Skip to content

v0.8.7

Latest
Latest

Choose a tag to compare

View all tags
@github-actions github-actions released this 06 Nov 18:17
· 198 commits to main since this release
Immutable release. Only release title and notes can be modified.
v0.8.7
a6a0413
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

[0.8.7] - 2026-11-06

This candidate carries the unpublished 0.8.6 source and the changes since the
last published 0.7.9. Tags v0.8.0 through v0.8.6 remain
immutable; none establishes a qualified public release.

Fixed

  • Release smoke validation requires both the exact full-CI qualifier and the native build dependency on the actual attestation job. Its complete supplemental publication/receipt suite now runs in the existing CI contract step before tagging. This repairs the source-only smoke assertion that rejected the immutable 0.8.6 candidate after its successful full 20-role producer; no native artifacts, attestations or public/npm writes occurred for that candidate.

  • Source-version installer and web guidance checks follow cross-checked Cargo/npm/changelog metadata while retaining strict unique assignments and independent published-release claims. This repairs the stale 0.8.4 assertions that failed the immutable 0.8.5 candidate; older tags and failed qualification remain unchanged.

  • Shell PATH setup requires an exact standalone Phantom marker, handles
    unterminated shell-config lines and trailing backslashes, and restores the
    previous config if verification after replacement fails.

  • Citation metadata and generated public installation guidance retain the
    verified published release instead of promoting an unqualified source version.

  • npm wrappers derive their strict release identity from their own packaged
    metadata before cache access or binary execution. The reviewed six-file
    inventory is closed against missing, extra, duplicate, or substituted files.

  • Installer regressions retain independent GNU/BSD diagnostics, real zsh
    startup coverage, literal-dollar and shell-fallback paths, leading whitespace,
    trailing comments, exact operation/path checks, and foreign-byte sentinels.

  • Release qualification reuses or dispatches one exact manual tag producer,
    requires all 20 roles and critical steps, and revokes stale run/attempt or
    source-policy evidence before native work and every public/npm write.

  • A closed native Windows diagnostic mode preserves the original installer
    bounds and reports safe timeout facts; partial diagnostics cannot qualify a
    release or trigger publication.

Breaking changes and migration

Upgrading from the last published 0.7.9 includes the output changes recorded
in the 0.8.4 source tranche. JSON consumers must accept mode: log and
findings with kind: log, plus additive schema identifiers and status.kind.
Do not combine log_path with runtime=true. validate schedule --json returns an object; strict agent
readiness failures use exit 2. Broader credential scanning can require removing
or protecting exposed values. Review the 0.7.10, 0.8.0 and 0.8.4 source entries
for details. Vault format and route-owned proxy authentication stay unchanged;
this candidate grants no new reveal, hosted-service or provider authority.
Existing v0.8.0 and v0.8.1 tags stay immutable, as do reserved v0.8.2,
v0.8.3, v0.8.4, v0.8.5 and v0.8.6. Keep using checksum-verified v0.7.9 assets until a new
release receipt exists.

What's Changed

Full Changelog: v0.8.6...v0.8.7

Contributors

masonwyatt23
Assets 22
Loading