Highlights
- Automatically publishes the matching public npm package from a published GitHub release using npm trusted publishing and provenance.
- Adds reproducible browser-obstruction evidence and expanded built-CLI failure coverage.
- Updates the C2PA runtime, Commander, Zod, TypeScript, and Vitest dependency lines.
- Uses
unzipper@0.12.5for the repository and tagged Action runtime installation. - Requires Node.js 22.12.0 or later.
Validation
The release commit passed all 90 tests, the isolated composite-action smoke test, C2PA fixture integrity checks, npm packaging validation, and a zero-finding repository audit. The published npm CLI was installed from the public registry and reports version 0.4.0. npm published SLSA provenance for the 49-file tarball.
Known limitation
npm does not propagate a dependency package's overrides into the consuming project's resolution. Consequently, projects installing the npm CLI can still see four high-severity audit findings in @contentauth/c2pa-node's install-time unzipper@0.10.14 → fstream → rimraf → glob → minimatch → brace-expansion chain. The tagged Action and repository lockfile use unzipper@0.12.5; fully removing the warnings for npm consumers requires an upstream C2PA dependency-range update.