Repository navigation
Record the inspected @augmentworks/cli@0.4.0 registry receipt - #96
Merged
Merged
Conversation
…eceipt The v0.4.0 release workflow published the tarball through npm trusted publishing with SLSA provenance from augmentworks-org/augmentworks-cli (.github/workflows/release.yml, refs/tags/v0.4.0, commit afb23c3). The downloaded tarball matches the workflow's packed tarball and npm pack of the tag, and is not republished. The registry document omitted gitHead. Co-authored-by: hamzahskafi <hamzahskafi@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Records the downloaded
@augmentworks/cli@0.4.0tarball without republishing it. Resolves AUG-371. This follows the AUG-337 receipt for 0.3.9 (#86).afb23c37ffe99289c75b3769b50447c3e403c50f(main, tagv0.4.0)8470945d3656e39764b7948baea6e1058819de0fv0.4.0: published 2026-10-18T17:34:34Z by @hamzahskafi, not a draft, not a prereleaseafb23c3is the PR Bring the README up to date for the 0.4.0 npm page #95 merge. It contains the AUG-370 merge252efd84c958eebacec6ca8cf66a8ddabe6fe088(Prepare CLI 0.4.0: hosted real-data testing and Node 22.12 (AUG-370) #91). It also contains Test the published tarball on Node 22.12.0 before npm publish #93 (packed Node 22.12.0 gate), chore(deps-dev): bump the development-dependencies group across 1 directory with 3 updates #94 (dev-dependency bump) and Bring the README up to date for the 0.4.0 npm page #95 (README).publish.0.4.0was published at2026-10-18T17:41:10.515ZbyGitHub Actions(trusted publisher).latestis now0.4.0.sha512-MquWMHbfZQTQ6QMIV4shagYUBLKcUfyIMhMR+zEcl46vfqn/LIjHICtPldCD9kaAn8GY+nhSFC8jjP9sLy4NCw==04c78bdebf100a45c456cccf917d9ff9a28f17a6525af59db88046fceb38512dde85cf209a84170eddc3c3c42120892c9bf92216, 74 files. This matches the tarball the workflow packed and tested, and a localnpm packof the tag.augmentworks-org/augmentworks-cli, workflow.github/workflows/release.yml, refrefs/tags/v0.4.0, commitafb23c3, and run39150220225/attempts/1. In a clean install,npm audit signaturesreports one verified registry signature and one verified attestation.gitHead. The provenance carries the commit instead.npm publishby hand.What changed:
LAST_VERIFIED_*now names 0.4.0, and the Node range is now>=22.12.published-registry-evidence.jsonnow hasthisPackageIdentityset toindependently-inspected, plus aprovenanceblock and a 0.4.0 entry in the immutable artifacts.pending-protected-publish.This commit is not inside the
0.4.0tarball, which still embeds the 0.3.9LAST_VERIFIEDsnapshot. Do not republish0.4.0.Test plan
npm run checkpassed: 123 files, 1232 tests passed, 1 skipped. The discovery, billing, run-report and real-data contract checks passed.npm run smoke:packpassed (74 files).@augmentworks/cli@0.4.0from the registry:--versionprinted0.4.0anddemoexited 0. On Node 22.22.2,npx --yes @augmentworks/cli@0.4.0 --versionprinted0.4.0.AUGMENTWORKS_*QA secrets unset. With them set, 54 billing and target tests fail withAUTH_ENV_CONFLICT, because the realAUGMENTWORKS_API_KEYconflicts with the tests' fakeAUGMENTWORKS_TOKEN. That failure comes from the VM environment and is not a regression.Linear Issue: AUG-371