Skip to content

v2.1.3

Choose a tag to compare

View all tags
@github-actions github-actions released this 31 Aug 14:09
Immutable release. Only release title and notes can be modified.
v2.1.3
a766fb1
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Retro Web UI v2.1.3

v2.1.3 is a backward-compatible release-engineering and
publication-integrity hardening release over v2.1.0. It does not add a
product feature, theme, framework claim, or semantic-conversion behavior.

The protected annotated v2.1.1 and v2.1.2 tags are retained as unpublished
failed candidates. Neither has a GitHub Release. The v2.1.1 workflow exposed
the runner-local peeled-tag identity issue corrected in v2.1.2. The
v2.1.2 workflow then passed metadata and stopped in immutable preflight before
native builds or publication when Python forwarded the repository bearer token
from the GitHub API to the cross-host signed artifact URL. This release strips
credentials on cross-host redirects, retains them on same-host redirects, and
rejects non-HTTPS destinations.

Immutable publication gates

  • A protected, manually approved pre-tag workflow uses a dedicated
    Administration-read credential to require the literal repository setting
    enabled: true, an unused version tag and Release, and the exact main
    commit.
  • The annotated tag records the successful preflight run ID. The tag-triggered
    workflow resolves the authoritative remote annotated tag and that exact run,
    checks their identities and commit binding, and downloads the protected
    preflight evidence without forwarding repository credentials to signed
    artifact storage.
  • Publication creates one draft Release through a create-only API path, retains
    its exact Release ID, uploads only the manifest-bound asset set, and verifies
    that same draft before making it public.
  • Final certification requires the literal GitHub Release API boolean
    immutable: true, complete public re-downloads and SHA-256 matches, and
    Sigstore/DSSE provenance covering the exact tag and every expected asset
    digest.
  • Third-party GitHub Actions used by CI, native builds, preflight, and release
    publication are pinned by commit.

Distribution and compatibility

The release retains the v2.1.0 desktop workspace, Core, CLI, Skill, framework,
browser, privacy, and containment behavior. Assets include native archives for
macOS arm64, Windows x86_64, and Linux x86_64, plus the standalone Skill ZIP,
Python wheel, source distribution, SHA-256 sidecars, and per-platform native
reports. The tagged workflow rebuilds and exercises the complete release set.

The macOS archive is ad-hoc signed, not Developer ID signed or notarized. The
Windows archive is unsigned and not Authenticode signed. Hosted native checks
use offscreen display environments and do not replace physical-device UX
evaluation. Codex remains an external prerequisite and is not bundled.

Install

Install and sign in to a compatible Codex first, then download the native
archive for your operating system and verify its adjacent SHA-256 file.

Install the matching Skill for standalone Codex use:

$skill-installer install https://github.com/ririri-rgb/retro-web-ui/tree/v2.1.3/skills/retro-web-ui

CLI-only users can install retro_web_ui_skill-2.1.3-py3-none-any.whl without
installing Qt. The historical v2.1.0 Release remains unchanged.

Assets 18
Loading