Skip to content

v0.2.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 22 Aug 06:33
· 18 commits to main since this release
v0.2.0
8d6c342
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

CHANGELOG.md
is the readable account of what changed and why. The commit list below is
the complete one.

Changelog

  • eca8895 Merge origin/main into feature/grok-build-harness
  • 6173e20 Merge origin/main into feature/grok-build-harness
  • 9f606a1 Merge remote-tracking branch 'origin/main' into fix-relative-path-harness-lookup
  • cec1549 feat: add Grok Build harness adapter
  • f9374aa feat: add Grok Build harness adapter (#12)
  • 54ce8bb feat: reach , with a session per target (#17)
  • 2b41a0c fix: find a harness on PATH the way the shell does
  • 9a7e0d1 fix: make the Grok adapter usable, and let its probe reach a verdict
  • 8bdd8f6 fix: replace REACH_SESSION in harness environments rather than appending it (#16)
  • abbc433 fix: resolve the grok binary the same way as every other harness
  • 3742d6d fix: surface a working-directory failure instead of swallowing it
  • 5c4ab11 refactor: remove --untrusted (#18)
  • a343a44 release: prepare 0.2.0
  • 8d6c342 release: prepare 0.2.0 (#21)
  • 71bdc53 style: satisfy the linters in the grok shim path

Verifying this release

Every archive ships reach plus the helper binary for each target platform.
At the helper tier reach copies that binary onto your target, so it is worth
knowing where it came from.

Check the contents against checksums.txt:

sha256sum -c checksums.txt --ignore-missing

And check that checksums.txt itself came from this repository's tagged CI
run. The release is signed with cosign keyless
signing, so there is no public key to fetch — the identity is the workflow
that built it:

cosign verify-blob checksums.txt \
  --certificate checksums.txt.pem \
  --signature checksums.txt.sig \
  --certificate-identity-regexp '^https://github.com/bojieli/agentreach/\.github/workflows/release\.yml@refs/tags/' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

Each archive also ships with an SBOM (.sbom.json, SPDX) listing everything
compiled into it.

Container image

The same build is on GitHub Packages for amd64 and arm64:

docker run --rm -v "$HOME/.ssh:/root/.ssh:ro" \
  ghcr.io/bojieli/agentreach:0.2.0 version

Nothing was published here until CI was green on this tag — every test on
every platform, the linters, the fuzz runs, govulncheck, the cross-compiles
and a full release dry run.

Assets 17
Loading