Skip to content

v0.16.40 — release: signed releases, OpenSSF Scorecard, README leads with the evidence, one-time star line

Choose a tag to compare

View all tags
@github-actions github-actions released this 20 Oct 22:11
· 34 commits to main since this release
v0.16.40
9e986e9
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

  • Every release can be verified. Each GitHub Release now carries:

    • the exact tarball published to npm;
    • a Sigstore-signed build provenance for it (gh attestation verify skilldrop-cli-<version>.tgz --repo sananthanarayan/skilldrop);
    • a CycloneDX SBOM.

    Its notes are this changelog entry, and its title is the pull request's (RFC-0059).

  • The repo is scored by OpenSSF Scorecard every week and after every merge, with a badge on the README.

    • CI's own tools now install from hash-locked files.
    • Every workflow is read-only at the top level.

  • The README leads with the evidence:

    • one real request answered with and without a skill, and the blind judge's verdict;
    • the last run's numbers;
    • the skills that were retired for losing.

  • The CLI asks for a GitHub star once. The line prints after your first successful install, at an interactive terminal only, never in CI, a pipe or --json. Set SKILLDROP_NO_STAR=1 to turn it off. Nothing is sent anywhere.

npx skilldrop-cli@0.16.40 install --pack solution-architect

skilldrop-cli@0.16.40 on npm, published with provenance.
The attached skilldrop-cli-0.16.40.tgz is that same file. Check its signed build provenance with
gh attestation verify skilldrop-cli-0.16.40.tgz --repo sananthanarayan/skilldrop; its SBOM is skilldrop-cli-0.16.40.cdx.json.

Assets 5
Loading