Skip to content

ActionLineage v0.1.0a2

Pre-release
Pre-release

Choose a tag to compare

View all tags
@Marq-Dev Marq-Dev released this 21 Jun 23:21
v0.1.0a2
ac97c90
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

ActionLineage v0.1.0a2

Public-alpha release candidate for ActionLineage, a vendor-neutral evidence and detection plane for tool-using agents.

This release keeps the project in alpha posture. It is not a production/stable claim.

Release evidence

Artifacts were built by the GitHub release workflow from tag v0.1.0a2 at commit ac97c901412576a93c4d9ac7a621ceafbb5c4d12.

Workflow run: https://github.com/VectorTrace-Labs/ActionLineage/actions/runs/27920690328

Workflow gates passed:

  • ruff check .
  • ruff format --check .
  • mypy src
  • pytest
  • claim-language guard
  • secret scan
  • pip-audit
  • wheel and source distribution build
  • SBOM generation
  • local release provenance generation
  • SHA-256 checksum generation
  • GitHub artifact attestation generation

Artifact checksums

45b2e81267b92ea69687ab9a0dfb1b2e32ffca4e1263eeea53d84ae00f0ab0d0  dist/actionlineage-0.1.0a2-py3-none-any.whl
3ab6056d08d458e983c691946507e904532c312df907f79d1cb744d1885b87d1  dist/actionlineage-0.1.0a2.tar.gz
da0427d5ef50b0413beb30658c39267632e5cf65802f08a8652f7c34106d3df7  build/release/actionlineage-provenance.json
5778ed14e310d272a2c54e601df716d39bd9638adc803f48efaf85da55859d0b  build/release/actionlineage-sbom.json

Local verification commands

shasum -a 256 -c build/release/SHA256SUMS.txt
gh attestation verify dist/actionlineage-0.1.0a2-py3-none-any.whl --repo VectorTrace-Labs/ActionLineage
gh attestation verify dist/actionlineage-0.1.0a2.tar.gz --repo VectorTrace-Labs/ActionLineage
gh attestation verify build/release/actionlineage-sbom.json --repo VectorTrace-Labs/ActionLineage
gh attestation verify build/release/actionlineage-provenance.json --repo VectorTrace-Labs/ActionLineage

Package-index status

This pre-release is attached to GitHub only. TestPyPI/PyPI publication is deferred until Trusted Publisher records are configured on the package indexes. See issue #19.

Wheel smoke test

The workflow-built wheel was installed into a fresh temporary Python 3.13 environment with uv pip install. The installed CLI returned 0.1.0a2, actionlineage demo run produced 18 verified records, and actionlineage journal verify confirmed the deterministic demo journal hash:

sha256:c51f29aadf75d59dd69813e0348f6fbfe2a4297a31051bbdb362017aac01b981
Assets 7
Loading