Skip to content

v1.0.1

Choose a tag to compare

View all tags
@100yenadmin 100yenadmin released this 09 Jul 13:17
v1.0.1
4381bea
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

v1.0.1

  • Release type: stable patch release hygiene and license-boundary proof
  • Release source SHA: to be stamped by refs/tags/v1.0.1
  • Previous stable release: v1.0.0
  • Tracking issues / source PRs: #382, #485, #492, #484
  • Package artifact: neondiff@1.0.1 after publish
  • Rollback baseline: v1.0.0

Purpose

Cut the first stable patch after GA so release operations stop depending on
historical beta surfaces.

This patch keeps the v1.0 launch boundary unchanged: npm install -g neondiff
installs the CLI, neondiff dashboard opens the local HTML setup/status
dashboard, and the minimal Mac launcher remains the desktop entry point until
the v1.1 signed desktop lane lands.

Included Changes

  • Remove public npm install exposure for the pre-1.0 beta train:
    • remove the beta dist-tag;
    • unpublish neondiff@0.4.30-beta.1 where npm permits;
    • verify neondiff@beta and neondiff@0.4.30-beta.1 return 404;
    • verify neondiff@latest resolves to 1.0.0 before this patch publishes.
  • Delete historical GitHub prerelease pages while preserving Git tags/source
    refs for provenance and rollback.
  • Add npm publish-token preflight to the publish workflow so missing NPM_TOKEN
    fails early with an actionable error.
  • Retire the old manual npm publish default of v0.4.30-beta.1; manual
    workflow dispatch now defaults to v1.0.1.
  • Pin public CI and npm publish workflows to immutable actions/checkout and
    actions/setup-node v5 commit SHAs compatible with the GitHub Actions Node 24
    runtime. The workflows still install Node.js 26 for NeonDiff itself.
  • Keep the hosted website/install surface in the public release manifest as a
    required published channel. The hosted installer defaults to npm latest, so
    it picks up neondiff@1.0.1 after the npm promotion without a website code
    deploy.
  • Keep the public/private license boundary guarded in release-readiness tests:
    public repositories may run free when license.publicReposFree is true, and
    private/commercial repositories require an active entitlement before checkout,
    provider calls, or posting.

Required Gates

  • Focused validation:
    • NODE_OPTIONS=--experimental-sqlite npx vitest run tests/public-release-readiness.test.ts tests/linux-packaging.test.ts tests/license.test.ts --pool=forks --maxWorkers=1
    • npm run build
    • node scripts/check-public-claims.mjs
    • node scripts/check-secret-scan.mjs
    • git diff --check
  • License API proof:
    • docs/evidence/v1.0.1-license-api-healthz.json
    • docs/evidence/v1.0.1-license-checkout-issuance-unauthenticated.json
    • docs/evidence/v1.0.1-license-checkout-issuance-authenticated.json
  • Rollback target proof:
    • docs/evidence/v1.0.1-rollback-refs.json
  • Registry/release cleanup proof:
    • registry and GitHub release-page cleanup evidence linked from the release
      tracker and cleanup issue.

Caveats

  • This release does not ship signed/notarized desktop artifacts, Sparkle
    appcast, or auto-update proof. Those remain tracked by #116 and #449.
  • This release does not delete historical Git tags; it removes public GitHub
    prerelease pages and npm install channels only.
  • This release does not claim CodeRabbit parity, calibrated 95% review accuracy,
    auto-merge, approvals, native ZCode skills/MCP/memory, or target-repo mutation.

Rollback

: "${REPO_ROOT:?set REPO_ROOT to your local NeonDiff checkout}"

cd "$REPO_ROOT"
git fetch origin --tags
git checkout main
git reset --hard refs/tags/v1.0.0
npm dist-tag add neondiff@1.0.0 latest
Assets 2
Loading