v1.0.1

Summary

A security fix for /send commands. Upgrade if you pin v1.0.0; if you pin v1, you already have it.

Fixed

• A /send that names an asset other than the one the workflow pays is now refused. Previously /send 0xabc 25 DAI on a USDC workflow paid 25 USDC under a receipt that said DAI, and USDC, usdc and DAI on one PR produced three different idempotency keys — so one person could be paid up to three times without a round bump. The asset word must now match the asset input (case-insensitive), and every spelling shares one key. (#43)
• The v1 major tag is now looked up exactly before it is moved. (#31)

What adopters need to do

• Nothing. Receipts written by v1.0.0 are still found under the spelling they were written with, so past payouts are not paid again.
• If your /send commands name an asset, make sure the workflow sets the asset input; a named asset with no asset input to compare against is refused.

Also in this release

• The marketing site, https://gitpay.stability.nexus/ (#33).

---

What's Changed

• Close the release gate: v1.0.0 tagged, SBOM and provenance published by @kpj2006 in #32
• Look up the major tag exactly before moving it by @kpj2006 in #31
• Add the marketing site in frontend/ and deploy it to GitHub Pages by @kpj2006 in #33
• Refuse a /send that names a different asset than the workflow pays by @kpj2006 in #43
• Release v1.0.1: ship the /send asset fix by @kpj2006 in #44

Full Changelog: v1.0.0...v1.0.1

v1.0.0

Summary

The first stable release of GitPay: a GitHub Action that pays contributors from your own Safe when a maintainer comments /send <recipient> <amount>. Supported network: Ethereum Sepolia only.

Highlights

• Safe AllowanceModule settlement. Set up a Safe, a period-capped allowance and a delegate once; CI then pays recipients directly from the Safe with no per-payout approval. GitPay never holds funds.
• Dry-run by default. Real payouts require mode: self; an unknown mode is refused.
• Declared policy. enabled (kill switch), allowed_associations and max_per_payout are action inputs, evaluated offline before anything is signed.
• No double payments. Each payout's idempotency key is recorded in a receipt comment on the PR before broadcast; a re-run finds it and does not pay again.
• Simulate before broadcast. eth_call and gas estimation catch an exhausted allowance, missing delegate or empty Safe for zero gas.
• Frozen input schema at schema/action-inputs.v1.schema.json.
• Supply chain. Two runtime dependencies (@noble/curves, @noble/hashes), reproducible dist/, SBOM and signed build provenance on every release.
• Evidence. 20 consecutive live settlements and a merged-PR payout on Sepolia, recorded in docs/VERIFIED_CHAINS.md.

Getting started

Pin StabilityNexus/GitPay@v1 and follow the README's Using the Action. Workflows must serialize payouts with a concurrency group and cancel-in-progress: false.

---

What's Changed

• Add REFERENCES.md and ROADMAP.md for XOps project documentation by @kpj2006 in #2
• chore(deps)(deps): bump step-security/harden-runner from 2.21.0 to 2.21.1 by @dependabot[bot] in #6
• chore: remove initial issues automation files and related configurations by @kpj2006 in #1
• chore(deps)(deps): bump actions/setup-java from 5 to 6 by @dependabot[bot] in #4
• chore(deps)(deps): bump google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml from 2.5.1 to 2.6.0 by @dependabot[bot] in #8
• chore(deps)(deps): bump google/osv-scanner-action/.github/workflows/osv-scanner-reusable-pr.yml from 2.5.1 to 2.6.0 by @dependabot[bot] in #7
• Import the XOps implementation into GitPay by @kpj2006 in #9
• Rename XOps to GitPay by @kpj2006 in #10
• Upgrade brace-expansion and js-yaml past known vulnerabilities by @kpj2006 in #18
• Replace the XOps logo with GitPay artwork by @kpj2006 in #19
• Close three release-gate boxes with tests by @kpj2006 in #20
• Record the live Sepolia evidence in the release gate by @kpj2006 in #21
• Release a Node Action with an SBOM and signed build provenance by @kpj2006 in #22
• chore(deps)(deps): bump actions/setup-node from 4.4.0 to 7.1.0 by @dependabot[bot] in #29
• chore(deps)(deps): bump step-security/harden-runner from 2.21.1 to 2.22.1 by @dependabot[bot] in #28
• chore(deps)(deps): bump actions/upload-artifact from 7.0.1 to 7.0.2 by @dependabot[bot] in #27
• Run the Action on Node 24 by @kpj2006 in #26
• Fix the README quickstart, which could not run by @kpj2006 in #25
• Record 20 consecutive Sepolia settlements and a merged-PR payout by @kpj2006 in #24
• Publish and freeze the input schema; refuse an unknown mode by @kpj2006 in #23
• chore(deps)(deps): bump actions/checkout from 4.4.0 to 7.0.1 by @dependabot[bot] in #16
• chore(deps)(deps-dev): bump typescript-eslint from 8.46.2 to 8.70.1 by @dependabot[bot] in #17
• chore(deps)(deps-dev): bump @types/node from 22.19.0 to 26.6.3 by @dependabot[bot] in #15
• Bump to 1.0.0 and rewrite AGENTS.md for the allowance model by @kpj2006 in #30

New Contributors

• @kpj2006 made their first contribution in #2
• @dependabot[bot] made their first contribution in #6

Full Changelog: https://github.com/StabilityNexus/GitPay/commits/v1.0.0