Skip to content

Ygg v0.6.7

Choose a tag to compare

View all tags
@achuthanmukundan00 achuthanmukundan00 released this 02 Sep 14:11
v0.6.7
93a771c
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

ygg v0.6.7

GitHub-only follow-up hardening from pre-user dogfood validation of v0.6.6.
These releases preceded external user adoption. npm, Homebrew, and crates.io
publication remained deferred while the product/package name was unresolved.

Fixed

  • Serve repository refresh now enumerates Git clean/process filters from the
    effective repository, worktree, and included configuration before running
    status commands.
  • Filter names that cannot be represented safely as Git command overrides,
    including delimiter-bearing or non-UTF-8 names, fail closed without running
    repository status.
  • Marker-based regressions cover ordinary local config, config.worktree, and
    the unsafe-name cases with real positive controls.

Installation and updates

Install the signed binary for GNU/Linux x86-64, macOS Intel, or macOS Apple
silicon:

curl --proto '=https' --tlsv1.2 -LsSf \
  https://github.com/skaft-software/ygg/releases/download/v0.6.7/install-ygg.sh | sh

Existing GitHub-binary users can update in place:

ygg update
ygg --version
ygg doctor

Managed first-party packages update separately from the core binary. Run the
ygg extension update ... commands reported by ygg update; an incompatible
older package is rejected rather than executed.

Cargo users can install the immutable tag with Rust 1.86 or newer:

cargo install --locked \
  --git https://github.com/skaft-software/ygg \
  --tag v0.6.7 \
  --bins \
  ygg-coding-agent

Compatibility and known limits

  • Core crates and first-party extension manifests target Ygg 0.6.7 exactly.
  • Executable-extension API 0.2 remains unchanged.
  • Existing configuration, credentials, sessions, goals, and extension-owned
    data remain in place across installer upgrades. Managed package binaries
    follow the separate exact-version update described above.
  • npm, Homebrew, and crates.io remain unpublished by maintainer decision.
  • The incremental production unwrap/expect audit tracked in #111 remains
    deferred to v0.7.0.

Immutable release evidence

  • Source: 93a771cc789d8b21e4d279831c941910c4cfd857
  • Release PR: #234
  • Security fix PR: #233
  • Protected post-merge CI: 33639465987
  • Post-merge CodeQL: 33639464121
  • Binary publication and install verification: 33640448510, attempt 2
  • Serve publication and official install/update verification: 33640447716
  • Published inventory: 28 GitHub assets; both checksum manifests and all 14
    Sigstore bundles independently verified with exact workflow identity,
    repository, ref, trigger, issuer, and source-SHA constraints.

The first binary post-publish attempt reached extension installation before the
parallel Serve workflow had attached SHA256SUMS; rerunning only the failed
post-publish jobs after Serve publication passed on all three supported targets.
No npm, Homebrew, or crates.io publication job ran.

Assets 30
Loading