Affaan Mustafa and GitHub
0348d7b6d7
chore(release): 2.2.3, ECC-only naming in pi/core and a longer npm publish wait ( #3329 )
...
pi/core and the bundled blueprint skill now refer to the project as ECC only;
the generated README no longer expands the name. Profile contents, package
name and paths are unchanged (123 skills, 24 commands).
The release workflows poll npm for up to five minutes after publish before
verifying the artifact. In 2.2.2 the check gave up after about 30 seconds while
npm was still processing, failing the run before latest was promoted and the
GitHub Release was created.
Version metadata synced to 2.2.3 with CHANGELOG, translated release headings
and release notes; skill-triggers registryDigest updated for the blueprint text.
2026-10-01 17:49:51 -05:00
Affaan Mustafa and GitHub
c70874fae9
feat(pi): curated pi/core skills+prompts profile, CI load test, and 2.2.2 release sync ( #3264 )
...
Adds a curated, Pi-native, skills+prompts-only profile at pi/core/ for downstream packagers that mirror GitHub Releases.
- manifests/pi-core.json: explicit include lists, per-item exclusion reasons, curation rules, safety allowlists; every root skill and command must be classified.
- scripts/build-pi-core.js regenerates pi/core deterministically (package.json from VERSION, LICENSE, README.md, CURATION.md, skills/, commands/); --check fails CI on drift. council is renamed ecc-council inside pi/core only.
- Safety checks: no callable endpoints outside the allowlist, no npx/curl|sh/pip install, no secrets, no absolute home paths, no symlinks, valid frontmatter, no duplicate names.
- CI: build + drift check and an offline Pi CLI load test of pi/core.
- Release: VERSION, package.json and pi/core/package.json at 2.2.2, CHANGELOG, tag-triggered release verification, and a two-week cadence in CONTRIBUTING.md.
pi/core: 123 of 293 skills and 24 of 94 commands; 35,006 characters of skill description text.
2026-09-29 20:24:05 -05:00
affaan-m
f36b5d1fda
fix(release): bind privileged checkout to verified event commit
...
Preserve contributor history and current-main behavior while resolving the exact reviewed follow-up.
Source-PR: https://github.com/affaan-m/ECC/pull/3195
Source-Parent: ffb69744b0
2026-09-28 00:54:51 -04:00
affaan-m
7c9c44736b
fix(release): bind trusted checks and signed tag identity on current main
2026-09-27 22:48:51 -04:00
Viggo Phillips
1e4576e685
fix: enforce signed release provenance gates
2026-09-20 23:46:22 +02:00
dependabot[bot] and GitHub
6a1e0c1bc5
chore(deps): bump softprops/action-gh-release
...
Bumps the actions-minor-and-patch group with 1 update in the / directory: [softprops/action-gh-release](https://github.com/softprops/action-gh-release ).
Updates `softprops/action-gh-release` from 3.0.2 to 3.0.3
- [Release notes](https://github.com/softprops/action-gh-release/releases )
- [Changelog](https://github.com/softprops/action-gh-release/blob/master/CHANGELOG.md )
- [Commits](https://github.com/softprops/action-gh-release/compare/3d0d9888cb7fd7b750713d6e236d1fcb99157228...efb35369e0ad2afab669f228072c1b0d510eae64 )
---
updated-dependencies:
- dependency-name: softprops/action-gh-release
dependency-version: 3.0.3
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: actions-minor-and-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
2026-09-03 20:05:14 +00:00
dependabot[bot] and haelyra
45a48d5e1b
chore(deps): bump the actions-minor-and-patch group across 1 directory with 2 updates
...
Bumps the actions-minor-and-patch group with 2 updates in the / directory: [actions/checkout](https://github.com/actions/checkout ) and [pnpm/action-setup](https://github.com/pnpm/action-setup ).
Updates `actions/checkout` from 7.0.0 to 7.0.1
- [Release notes](https://github.com/actions/checkout/releases )
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md )
- [Commits](https://github.com/actions/checkout/compare/9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0...3d3c42e5aac5ba805825da76410c181273ba90b1 )
Updates `pnpm/action-setup` from 6.0.9 to 6.0.10
- [Release notes](https://github.com/pnpm/action-setup/releases )
- [Commits](https://github.com/pnpm/action-setup/compare/0ebf47130e4866e96fce0953f49152a61190b271...0977fd99725f1db4007ccb2928dbb4e90d06cc86 )
---
updated-dependencies:
- dependency-name: actions/checkout
dependency-version: 7.0.1
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: actions-minor-and-patch
- dependency-name: pnpm/action-setup
dependency-version: 6.0.10
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: actions-minor-and-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
2026-09-03 14:59:21 -04:00
haelyra
204cc2d2a3
fix(release): stage ECC 2.2 launch safely
2026-08-25 17:19:45 -04:00
haelyra
bbf5493279
fix(release): clear final review blockers
2026-08-24 21:16:39 -04:00
haelyra
c83200bbbe
fix(release): follow release-note filename convention
2026-08-24 21:09:46 -04:00
haelyra
25d59ca41d
fix(release): select reviewed notes by version
2026-08-24 20:34:41 -04:00
haelyra
2c5a91a1d6
fix(release): make ECC 2.2 ready to publish
2026-08-24 20:15:12 -04:00
haelyra
bab38ae91b
fix(security): close installer filesystem races
...
Use no-follow file descriptors for legacy Codex snapshots, verification, restoration, and marker cleanup. Quarantine candidate removals and verify inode identity before deletion.
Carry the lifecycle runner as a verified artifact so privileged release workflows never dynamically check out and execute an output-selected revision.
2026-08-13 16:59:06 -04:00
1db5c8ab4a
fix(install): harden ECC installer lifecycle
...
Make Antigravity 2.0 installs native and safely migrate legacy state. Ensure doctor, repair, status projection, repeat installs, legacy Codex sync, and uninstall converge without losing user files. Exclude Python bytecode and harden repo-scan bootstrap guidance.
Gate publishing and pull-request merges on one exact packed artifact completing install, repeat, drift, repair, status, and uninstall across Linux, macOS, and Windows.
Co-authored-by: lorencifernando-coder <lorenci.fernando@gmail.com >
Co-authored-by: Suliman Abdulrazzaq <suliman9000a@gmail.com >
Co-authored-by: Wu Shuwen <mikewushuwen@outlook.com >
2026-08-13 16:42:51 -04:00
d0fc6be911
chore(deps): bump actions/setup-node from 6.4.0 to 7.0.0 ( #2590 )
...
Bumps [actions/setup-node](https://github.com/actions/setup-node ) from 6.4.0 to 7.0.0.
- [Release notes](https://github.com/actions/setup-node/releases )
- [Commits](https://github.com/actions/setup-node/compare/48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e...820762786026740c76f36085b0efc47a31fe5020 )
---
updated-dependencies:
- dependency-name: actions/setup-node
dependency-version: 7.0.0
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-08-11 17:24:13 -04:00
Affaan Mustafa and Claude
edaf6fef94
fix(release): drop the dead OMP adapter verification step
...
The step ran node tests/omp/omp-plugin.test.js, which has never existed in
this repository. It was added by #2382 without the test file, so Verify
Release failed on every tag and no release could publish.
The OpenCode payload is already verified by tests/scripts/build-opencode.test.js
in the preceding step, and the plugin and marketplace manifests by
tests/plugin-manifest.test.js in Verify release metadata stays in sync.
Co-Authored-By: Claude <noreply@anthropic.com >
Claude-Session: https://claude.ai/code/session_0149VwNuynam6rvEfcMmiHHa
2026-07-27 14:07:43 -04:00
dependabot[bot] and GitHub
efc91870c7
chore(deps): update pinned GitHub actions ( #2540 )
...
Update actions/stale to v10.4.0 and softprops/action-gh-release to v3.0.2 while preserving exact SHA pinning.
2026-07-26 03:11:38 -07:00
ad08352f60
chore(deps): bump the actions-minor-and-patch group across 1 directory with 3 updates ( #2325 )
...
Bumps the actions-minor-and-patch group with 3 updates in the / directory: [actions/setup-node](https://github.com/actions/setup-node ), [pnpm/action-setup](https://github.com/pnpm/action-setup ) and [softprops/action-gh-release](https://github.com/softprops/action-gh-release ).
Updates `actions/setup-node` from 6.3.0 to 6.4.0
- [Release notes](https://github.com/actions/setup-node/releases )
- [Commits](https://github.com/actions/setup-node/compare/v6.3.0...48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e )
Updates `pnpm/action-setup` from 6.0.8 to 6.0.9
- [Release notes](https://github.com/pnpm/action-setup/releases )
- [Commits](https://github.com/pnpm/action-setup/compare/0e279bb959325dab635dd2c09392533439d90093...0ebf47130e4866e96fce0953f49152a61190b271 )
Updates `softprops/action-gh-release` from 3.0.0 to 3.0.1
- [Release notes](https://github.com/softprops/action-gh-release/releases )
- [Changelog](https://github.com/softprops/action-gh-release/blob/master/CHANGELOG.md )
- [Commits](https://github.com/softprops/action-gh-release/compare/b4309332981a82ec1c5618f44dd2e27cc8bfbfda...718ea10b132b3b2eba29c1007bb80653f286566b )
---
updated-dependencies:
- dependency-name: actions/setup-node
dependency-version: 6.4.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: actions-minor-and-patch
- dependency-name: pnpm/action-setup
dependency-version: 6.0.9
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: actions-minor-and-patch
- dependency-name: softprops/action-gh-release
dependency-version: 3.0.1
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: actions-minor-and-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-06-29 15:56:09 -07:00
e676d1da7f
chore(deps): bump actions/checkout from 6.0.3 to 7.0.0 ( #2328 )
...
Bumps [actions/checkout](https://github.com/actions/checkout ) from 6.0.3 to 7.0.0.
- [Release notes](https://github.com/actions/checkout/releases )
- [Commits](https://github.com/actions/checkout/compare/v6.0.3...v7 )
---
updated-dependencies:
- dependency-name: actions/checkout
dependency-version: 7.0.0
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-06-29 15:55:45 -07:00
00b443eddb
ci: isolate OMP workflow verification ( #2382 )
...
Co-authored-by: jan <jan@w-saxs001.local >
2026-06-29 15:51:00 -07:00
d71ffd56b9
chore(deps): bump actions/setup-node ( #2204 )
...
Bumps the actions-minor-and-patch group with 1 update in the / directory: [actions/setup-node](https://github.com/actions/setup-node ).
Updates `actions/setup-node` from 6.3.0 to 6.4.0
- [Release notes](https://github.com/actions/setup-node/releases )
- [Commits](https://github.com/actions/setup-node/compare/53b83947a5a98c8d113130e565377fae1a50d02f...48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e )
---
updated-dependencies:
- dependency-name: actions/setup-node
dependency-version: 6.4.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: actions-minor-and-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-06-10 23:39:00 -04:00
09e2bc58d3
chore(deps): bump actions/checkout from 6.0.2 to 6.0.3 ( #2183 )
...
Bumps [actions/checkout](https://github.com/actions/checkout ) from 6.0.2 to 6.0.3.
- [Release notes](https://github.com/actions/checkout/releases )
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md )
- [Commits](https://github.com/actions/checkout/compare/de0fac2e4500dabe0009e67214ff5f5447ce83dd...df4cb1c069e1874edd31b4311f1884172cec0e10 )
---
updated-dependencies:
- dependency-name: actions/checkout
dependency-version: 6.0.3
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-06-07 13:25:31 +08:00
Affaan Mustafa and Affaan Mustafa
9ee1e15564
docs: define ECC 2.0 hypergrowth release lane
...
Refresh the active 2.0 release surface for the affaan-m/ECC repo identity, update package/plugin/workflow launch metadata, and add an operator command center for release video, partner, sponsor, consulting, and social launch execution.
2026-05-19 05:42:38 -04:00
Affaan Mustafa
7911af4a39
security: scope release oidc publishing
2026-05-18 13:41:10 -04:00
Affaan Mustafa and GitHub
13585f1092
feat: add platform and supply-chain audit commands ( #1926 )
2026-05-15 08:06:26 -04:00
Affaan Mustafa and GitHub
209abd403b
ci: disable checkout credential persistence in privileged workflows ( #1851 )
2026-05-13 01:15:49 -04:00
Affaan Mustafa and GitHub
33db548be3
ci: ignore install scripts in release workflows ( #1839 )
2026-05-12 21:36:36 -04:00
Affaan Mustafa
0a87323eda
feat(ecc2): finalize rc1 release surface
2026-04-28 22:10:04 -04:00
Affaan Mustafa
b5c4d2beb9
fix: wire npm auth into release publish
2026-04-14 20:43:22 -07:00
Affaan Mustafa
34380326c8
fix: publish npm releases and clarify install identifiers
2026-04-14 20:42:28 -07:00
Affaan Mustafa and GitHub
5c4570baa5
Merge pull request #1370 from affaan-m/dependabot/github_actions/softprops/action-gh-release-3.0.0
...
build(deps): bump softprops/action-gh-release from 2.6.1 to 3.0.0
2026-04-13 00:30:59 -07:00
Affaan Mustafa
db8247d701
chore: update release action version comments
2026-04-12 23:54:26 -07:00
Affaan Mustafa and GitHub
28edd197c2
fix: harden release surface version and packaging sync ( #1388 )
...
* fix: keep ecc release surfaces version-synced
* fix: keep lockfile release version in sync
* fix: remove release version drift from locks and tests
* fix: keep root release metadata version-synced
* fix: keep codex marketplace metadata version-synced
* fix: gate release workflows on full metadata sync
* fix: ship all versioned release metadata
* fix: harden manual release path
* fix: keep localized release docs version-synced
* fix: sync install architecture version examples
* test: cover shipped plugin metadata in npm pack
* fix: verify final npm payload in release script
* fix: ship opencode lockfile in npm package
* docs: sync localized release highlights
* fix: stabilize windows ci portability
* fix: tighten release script version sync
* fix: prefer repo-relative hook file paths
* fix: make npm pack test shell-safe on windows
2026-04-12 22:33:32 -07:00
dependabot[bot] and GitHub
5ae63b301f
build(deps): bump softprops/action-gh-release from 2.6.1 to 3.0.0
...
Bumps [softprops/action-gh-release](https://github.com/softprops/action-gh-release ) from 2.6.1 to 3.0.0.
- [Release notes](https://github.com/softprops/action-gh-release/releases )
- [Changelog](https://github.com/softprops/action-gh-release/blob/master/CHANGELOG.md )
- [Commits](https://github.com/softprops/action-gh-release/compare/153bb8e04406b158c6c84fc1615b65b24149a1fe...b4309332981a82ec1c5618f44dd2e27cc8bfbfda )
---
updated-dependencies:
- dependency-name: softprops/action-gh-release
dependency-version: 3.0.0
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com >
2026-04-12 04:52:35 +00:00
Affaan Mustafa
4967dad08c
ci: gate releases on opencode payload verification
2026-04-06 14:08:08 -07:00
87363f0e59
chore(deps): bump actions/checkout from 4.3.1 to 6.0.2 ( #1060 )
...
Bumps [actions/checkout](https://github.com/actions/checkout ) from 4.3.1 to 6.0.2.
- [Release notes](https://github.com/actions/checkout/releases )
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md )
- [Commits](https://github.com/actions/checkout/compare/34e114876b0b11c390a56381ad16ebd13914f8d5...de0fac2e4500dabe0009e67214ff5f5447ce83dd )
---
updated-dependencies:
- dependency-name: actions/checkout
dependency-version: 6.0.2
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Affaan Mustafa <me@affaanmustafa.com >
2026-03-31 14:07:40 -07:00
Andriy Kalashnykov
46f37ae4fb
chore: pin actions to commit SHAs and add Skills section to CLAUDE.md
...
Pin all GitHub Actions to commit SHAs instead of mutable version tags
across ci.yml, release.yml, maintenance.yml, and all reusable workflows.
This prevents supply-chain attacks via tag hijacking.
Add the required Skills section to CLAUDE.md mapping project files
(README.md, .github/workflows/*.yml) to their respective review skills.
2026-03-29 17:16:56 -04:00
dagecko
28a1fbc3f2
fix: pin 6 actions to commit SHA, extract 1 expression to env var
2026-03-28 15:57:55 -04:00
Affaan Mustafa
48b883d741
feat: deliver v1.8.0 harness reliability and parity updates
2026-03-04 14:48:06 -08:00
ericcai and GitHub
d2191d09a2
fix: sync plugin.json version with latest tag ( #171 )
...
Sync plugin.json version to 1.4.1, add CI check to verify versions match on release, and add release.sh script. Fixes #170 .
2026-02-08 16:18:49 -08:00
Roei Bar Aviv and GitHub
7c0bc25982
feat: add comprehensive CI/CD pipeline
...
Adds GitHub Actions workflows for CI, maintenance, and releases with multi-platform testing matrix.
2026-01-28 23:05:43 -08:00
