v1.9.0

This repository releases itself (#210, #213).

Ten tags between v1.4.0 and v1.8.2 carried no Release object, so releases/latest answered v1.3.4 from 2026-08-04. The cause was not a withheld decision: every workflow here that mentions tags: is a workflow_call reusable for consumers, and the only push trigger was self-ci on branches. release.yml is a path this repository offers, not one it took.

self-release.yml now fires on a signed tag push and runs the same chain the skill repos run: verify the tag is annotated and signed, build, checksum, Cosign sign-blob, SLSA attest, publish -- all in one job before the assets become public, so no window exists in which unattested artefacts are downloadable. The release notes are the annotated tag message, read with %(contents:body) so the SSH signature block stays out of them. The release is created with gh release create, not a third-party action.

The README gained a "Releasing This Repository" section, because the release path being knowledge nobody had written down is part of how the gap survived ten tags.

Read this before assuming the archives changed: they did not. git archive applies .gitattributes, whose export-ignore strips .github/, docs/, scripts/ and README.md -- and this release touches nothing else. The Composer payload in typo3-ci-workflows-v1.9.0.tar.gz is byte-identical to the one v1.8.2 would have produced, verified by extracting both and diffing.

That is deliberate rather than an oversight. The archive is the half worth attesting: uses: ...@main is resolved by GitHub from the git ref and never downloaded, while the runner IS installed, so a consumer can now check the copy in their .Build/vendor/netresearch/typo3-ci-workflows/ against a signed checksum. What this tag ships is the release path itself, and the first run of it.

Consumers referencing the workflows with @main are unaffected. Nothing about what a workflow does has changed -- only what a tag produces.