Skip to content

v1.1.2

Choose a tag to compare

View all tags
@github-actions github-actions released this 10 Jul 11:06
· 8 commits to main since this release
v1.1.2
4726e07

Automated Skills Library release for tag v1.1.2.

Assets:

  • secure-vibe-<goos>-<goarch>[.exe] — the single binary: CLI + MCP server (secure-vibe mcp), reproducible build. This is what install.sh and Homebrew download, and what go install .../cmd/secure-vibe@latest produces. Reads its library data from --path / $SECURE_VIBE_LIBRARY_PATH (it does not embed the data tree).
  • checksums-<goos>-<goarch>.txt — SHA-256 of the binary for that platform.
  • manifest.json — library manifest (signed out-of-band before publish).
  • secure-vibe-data.tar.gz — library payload (skills, vulnerabilities, dictionaries, dist, rules, compliance, profiles, manifest.json). This is what secure-vibe update downloads by default. The bundled vulnerabilities/osv/ tree is a small latest-first sample.
  • osv-cache.tar.gz — full upstream OSV catalogue (osv/<eco>/...). Consumed by secure-vibe dev fetch-vulns --from-release to populate the user cache with complete coverage without hitting osv.dev.
  • deltas.tar.gz — patch set against the previous release (best effort).
  • SHA256SUMS.txt — checksum of every asset above.

Verification (post-publish):

  • Verify the binary with the matching checksums-<goos>-<goarch>.txt file.
  • Verify manifest.json with secure-vibe dev manifest verify --path ..
  • The Sign & publish workflow runs the same verification in CI
    before flipping the draft to public.
Assets 17
Loading