Skip to content

v0.1.0-beta.4 — Action defaults, ergonomics, dependency pins

Pre-release
Pre-release

Choose a tag to compare

View all tags
@daichunghy daichunghy released this 23 Aug 04:24
· 11 commits to main since this release
v0.1.0-beta.4
d8c67a8
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

v0.1.0-beta.4 ships the CLI ergonomics and Action-defaults work on top of beta.3. It supersedes v0.1.0-beta.3 as the pinned reference for shadow evaluation.

What changed since beta.3

  • Install from GitHub without cloning (PR #36): npx github:daichunghy/patchgate now works — a prepare script builds dist/ during a Git dependency install, verified by a real clean-directory install smoke (--version, --help, doctor, and .github/patchgate.yml discovery end to end). Registry publication remains a maintainer-gated decision; prepublishOnly now runs the full verification chain. CLI --fail-on parity and glob hardening (? is a literal character in path patterns, not a regex quantifier) are included, plus a docs/demo.md walkthrough with captured CLI output.
  • evaluate --output alias, fail-closed conflicts (PR #40): --output is now an alias of --report on evaluate; passing both with different receipt paths exits 2 with REPORT_OUTPUT_CONFLICT instead of picking a winner. --report remains the documented flag; the committed Action bundle catches up with this parser change.
  • create-check-run defaults to true (PR #42): the Action posts its idempotent Check Run by default, matching how every recorded shadow evaluation was configured; the input parser default mirrors action.yml. Also carries the combined CodeQL 4.37.7 action pin bump.
  • Dependency pins (PRs #38, #39, #42): actions/setup-node 7.0.0 and actions/checkout 7.0.1 full-SHA pins across all five repository workflows, plus the CodeQL action runner bump above.
  • Docs: PR #41 records the PR #40 maintainer merge and status snapshot.

Full record: docs/CHANGELOG.md, docs/releases/2026-08-23-beta.4.md.

Consumer reference (shadow, non-blocking)

- name: PatchGate beta shadow gate
  uses: daichunghy/patchgate@d8c67a848a95d456707e6c580a43e4e56e6071a0
  with:
    fail-on: never
    create-check-run: true
    github-token: ${{ github.token }}

Consumer guidance is unchanged: pin this full commit SHA, keep fail-on: never, and run in shadow only. With github.token the evaluation fails closed with GITHUB_PROVENANCE_AMBIGUOUS (native-control visibility needs a PAT or GitHub App token with administration: read); a rejected snapshot posts a neutral rejection Check Run and exits 0 under fail-on: never.

Verification

Fresh-checkout npm run verify at the tagged commit: lint, typecheck, budget/pin/event/doc-link/community/dossier checks, audit (0 vulnerabilities), full test suites (146 tests: unit, security, GitHub integration, CLI process incl. --output conflict and --fail-on cases), clean-room action bundle, consumer fixture and release-candidate checks all pass; public CI and CodeQL runs pass on the same commit (d8c67a8). Maintainer smoke repository: daichunghy/patchgate-beta-smoke.

Beta shadow-evidence scope only — this is not a production release, not external adoption evidence, and not a v0.1 claim. It blocks merges nowhere unless a maintainer configures it as a required status check with an expected-source setting. Two consenting external shadow installations, a live external consumer E2E, and fork/merge-group E2E remain open gates before any v0.1 claim.

Assets 2
Loading