Skip to content

v0.2.1

Choose a tag to compare

View all tags
@github-actions github-actions released this 10 Jun 18:47
v0.2.1
3acee4e
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

v0.2.1 - integrity coverage + replay-safe approvals

Hardening release closing the two gaps documented in SPEC §9.

Exhaustive sibling-file digests

script_hashes now covers every regular file a skill ships - scripts/, resources/, bin/, top-level siblings - not just the two conventional directories. A payload moved to an unhashed sibling path can no longer change behind a clean diff. Additive within schema 0.1: existing lockfiles stay valid; run skil-lock lock . after upgrading to extend coverage to previously unhashed files.

PR-scoped approvals

.skil-lock-approvals.yaml entries accept an optional pr: field scoping an approval to one pull request. The PR-comment snippet pre-fills it in CI (the PR number is auto-detected from the Actions event payload, or pass --pr). A delta that is approved, reverted, and reintroduced in a later PR now re-blocks with an approval scoped to PR #N note instead of silently matching the stale approval. Approvals without pr: keep their standing value-match semantics.

Pairs with Action v0.2.1

skills-lock/skil-lock-action@v0.2.1 adds a verify-signature input: cosign keyless verification of checksums.txt against this repo's release-workflow OIDC identity before any checksum is trusted (default auto).

Changelog

  • 3acee4e feat(integrity): exhaustive sibling-file digests + PR-scoped approvals (#29)

All binaries are cosign-signed; SBOMs and SLSA provenance attached. Verify:

cosign verify-blob --certificate checksums.txt.pem --signature checksums.txt.sig \
  --certificate-identity-regexp 'github.com/skills-lock/skil-lock' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com checksums.txt
Assets 15
Loading