PatchWitness v0.1.1 - Verifiable releases, tighter automation

PatchWitness v0.1.1 - Verifiable releases, tighter automation

PatchWitness v0.1.1 is a security-hardening release. It does not change the evidence schema or the
core gate contract; it strengthens how the project itself is built, reviewed, and released.

Security improvements

• Every third-party GitHub Action is pinned to a full, immutable commit SHA.
• Read-only jobs discard the checkout credential instead of leaving it in the local Git config.
• Pull requests receive a dependency review that rejects newly introduced
  moderate-or-higher-severity vulnerabilities.
• The release workflow rejects a tag that does not match the package version.
• Release wheel and source archives receive GitHub build-provenance attestations before upload.
• Common local credential and signing-key files are ignored, with regression tests guarding these
  repository invariants.

PatchWitness now also uses one version source for its CLI, MCP server, package metadata, and Change
Passport, preventing release metadata from drifting between interfaces.

Install

pipx install "https://github.com/pangxueyuan2-creator/patchwitness/releases/download/v0.1.1/patchwitness-0.1.1-py3-none-any.whl"

Verify an artifact

After downloading a v0.1.1 asset, verify its GitHub-hosted provenance:

gh attestation verify patchwitness-0.1.1-py3-none-any.whl \
  --repo pangxueyuan2-creator/patchwitness

Compatibility

• Evidence schema remains patchwitness.dev/evidence/v1.
• No runtime dependencies were added.
• Existing contracts, CLI commands, SDK calls, MCP tools, and reports remain compatible.

Local release validation

• 32 tests passed on Windows with Python 3.14.5.
• Measured test coverage: 82.76%, above the enforced 80% floor.
• Ruff and strict mypy passed.
• The wheel and source archive were built from the release candidate, followed by a clean wheel
  installation and CLI smoke test.

GitHub CI repeats the test matrix across Linux, Windows, macOS, and Python 3.11-3.14.