v1.1.1

What's Changed

• Site: show the MetaMask/wallet option, round:N and unconfirmed; add the setup guide by @kpj2006 in #71
• License as GPL-3.0 and add Terms of Use by @kpj2006 in #74
• Say 'wait' while a payout transaction is pending by @kpj2006 in #72
• Confirm /send authors' write access; keep the delegate key out of errors by @kpj2006 in #73
• Bump to 1.1.1 by @kpj2006 in #75

Full Changelog: v1.1.0...v1.1.1

v1.1.0

Summary

Pay contributors from an ordinary wallet (MetaMask, Rabby, a hardware wallet) with no Safe needed, and recover a stuck payout from a PR comment. If you pin v1, you get this release automatically. The default scheme is unchanged, so existing Safe workflows keep working as before.

Added

• scheme: approve: pay from an ordinary wallet. The wallet calls approve(delegate, N) on the token once. CI pays each /send with transferFrom(wallet, recipient, amount) using the delegate key. Set scheme: approve and the new payer input in place of safe. The approval does not reset like a Safe spending limit, so top it up when it runs out. In return, a leaked delegate key can spend only what is left of it, once. Revoke with approve(delegate, 0). GitPay refuses a delegate key that controls the payer itself. (#67)
• round:N on /send. /send 0xabc… 2.50 round:1 pays the same person again on the same PR, deliberately, from a comment. Previously round was only a workflow input, so this needed a workflow edit. Only an author in allowed_associations can /send at all, and a malformed round is refused rather than ignored. (#68)
• STATUS=unconfirmed. A retry that finds a receipt recorded before broadcast and never confirmed now reports unconfirmed and fails, instead of a green already-paid. It still pays nothing. Check the transaction on the explorer: if it succeeded, the contributor is paid; if it failed or never landed, re-send with round:N. (#68)

Fixed

• A call to an address with no contract code (a mistyped token or module address) is refused before anything is recorded. Previously it could mine as a no-op and be recorded as a settled payout. (#67)
• A payout that failed no longer logs settled: <hash>. Timeouts, reverts and lost nonces now log not settled (<code>) with what to do. (#69)
• ERROR_CODE is set for driver refusals, such as a simulation revert or missing contract code. It used to be blank. (#69)
• A transaction the RPC node refuses keeps its hash in TX_HASH, matching the receipt. (#69)

What adopters need to do

• Nothing, if you settle through a Safe.
• If your workflow's report step treats an unknown STATUS as an error, an unconfirmed run now fails it, which is intended. To print the guidance, add a case for unconfirmed.
• To switch to a wallet, follow "Going live without a Safe" in the README.

Verified

scheme: approve was checked against Ethereum Sepolia with throwaway keys. Against the real Circle USDC contract, an unapproved payout, a payer that is the delegate, a token address with no code, an over-cap amount and a non-maintainer were each refused before anything was recorded. A real approve payout is still to be recorded in docs/VERIFIED_CHAINS.md (ROADMAP §0).

Also in this release

• Workflow hardening: every action pinned to a commit SHA, workflow tokens read-only by default (#57), and the anti-slop PR check (#58).
• Brand assets in brand/ (#51) and dependency updates, including eslint 10.

---

What's Changed

• Fix the gitleaks allowlist, which CI's gitleaks 8.24 never loaded by @kpj2006 in #46
• Fill in the best practices checklist (42/49, 86%) by @kpj2006 in #47
• Add brand guidelines by @kpj2006 in #48
• Queue payouts at job level so other comments cannot cancel a pending /send by @kpj2006 in #49
• Close the remaining repo-quality items by @kpj2006 in #50
• Add brand folder: SVG logo, favicons and icons (fixes broken README logo) by @kpj2006 in #51
• chore(deps)(deps): bump react from 19.3.0 to 19.3.1 in /frontend by @dependabot[bot] in #54
• chore(deps)(deps): bump google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml from 2.6.0 to 2.7.0 by @dependabot[bot] in #52
• chore(deps)(deps): bump google/osv-scanner-action/.github/workflows/osv-scanner-reusable-pr.yml from 2.6.0 to 2.7.0 by @dependabot[bot] in #53
• chore(deps)(deps): bump ossf/scorecard-action from 2.4.4 to 2.5.0 by @dependabot[bot] in #41
• chore(deps)(deps-dev): bump @types/node from 26.6.3 to 26.6.5 by @dependabot[bot] in #42
• chore(deps)(deps-dev): bump typescript-eslint from 8.70.1 to 8.71.1 by @dependabot[bot] in #36
• chore(deps)(deps-dev): bump vite from 8.3.1 to 8.3.4 in /frontend by @dependabot[bot] in #37
• chore(deps)(deps-dev): bump @vitejs/plugin-react from 6.1.1 to 6.1.2 in /frontend by @dependabot[bot] in #40
• chore(deps)(deps): bump react-dom from 19.3.0 to 19.3.1 in /frontend by @dependabot[bot] in #55
• Best-practices follow-ups: release notes, CodeQL, gitleaks by @kpj2006 in #56
• Pin workflow actions to SHAs and default tokens to read-only by @kpj2006 in #57
• Add the anti-slop PR check from the AOSSIE template by @kpj2006 in #58
• Add scheme: approve, to pay from an ordinary wallet without a Safe by @kpj2006 in #67
• Accept round:N on /send, and report an unconfirmed receipt as unconfirmed by @kpj2006 in #68
• Never log 'settled' for a payout that did not settle by @kpj2006 in #69
• chore(deps)(deps): bump github/codeql-action/analyze from 4.39.0 to 4.39.1 by @dependabot[bot] in #59
• chore(deps)(deps): bump advanced-security/set-codeql-language-matrix from 1.3.0 to 1.6.0 by @dependabot[bot] in #60
• chore(deps)(deps): bump actions/setup-python from 7.0.0 to 7.1.0 by @dependabot[bot] in #61
• chore(deps)(deps): bump github/codeql-action/upload-sarif from 4.39.0 to 4.39.1 by @dependabot[bot] in #64
• chore(deps)(deps): bump github/codeql-action/init from 4.39.0 to 4.39.1 by @dependabot[bot] in #65
• chore(deps)(deps-dev): bump vite from 8.3.4 to 8.3.5 in /frontend by @dependabot[bot] in #66
• chore(deps)(deps-dev): bump eslint from 9.39.0 to 10.13.0 by @dependabot[bot] in #62
• chore(deps)(deps-dev): bump typescript-eslint from 8.71.1 to 8.72.0 by @dependabot[bot] in #63
• Release v1.1.0: pay from an ordinary wallet, re-pay with round:N by @kpj2006 in #70

Full Changelog: v1.0.1...v1.1.0

v1.0.1

Summary

A security fix for /send commands. Upgrade if you pin v1.0.0; if you pin v1, you already have it.

Fixed

• A /send that names an asset other than the one the workflow pays is now refused. Previously /send 0xabc 25 DAI on a USDC workflow paid 25 USDC under a receipt that said DAI, and USDC, usdc and DAI on one PR produced three different idempotency keys — so one person could be paid up to three times without a round bump. The asset word must now match the asset input (case-insensitive), and every spelling shares one key. (#43)
• The v1 major tag is now looked up exactly before it is moved. (#31)

What adopters need to do

• Nothing. Receipts written by v1.0.0 are still found under the spelling they were written with, so past payouts are not paid again.
• If your /send commands name an asset, make sure the workflow sets the asset input; a named asset with no asset input to compare against is refused.

Also in this release

• The marketing site, https://gitpay.stability.nexus/ (#33).

---

What's Changed

• Close the release gate: v1.0.0 tagged, SBOM and provenance published by @kpj2006 in #32
• Look up the major tag exactly before moving it by @kpj2006 in #31
• Add the marketing site in frontend/ and deploy it to GitHub Pages by @kpj2006 in #33
• Refuse a /send that names a different asset than the workflow pays by @kpj2006 in #43
• Release v1.0.1: ship the /send asset fix by @kpj2006 in #44

Full Changelog: v1.0.0...v1.0.1

v1.0.0

Summary

The first stable release of GitPay: a GitHub Action that pays contributors from your own Safe when a maintainer comments /send <recipient> <amount>. Supported network: Ethereum Sepolia only.

Highlights

• Safe AllowanceModule settlement. Set up a Safe, a period-capped allowance and a delegate once; CI then pays recipients directly from the Safe with no per-payout approval. GitPay never holds funds.
• Dry-run by default. Real payouts require mode: self; an unknown mode is refused.
• Declared policy. enabled (kill switch), allowed_associations and max_per_payout are action inputs, evaluated offline before anything is signed.
• No double payments. Each payout's idempotency key is recorded in a receipt comment on the PR before broadcast; a re-run finds it and does not pay again.
• Simulate before broadcast. eth_call and gas estimation catch an exhausted allowance, missing delegate or empty Safe for zero gas.
• Frozen input schema at schema/action-inputs.v1.schema.json.
• Supply chain. Two runtime dependencies (@noble/curves, @noble/hashes), reproducible dist/, SBOM and signed build provenance on every release.
• Evidence. 20 consecutive live settlements and a merged-PR payout on Sepolia, recorded in docs/VERIFIED_CHAINS.md.

Getting started

Pin StabilityNexus/GitPay@v1 and follow the README's Using the Action. Workflows must serialize payouts with a concurrency group and cancel-in-progress: false.

---

What's Changed

• Add REFERENCES.md and ROADMAP.md for XOps project documentation by @kpj2006 in #2
• chore(deps)(deps): bump step-security/harden-runner from 2.21.0 to 2.21.1 by @dependabot[bot] in #6
• chore: remove initial issues automation files and related configurations by @kpj2006 in #1
• chore(deps)(deps): bump actions/setup-java from 5 to 6 by @dependabot[bot] in #4
• chore(deps)(deps): bump google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml from 2.5.1 to 2.6.0 by @dependabot[bot] in #8
• chore(deps)(deps): bump google/osv-scanner-action/.github/workflows/osv-scanner-reusable-pr.yml from 2.5.1 to 2.6.0 by @dependabot[bot] in #7
• Import the XOps implementation into GitPay by @kpj2006 in #9
• Rename XOps to GitPay by @kpj2006 in #10
• Upgrade brace-expansion and js-yaml past known vulnerabilities by @kpj2006 in #18
• Replace the XOps logo with GitPay artwork by @kpj2006 in #19
• Close three release-gate boxes with tests by @kpj2006 in #20
• Record the live Sepolia evidence in the release gate by @kpj2006 in #21
• Release a Node Action with an SBOM and signed build provenance by @kpj2006 in #22
• chore(deps)(deps): bump actions/setup-node from 4.4.0 to 7.1.0 by @dependabot[bot] in #29
• chore(deps)(deps): bump step-security/harden-runner from 2.21.1 to 2.22.1 by @dependabot[bot] in #28
• chore(deps)(deps): bump actions/upload-artifact from 7.0.1 to 7.0.2 by @dependabot[bot] in #27
• Run the Action on Node 24 by @kpj2006 in #26
• Fix the README quickstart, which could not run by @kpj2006 in #25
• Record 20 consecutive Sepolia settlements and a merged-PR payout by @kpj2006 in #24
• Publish and freeze the input schema; refuse an unknown mode by @kpj2006 in #23
• chore(deps)(deps): bump actions/checkout from 4.4.0 to 7.0.1 by @dependabot[bot] in #16
• chore(deps)(deps-dev): bump typescript-eslint from 8.46.2 to 8.70.1 by @dependabot[bot] in #17
• chore(deps)(deps-dev): bump @types/node from 22.19.0 to 26.6.3 by @dependabot[bot] in #15
• Bump to 1.0.0 and rewrite AGENTS.md for the allowance model by @kpj2006 in #30

New Contributors

• @kpj2006 made their first contribution in #2
• @dependabot[bot] made their first contribution in #6

Full Changelog: https://github.com/StabilityNexus/GitPay/commits/v1.0.0