Skip to content

anchored 0.1.2

Choose a tag to compare

View all tags
@github-actions github-actions released this 28 May 14:25
v0.1.2
914b195

First successful npm publish via CI. (0.1.1 tagged but never reached
npm registry due to npm CLI bundled with Node 20 not handling
trusted-publisher OIDC reliably.)

Fixed

  • mcp/package.json had duplicate keys (keywords, license,
    repository) from a botched merge. The duplicate repository
    carried the wrong URL (anchored/anchored instead of
    chafoo/anchored), which npm normalized into the published
    metadata for 0.1.0. Removed the duplicates; canonical
    repository: chafoo/anchored is the single source of truth now.

Changed

  • CI publish workflow (.github/workflows/publish.yml) switched
    from NODE_AUTH_TOKEN to npm trusted publishing via OIDC. No
    long-lived tokens; each release is authenticated by GitHub's
    short-lived id-token signed against the workflow + repository
    registered with npm. Removes the supply-chain attack surface
    from stolen registry tokens.
  • CI now pins Node 22 (npm 11.x) and upgrades npm to latest before
    publish — npm 10.x's trusted-publisher implementation had
    intermittent registry-auth bugs.
Assets 2
Loading