vibe-kits v1.2.1

vibe-kits v1.2.1

Supply-chain hardening for the release pipeline. No change to the vibe CLI or any kit.

Releases publish to PyPI through trusted publishing. Until now that pipeline trusted mutable references: action tags that can be moved, and build tools resolved fresh from PyPI at release time. A compromised tag or build-tool release could have changed what ships. This release pins both. Installed behavior is the same as v1.2.0.

What's new

• GitHub Actions are pinned to commit SHAs in both workflows, with the version kept in a trailing comment. This includes pypa/gh-action-pypi-publish, which runs in the job that holds id-token: write. Pins match what the old tags resolved to, so no action versions changed.
• The sdist and wheel build installs from requirements-build.txt, a hash-pinned file covering build, setuptools, setuptools-scm and their dependencies. It installs with --require-hashes and builds with --no-isolation, so the pinned versions are what actually run. On Python 3.11 the wheel and sdist contents are identical to an isolated build.
• Dependabot now opens weekly PRs to bump the pinned actions.

Maintainers

• To refresh the build pins, run the command in the header of requirements-build.txt (source: requirements-build.in). Dependabot does not cover that file.
• Only .github/ and requirements-build.* changed since v1.2.0. The vibe package code is untouched.

Two things to check before you tag:

• Tagging is the first real run of the new build path. I only verified it locally. A v1.2.1 tag with no user-facing risk is a good way to test it. If the build job fails, nothing reaches PyPI, because publish needs build.
• Alternatively, fold these changes into the next feature release and skip a CI-only version. Then drop the "no change to the CLI" framing and add a short "Build and supply chain" section instead.