v0.1.2

Published from a signed tag with build provenance.

Package	Registry
matchory/coding-style	Packagist
@matchory/coding-style	npm
matchory-coding-style	PyPI

Verify the artefacts:

gh attestation verify <file> --repo matchory/coding-style

---

[0.1.2] — 2026-07-30

First release published to every registry.

0.1.1 reached npmjs, with provenance, but its PyPI and GitHub Packages jobs failed on two workflow
bugs, so it exists on npmjs alone. Both are fixed here:

• The checksum manifest was generated as sha256sum dist/*, which embeds the dist/ prefix, while the
  publish job verifies it after cd dist — so every path resolved to dist/dist/... and could not be
  opened. It is now generated from inside dist/ with bare filenames, and CI round-trips it the way the
  release does, including asserting that it still detects a tampered artefact.
• publishConfig.provenance: true is baked into the published tarball, so npm attempted provenance on
  the GitHub Packages publish too and failed for want of an id-token permission that job is
  deliberately not granted. The declaration is gone; the npmjs job passes --provenance explicitly, so
  the intent is per-registry rather than per-tarball.

Version tags cannot be moved or deleted in this repository, so 0.1.1 stays on npmjs as a superseded
version rather than being retracted. PyPI has no 0.1.1; the three ecosystems are aligned again from
0.1.2 onward.