v1.1.0

Summary

Pay contributors from an ordinary wallet (MetaMask, Rabby, a hardware wallet) with no Safe needed, and recover a stuck payout from a PR comment. If you pin v1, you get this release automatically. The default scheme is unchanged, so existing Safe workflows keep working as before.

Added

• scheme: approve: pay from an ordinary wallet. The wallet calls approve(delegate, N) on the token once. CI pays each /send with transferFrom(wallet, recipient, amount) using the delegate key. Set scheme: approve and the new payer input in place of safe. The approval does not reset like a Safe spending limit, so top it up when it runs out. In return, a leaked delegate key can spend only what is left of it, once. Revoke with approve(delegate, 0). GitPay refuses a delegate key that controls the payer itself. (#67)
• round:N on /send. /send 0xabc… 2.50 round:1 pays the same person again on the same PR, deliberately, from a comment. Previously round was only a workflow input, so this needed a workflow edit. Only an author in allowed_associations can /send at all, and a malformed round is refused rather than ignored. (#68)
• STATUS=unconfirmed. A retry that finds a receipt recorded before broadcast and never confirmed now reports unconfirmed and fails, instead of a green already-paid. It still pays nothing. Check the transaction on the explorer: if it succeeded, the contributor is paid; if it failed or never landed, re-send with round:N. (#68)

Fixed

• A call to an address with no contract code (a mistyped token or module address) is refused before anything is recorded. Previously it could mine as a no-op and be recorded as a settled payout. (#67)
• A payout that failed no longer logs settled: <hash>. Timeouts, reverts and lost nonces now log not settled (<code>) with what to do. (#69)
• ERROR_CODE is set for driver refusals, such as a simulation revert or missing contract code. It used to be blank. (#69)
• A transaction the RPC node refuses keeps its hash in TX_HASH, matching the receipt. (#69)

What adopters need to do

• Nothing, if you settle through a Safe.
• If your workflow's report step treats an unknown STATUS as an error, an unconfirmed run now fails it, which is intended. To print the guidance, add a case for unconfirmed.
• To switch to a wallet, follow "Going live without a Safe" in the README.

Verified

scheme: approve was checked against Ethereum Sepolia with throwaway keys. Against the real Circle USDC contract, an unapproved payout, a payer that is the delegate, a token address with no code, an over-cap amount and a non-maintainer were each refused before anything was recorded. A real approve payout is still to be recorded in docs/VERIFIED_CHAINS.md (ROADMAP §0).

Also in this release

• Workflow hardening: every action pinned to a commit SHA, workflow tokens read-only by default (#57), and the anti-slop PR check (#58).
• Brand assets in brand/ (#51) and dependency updates, including eslint 10.

---

What's Changed

• Fix the gitleaks allowlist, which CI's gitleaks 8.24 never loaded by @kpj2006 in #46
• Fill in the best practices checklist (42/49, 86%) by @kpj2006 in #47
• Add brand guidelines by @kpj2006 in #48
• Queue payouts at job level so other comments cannot cancel a pending /send by @kpj2006 in #49
• Close the remaining repo-quality items by @kpj2006 in #50
• Add brand folder: SVG logo, favicons and icons (fixes broken README logo) by @kpj2006 in #51
• chore(deps)(deps): bump react from 19.3.0 to 19.3.1 in /frontend by @dependabot[bot] in #54
• chore(deps)(deps): bump google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml from 2.6.0 to 2.7.0 by @dependabot[bot] in #52
• chore(deps)(deps): bump google/osv-scanner-action/.github/workflows/osv-scanner-reusable-pr.yml from 2.6.0 to 2.7.0 by @dependabot[bot] in #53
• chore(deps)(deps): bump ossf/scorecard-action from 2.4.4 to 2.5.0 by @dependabot[bot] in #41
• chore(deps)(deps-dev): bump @types/node from 26.6.3 to 26.6.5 by @dependabot[bot] in #42
• chore(deps)(deps-dev): bump typescript-eslint from 8.70.1 to 8.71.1 by @dependabot[bot] in #36
• chore(deps)(deps-dev): bump vite from 8.3.1 to 8.3.4 in /frontend by @dependabot[bot] in #37
• chore(deps)(deps-dev): bump @vitejs/plugin-react from 6.1.1 to 6.1.2 in /frontend by @dependabot[bot] in #40
• chore(deps)(deps): bump react-dom from 19.3.0 to 19.3.1 in /frontend by @dependabot[bot] in #55
• Best-practices follow-ups: release notes, CodeQL, gitleaks by @kpj2006 in #56
• Pin workflow actions to SHAs and default tokens to read-only by @kpj2006 in #57
• Add the anti-slop PR check from the AOSSIE template by @kpj2006 in #58
• Add scheme: approve, to pay from an ordinary wallet without a Safe by @kpj2006 in #67
• Accept round:N on /send, and report an unconfirmed receipt as unconfirmed by @kpj2006 in #68
• Never log 'settled' for a payout that did not settle by @kpj2006 in #69
• chore(deps)(deps): bump github/codeql-action/analyze from 4.39.0 to 4.39.1 by @dependabot[bot] in #59
• chore(deps)(deps): bump advanced-security/set-codeql-language-matrix from 1.3.0 to 1.6.0 by @dependabot[bot] in #60
• chore(deps)(deps): bump actions/setup-python from 7.0.0 to 7.1.0 by @dependabot[bot] in #61
• chore(deps)(deps): bump github/codeql-action/upload-sarif from 4.39.0 to 4.39.1 by @dependabot[bot] in #64
• chore(deps)(deps): bump github/codeql-action/init from 4.39.0 to 4.39.1 by @dependabot[bot] in #65
• chore(deps)(deps-dev): bump vite from 8.3.4 to 8.3.5 in /frontend by @dependabot[bot] in #66
• chore(deps)(deps-dev): bump eslint from 9.39.0 to 10.13.0 by @dependabot[bot] in #62
• chore(deps)(deps-dev): bump typescript-eslint from 8.71.1 to 8.72.0 by @dependabot[bot] in #63
• Release v1.1.0: pay from an ordinary wallet, re-pay with round:N by @kpj2006 in #70

Full Changelog: v1.0.1...v1.1.0