Skip to content

0.1.21

Choose a tag to compare

View all tags
@github-actions github-actions released this 17 Jul 06:22
· 1 commit to main since this release
0.1.21
4cf5648

Central Vault Sync 0.1.21

Obsidian Community attestation compatibility release.

  • Pins actions/attest-build-provenance to the exact v3 commit used by Community releases whose scorecards show verified GitHub artifact attestations.
  • Uses one v3 provenance statement covering main.js, manifest.json, and styles.css, matching the accepted release shape.
  • Retains the lightweight tag, unique per-release digests, exact source/tag identity, and fail-closed annotated-tag check.
  • Retains all sync runtime behavior from 0.1.20 unchanged.

Investigation established a version boundary: current releases generated with actions/attest-build-provenance v4 fail the Community scorecard across multiple repositories, while v2/v3-generated releases verify successfully. GitHub's verifier accepts both formats; this release targets the Community-compatible v3 format without weakening repository, workflow, source, or hosted-runner identity checks.

Verification: lint, typecheck, 31 tests, production build, policy checks, lightweight tag, exact release/source bytes, and strict GitHub SLSA verification.

Assets 5
Loading