Skip to content

v5.4.0

Latest
Latest

Choose a tag to compare

View all tags
@github-actions github-actions released this 02 Aug 16:22
v5.4.0
d8a50ff
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Minor release — 3 features, 25 fixes, 15 improvements.

Added (feat)

  • (#1129) first-class multi-repo project (leak-scrub covers every repo slug) — c7f65d8
  • (#1120) migrate block-main-push onto the shared lib, add --no-verify block, relabel as blocking backstop — 8af2391
  • (#1117) add blocking pre-commit protected-branch gate + fail-closed lib hardening (AgDR-0114) — c9569f4

Fixed (fix)

  • (#1125) centralize trust-chain lib self-location behind one anchored helper — a345010
  • (#1122) dispatch the red-CI check on tracker_kind so glab-registered projects check glab, not gh — 515bf38
  • (#1114) make portfolio path comparison case-insensitive-filesystem aware — ddf82c9
  • (#1113) pin #1087 fail-closed behaviour and correct the installer doc — 098c776
  • (#1112) fail closed on unreadable gh api body-file and unparseable --input — 0b44bac
  • (#1107) stop /dfd discovery from walking into workspace and worktrees — 663ae55
  • (#1111) anchor the pre-push skip marker to a whole line — d57df89
  • (#1110) emit release-changelog Closes only from a recognised conventional-commit scope — 15c6e13
  • (#1109) backfill walkable migration-chain placeholders and add the release-time migration check — 0435c36
  • (#1100) anchor the cwd-derived branch of trust-chain self-location (#1062) — 6d7d3f9
  • (#1101) unlock /decide and /audit-deps, and assert over every locked skill — ac9053b
  • (#1098) block instead of falling back to local HEAD when the forge is unreachable — 1712f79
  • (#1096) lint tracked markdown in the pre-push gate, not the whole disk — 59c3cc6
  • (#1090) enforce protected branches from git's pre-push ref list — 6762610
  • (#1075) strip heredoc bodies before git-command pattern matching — 32a84a3
  • (#1080) make leak-hook target-repo resolution class-based, not positional — d4fa95e
  • (#1082) derive release-changelog's PR lookup repo from the actual remote — acb3a01
  • (#1073) resolve verify-commit-refs.sh's tracker repo from the commit's own directory — 83249c2
  • (#1074) resolve issue refs before making Closes actually auto-close — cd64c00
  • (#1072) stage-then-promote audit_run_persist so a jq failure leaves no file — 8c7e890
  • (#1067) close the leak-hook trim fail-open and correct its bypass advice — 4cfd7a9
  • (#1065) untrack project-config.json and ship a tracked example template — 8822d05
  • (#1061) anchor the git-derived self-location fallback to an apexyard fork — 6699cc3
  • (#1060) stop reporting sections missing from a body file that was not read — 1eef1e0
  • (#1059) treat absolute drive-letter paths as absolute in _portfolio_resolve — cd7f6e6

Changed (refactor / chore / docs)

  • (#1132) ship the v5.3.0→v5.4.0 migration (untrack project-config.json) — d06cc1d
  • (#1130) route remaining hook self-location through resolve_anchored_lib_dir() — ee8aa6c
  • (#1127) memoise session-scoped ops-root + config resolution across hooks — 4cfc58a
  • (#1124) record AgDR-0119 (framework self-audit destination); defer Option A — 6e5510c
  • (#1119) make the Lean tier reachable (accept+document, reduced-scope Rex) [AgDR-0116] — 8aae369
  • (#1118) advisory nudge for trust-chain CONTROL adversarial-test coverage (AgDR-0117) — 1475171
  • (#1116) record AgDR-0115 (accept residual, forge-native check) + fix installer header — cb22bbd
  • (#1115) publish the framework control-plane DFD and threat model — 0d40dc8
  • (#1035) bump the codeql-action group with 3 updates — 7d93615
  • (#1036) bump actions/checkout from 7.0.0 to 7.0.1 — 63dcc4e
  • (#1037) bump ossf/scorecard-action from 2.4.3 to 2.4.4 — 0fef132
  • (#1103) credit aniketshukla1 in the contributors list — 6d5ba88
  • (#1108) pin fail-closed behaviour of the architecture + design merge gates — e2cf6d0
  • (#1106) give isolated-builds worktrees a location, naming, and lifecycle convention — 6d2c6b1
  • (#1087) install git pre-push hooks by default — 0e68a49

Closes

Migration script

  • This release ships a real migration. .claude/migrations/v5.3.0-to-v5.4.0.sh untracks .claude/project-config.json on adopter forks (working-tree content preserved), closing the #1065 git checkout data-loss window. docs/upgrading.md's "What each migration does" table has the matching row, and the decision is recorded in AgDR-0122.

Testing

  1. After merge, confirm CI creates tag v5.4.0 on main (the auto-tag-on-release-pr-merge workflow run).
  2. Verify git describe --tags --abbrev=0 origin/main returns v5.4.0.
  3. Run /release-sync v5.4.0 to sync main→dev and prevent squash divergence.
  4. Verify the squash commit carries the trailer: git log -1 --pretty=format:'%(trailers:key=Released-From,valueonly)' v5.4.0.

Refs #1133

Glossary

Term Definition
Squash merge GitHub merges all commits on the PR branch into a single commit on main; the resulting tip has a new SHA.
Auto-tag The auto-tag-on-release-pr-merge.yml workflow tags the squash commit and creates a GitHub Release on merge.
Per-adopter migration A .claude/migrations/vX-to-vY.sh script /update runs when an adopter syncs across that release hop.
Released-From trailer A git trailer recording the exact dev SHA this release was cut from (AgDR-0094).

Released-From: d06cc1d

Assets 2
Loading