First release published by publish.yml over GitHub OIDC trusted publishing rather than by hand.
This is the first huqan tarball that carries an npm provenance attestation tying it to this repository, this workflow, and commit 29112b74. Every earlier version, including v0.11.1, was uploaded manually and cannot be traced cryptographically back to its tag.
| Evidence | Value |
|---|---|
| Publisher | GitHub Actions via trustedPublisher: github — no stored token |
| Attestation | SLSA provenance v1 |
gitHead |
29112b7480f0dafea601ccff03977f8f0410c582 |
Both NPM_TOKEN secrets (repository and npm-publish environment) were deleted before this release. No workflow referenced them.
Carries 320 commits since v0.11.1 — see v0.11.1...v0.12.0 and CHANGELOG.md. Notable: the README was rewritten (#1964, #1965) after sitting empty on main; the public page and the npm page now show the same current text.