v1.4.4

Nothing changes for consumers. This release existed to exercise the publish path — and it worked.

npm trusted publishing is now live

pixelcheck@1.4.4 is the first version published with OIDC instead of a stored token. npm records which path a publish took in the registry metadata:

curl -s https://registry.npmjs.org/pixelcheck | jq '.versions["1.4.4"]._npmUser'

{ "name": "GitHub Actions",
  "email": "npm-oidc-no-reply@github.com",
  "trustedPublisher": { "id": "github", "oidcConfigId": "oidc:…" } }

Versions 1.4.1 through 1.4.3 show a personal account in that field, which is what a token publish looks like.

The token fallback has since been removed, so there is no stored publish credential in the repository at all. That also settles the token expiry, and matches where npm is heading: 2FA-bypassing tokens are restricted from August 2026 and direct publishing from January 2027.

What actually ships

• npm run build restores the executable bit on the compiled bin entry points. tsc emits 0644 files and the shebang is inert without that bit; npm sets it only at install or link time, so a rebuild in a linked development checkout used to leave pixelcheck failing with "permission denied". Consumers installing from the registry were never affected.
• Branch protection now requires every platform the package claims to support, rather than only linux-x64 — both macOS architectures and the packaging check are gated too.

Neither is observable from an installed package.

Published to npm with SLSA provenance. CycloneDX SBOM attached below.