci@0.3.0
npx playwright install chromium

The npm package, GitHub release tarball, and tagged Action are all available. For a release-asset install instead:

npm install --save-dev https://github.com/Rubiss/art50-ci/releases/download/v0.3.0/art50-ci-0.3.0.tgz

Release-asset SHA-256: 3d6fbe0c392becc3512d44183b06877e2ad19d4d274ddeb0bce3d4d3a468fda1

art50-ci v0.2.0 — portable report schema

This release makes generated evidence portable and privacy-minimised.

Highlights:

• Audit reports and standalone provenance evidence now use schemaVersion: 2; configuration remains version: 1.
• Persisted local configPath, target, resolvedTarget, and finalUrl values use $CONFIG_DIR/... or $LOCAL_FILE instead of absolute host paths.
• screenshotPath and evidencePath are document-relative, so report bundles can move between local and CI environments.
• Diagnostic fields redact known and unknown absolute filesystem paths while runtime objects and CLI output paths remain absolute for local use.
• Query strings, fragments, and URL credentials remain redacted.
• Added cross-platform regression coverage for Windows, UNC, POSIX, file-URL, missing-file, aggregate-report, and direct-evidence cases.

Upgrade advisory:

• Regenerate reports created with v0.1.0 before sharing them. Existing public v0.1.0 artifacts may contain a host path or username and should be removed or replaced.
• JSON consumers should branch on schemaVersion and reject unknown versions.
• Two-argument writeReports() calls remain privacy-safe; pass { baseDirectory } for the most precise $CONFIG_DIR/... projection.

Install from this release:

npm install --save-dev https://github.com/Rubiss/art50-ci/releases/download/v0.2.0/art50-ci-0.2.0.tgz
npx playwright install chromium
npx art50-ci verify https://art50-ci.rubiss89.chatgpt.site --selector '[data-product-boundary]' --text 'No legal compliance verdicts.'

SHA-256 (art50-ci-0.2.0.tgz):
7726160cbe827eebe5c13b6fddfdecbeb841708c504ce2efb9ca38e8ab2b3457

art50-ci reports configured technical observations. It does not provide legal advice, certification, signer-trust verification, authenticity guarantees, or legal-compliance conclusions. See the changelog for compatibility details.

art50-ci v0.1.0

Warning

Superseded by v0.2.0. Reports and provenance evidence generated by v0.1.0 may contain absolute local paths, including a host username. Upgrade and regenerate reports before sharing them; remove or replace any v0.1.0 report artifacts already published.

First technical preview of art50-ci: local-first regression tests for declared AI disclosures and C2PA provenance in delivered experiences.

Highlights:

• Checks configured disclosure text, initial-render visibility, sampled obstruction, and basic accessible names in Chromium.
• Compares source and delivered C2PA manifests through recursive ingredient ancestry.
• Produces JSON, HTML, screenshots, timestamps, and hashes without telemetry or media uploads.
• Denies private-network access unless the exact origin is requested in config and granted at runtime.

Install this release before the npm package is available:

npm install --save-dev https://github.com/Rubiss/art50-ci/releases/download/v0.1.0/art50-ci-0.1.0.tgz
npx playwright install chromium
npx art50-ci init

This tool reports configured technical observations. It does not provide legal advice, certification, signer-trust verification, or a legal compliance conclusion.