v1.0.0

Summary

The first stable release of GitPay: a GitHub Action that pays contributors from your own Safe when a maintainer comments /send <recipient> <amount>. Supported network: Ethereum Sepolia only.

Highlights

• Safe AllowanceModule settlement. Set up a Safe, a period-capped allowance and a delegate once; CI then pays recipients directly from the Safe with no per-payout approval. GitPay never holds funds.
• Dry-run by default. Real payouts require mode: self; an unknown mode is refused.
• Declared policy. enabled (kill switch), allowed_associations and max_per_payout are action inputs, evaluated offline before anything is signed.
• No double payments. Each payout's idempotency key is recorded in a receipt comment on the PR before broadcast; a re-run finds it and does not pay again.
• Simulate before broadcast. eth_call and gas estimation catch an exhausted allowance, missing delegate or empty Safe for zero gas.
• Frozen input schema at schema/action-inputs.v1.schema.json.
• Supply chain. Two runtime dependencies (@noble/curves, @noble/hashes), reproducible dist/, SBOM and signed build provenance on every release.
• Evidence. 20 consecutive live settlements and a merged-PR payout on Sepolia, recorded in docs/VERIFIED_CHAINS.md.

Getting started

Pin StabilityNexus/GitPay@v1 and follow the README's Using the Action. Workflows must serialize payouts with a concurrency group and cancel-in-progress: false.

---

What's Changed

• Add REFERENCES.md and ROADMAP.md for XOps project documentation by @kpj2006 in #2
• chore(deps)(deps): bump step-security/harden-runner from 2.21.0 to 2.21.1 by @dependabot[bot] in #6
• chore: remove initial issues automation files and related configurations by @kpj2006 in #1
• chore(deps)(deps): bump actions/setup-java from 5 to 6 by @dependabot[bot] in #4
• chore(deps)(deps): bump google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml from 2.5.1 to 2.6.0 by @dependabot[bot] in #8
• chore(deps)(deps): bump google/osv-scanner-action/.github/workflows/osv-scanner-reusable-pr.yml from 2.5.1 to 2.6.0 by @dependabot[bot] in #7
• Import the XOps implementation into GitPay by @kpj2006 in #9
• Rename XOps to GitPay by @kpj2006 in #10
• Upgrade brace-expansion and js-yaml past known vulnerabilities by @kpj2006 in #18
• Replace the XOps logo with GitPay artwork by @kpj2006 in #19
• Close three release-gate boxes with tests by @kpj2006 in #20
• Record the live Sepolia evidence in the release gate by @kpj2006 in #21
• Release a Node Action with an SBOM and signed build provenance by @kpj2006 in #22
• chore(deps)(deps): bump actions/setup-node from 4.4.0 to 7.1.0 by @dependabot[bot] in #29
• chore(deps)(deps): bump step-security/harden-runner from 2.21.1 to 2.22.1 by @dependabot[bot] in #28
• chore(deps)(deps): bump actions/upload-artifact from 7.0.1 to 7.0.2 by @dependabot[bot] in #27
• Run the Action on Node 24 by @kpj2006 in #26
• Fix the README quickstart, which could not run by @kpj2006 in #25
• Record 20 consecutive Sepolia settlements and a merged-PR payout by @kpj2006 in #24
• Publish and freeze the input schema; refuse an unknown mode by @kpj2006 in #23
• chore(deps)(deps): bump actions/checkout from 4.4.0 to 7.0.1 by @dependabot[bot] in #16
• chore(deps)(deps-dev): bump typescript-eslint from 8.46.2 to 8.70.1 by @dependabot[bot] in #17
• chore(deps)(deps-dev): bump @types/node from 22.19.0 to 26.6.3 by @dependabot[bot] in #15
• Bump to 1.0.0 and rewrite AGENTS.md for the allowance model by @kpj2006 in #30

New Contributors

• @kpj2006 made their first contribution in #2
• @dependabot[bot] made their first contribution in #6

Full Changelog: https://github.com/StabilityNexus/GitPay/commits/v1.0.0