haelyra
bab38ae91b
fix(security): close installer filesystem races
...
Use no-follow file descriptors for legacy Codex snapshots, verification, restoration, and marker cleanup. Quarantine candidate removals and verify inode identity before deletion.
Carry the lifecycle runner as a verified artifact so privileged release workflows never dynamically check out and execute an output-selected revision.
2026-08-13 16:59:06 -04:00
1db5c8ab4a
fix(install): harden ECC installer lifecycle
...
Make Antigravity 2.0 installs native and safely migrate legacy state. Ensure doctor, repair, status projection, repeat installs, legacy Codex sync, and uninstall converge without losing user files. Exclude Python bytecode and harden repo-scan bootstrap guidance.
Gate publishing and pull-request merges on one exact packed artifact completing install, repeat, drift, repair, status, and uninstall across Linux, macOS, and Windows.
Co-authored-by: lorencifernando-coder <lorenci.fernando@gmail.com >
Co-authored-by: Suliman Abdulrazzaq <suliman9000a@gmail.com >
Co-authored-by: Wu Shuwen <mikewushuwen@outlook.com >
2026-08-13 16:42:51 -04:00
d0fc6be911
chore(deps): bump actions/setup-node from 6.4.0 to 7.0.0 ( #2590 )
...
Bumps [actions/setup-node](https://github.com/actions/setup-node ) from 6.4.0 to 7.0.0.
- [Release notes](https://github.com/actions/setup-node/releases )
- [Commits](https://github.com/actions/setup-node/compare/48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e...820762786026740c76f36085b0efc47a31fe5020 )
---
updated-dependencies:
- dependency-name: actions/setup-node
dependency-version: 7.0.0
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-08-11 17:24:13 -04:00
Affaan Mustafa and Claude
edaf6fef94
fix(release): drop the dead OMP adapter verification step
...
The step ran node tests/omp/omp-plugin.test.js, which has never existed in
this repository. It was added by #2382 without the test file, so Verify
Release failed on every tag and no release could publish.
The OpenCode payload is already verified by tests/scripts/build-opencode.test.js
in the preceding step, and the plugin and marketplace manifests by
tests/plugin-manifest.test.js in Verify release metadata stays in sync.
Co-Authored-By: Claude <noreply@anthropic.com >
Claude-Session: https://claude.ai/code/session_0149VwNuynam6rvEfcMmiHHa
2026-07-27 14:07:43 -04:00
dependabot[bot] and GitHub
efc91870c7
chore(deps): update pinned GitHub actions ( #2540 )
...
Update actions/stale to v10.4.0 and softprops/action-gh-release to v3.0.2 while preserving exact SHA pinning.
2026-07-26 03:11:38 -07:00
ad08352f60
chore(deps): bump the actions-minor-and-patch group across 1 directory with 3 updates ( #2325 )
...
Bumps the actions-minor-and-patch group with 3 updates in the / directory: [actions/setup-node](https://github.com/actions/setup-node ), [pnpm/action-setup](https://github.com/pnpm/action-setup ) and [softprops/action-gh-release](https://github.com/softprops/action-gh-release ).
Updates `actions/setup-node` from 6.3.0 to 6.4.0
- [Release notes](https://github.com/actions/setup-node/releases )
- [Commits](https://github.com/actions/setup-node/compare/v6.3.0...48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e )
Updates `pnpm/action-setup` from 6.0.8 to 6.0.9
- [Release notes](https://github.com/pnpm/action-setup/releases )
- [Commits](https://github.com/pnpm/action-setup/compare/0e279bb959325dab635dd2c09392533439d90093...0ebf47130e4866e96fce0953f49152a61190b271 )
Updates `softprops/action-gh-release` from 3.0.0 to 3.0.1
- [Release notes](https://github.com/softprops/action-gh-release/releases )
- [Changelog](https://github.com/softprops/action-gh-release/blob/master/CHANGELOG.md )
- [Commits](https://github.com/softprops/action-gh-release/compare/b4309332981a82ec1c5618f44dd2e27cc8bfbfda...718ea10b132b3b2eba29c1007bb80653f286566b )
---
updated-dependencies:
- dependency-name: actions/setup-node
dependency-version: 6.4.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: actions-minor-and-patch
- dependency-name: pnpm/action-setup
dependency-version: 6.0.9
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: actions-minor-and-patch
- dependency-name: softprops/action-gh-release
dependency-version: 3.0.1
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: actions-minor-and-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-06-29 15:56:09 -07:00
e676d1da7f
chore(deps): bump actions/checkout from 6.0.3 to 7.0.0 ( #2328 )
...
Bumps [actions/checkout](https://github.com/actions/checkout ) from 6.0.3 to 7.0.0.
- [Release notes](https://github.com/actions/checkout/releases )
- [Commits](https://github.com/actions/checkout/compare/v6.0.3...v7 )
---
updated-dependencies:
- dependency-name: actions/checkout
dependency-version: 7.0.0
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-06-29 15:55:45 -07:00
00b443eddb
ci: isolate OMP workflow verification ( #2382 )
...
Co-authored-by: jan <jan@w-saxs001.local >
2026-06-29 15:51:00 -07:00
d71ffd56b9
chore(deps): bump actions/setup-node ( #2204 )
...
Bumps the actions-minor-and-patch group with 1 update in the / directory: [actions/setup-node](https://github.com/actions/setup-node ).
Updates `actions/setup-node` from 6.3.0 to 6.4.0
- [Release notes](https://github.com/actions/setup-node/releases )
- [Commits](https://github.com/actions/setup-node/compare/53b83947a5a98c8d113130e565377fae1a50d02f...48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e )
---
updated-dependencies:
- dependency-name: actions/setup-node
dependency-version: 6.4.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: actions-minor-and-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-06-10 23:39:00 -04:00
09e2bc58d3
chore(deps): bump actions/checkout from 6.0.2 to 6.0.3 ( #2183 )
...
Bumps [actions/checkout](https://github.com/actions/checkout ) from 6.0.2 to 6.0.3.
- [Release notes](https://github.com/actions/checkout/releases )
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md )
- [Commits](https://github.com/actions/checkout/compare/de0fac2e4500dabe0009e67214ff5f5447ce83dd...df4cb1c069e1874edd31b4311f1884172cec0e10 )
---
updated-dependencies:
- dependency-name: actions/checkout
dependency-version: 6.0.3
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-06-07 13:25:31 +08:00
Affaan Mustafa and Affaan Mustafa
9ee1e15564
docs: define ECC 2.0 hypergrowth release lane
...
Refresh the active 2.0 release surface for the affaan-m/ECC repo identity, update package/plugin/workflow launch metadata, and add an operator command center for release video, partner, sponsor, consulting, and social launch execution.
2026-05-19 05:42:38 -04:00
Affaan Mustafa
7911af4a39
security: scope release oidc publishing
2026-05-18 13:41:10 -04:00
Affaan Mustafa and GitHub
13585f1092
feat: add platform and supply-chain audit commands ( #1926 )
2026-05-15 08:06:26 -04:00
Affaan Mustafa and GitHub
209abd403b
ci: disable checkout credential persistence in privileged workflows ( #1851 )
2026-05-13 01:15:49 -04:00
Affaan Mustafa and GitHub
33db548be3
ci: ignore install scripts in release workflows ( #1839 )
2026-05-12 21:36:36 -04:00
Affaan Mustafa
0a87323eda
feat(ecc2): finalize rc1 release surface
2026-04-28 22:10:04 -04:00
Affaan Mustafa
b5c4d2beb9
fix: wire npm auth into release publish
2026-04-14 20:43:22 -07:00
Affaan Mustafa
34380326c8
fix: publish npm releases and clarify install identifiers
2026-04-14 20:42:28 -07:00
Affaan Mustafa and GitHub
5c4570baa5
Merge pull request #1370 from affaan-m/dependabot/github_actions/softprops/action-gh-release-3.0.0
...
build(deps): bump softprops/action-gh-release from 2.6.1 to 3.0.0
2026-04-13 00:30:59 -07:00
Affaan Mustafa
db8247d701
chore: update release action version comments
2026-04-12 23:54:26 -07:00
Affaan Mustafa and GitHub
28edd197c2
fix: harden release surface version and packaging sync ( #1388 )
...
* fix: keep ecc release surfaces version-synced
* fix: keep lockfile release version in sync
* fix: remove release version drift from locks and tests
* fix: keep root release metadata version-synced
* fix: keep codex marketplace metadata version-synced
* fix: gate release workflows on full metadata sync
* fix: ship all versioned release metadata
* fix: harden manual release path
* fix: keep localized release docs version-synced
* fix: sync install architecture version examples
* test: cover shipped plugin metadata in npm pack
* fix: verify final npm payload in release script
* fix: ship opencode lockfile in npm package
* docs: sync localized release highlights
* fix: stabilize windows ci portability
* fix: tighten release script version sync
* fix: prefer repo-relative hook file paths
* fix: make npm pack test shell-safe on windows
2026-04-12 22:33:32 -07:00
dependabot[bot] and GitHub
5ae63b301f
build(deps): bump softprops/action-gh-release from 2.6.1 to 3.0.0
...
Bumps [softprops/action-gh-release](https://github.com/softprops/action-gh-release ) from 2.6.1 to 3.0.0.
- [Release notes](https://github.com/softprops/action-gh-release/releases )
- [Changelog](https://github.com/softprops/action-gh-release/blob/master/CHANGELOG.md )
- [Commits](https://github.com/softprops/action-gh-release/compare/153bb8e04406b158c6c84fc1615b65b24149a1fe...b4309332981a82ec1c5618f44dd2e27cc8bfbfda )
---
updated-dependencies:
- dependency-name: softprops/action-gh-release
dependency-version: 3.0.0
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com >
2026-04-12 04:52:35 +00:00
Affaan Mustafa
4967dad08c
ci: gate releases on opencode payload verification
2026-04-06 14:08:08 -07:00
87363f0e59
chore(deps): bump actions/checkout from 4.3.1 to 6.0.2 ( #1060 )
...
Bumps [actions/checkout](https://github.com/actions/checkout ) from 4.3.1 to 6.0.2.
- [Release notes](https://github.com/actions/checkout/releases )
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md )
- [Commits](https://github.com/actions/checkout/compare/34e114876b0b11c390a56381ad16ebd13914f8d5...de0fac2e4500dabe0009e67214ff5f5447ce83dd )
---
updated-dependencies:
- dependency-name: actions/checkout
dependency-version: 6.0.2
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Affaan Mustafa <me@affaanmustafa.com >
2026-03-31 14:07:40 -07:00
Andriy Kalashnykov
46f37ae4fb
chore: pin actions to commit SHAs and add Skills section to CLAUDE.md
...
Pin all GitHub Actions to commit SHAs instead of mutable version tags
across ci.yml, release.yml, maintenance.yml, and all reusable workflows.
This prevents supply-chain attacks via tag hijacking.
Add the required Skills section to CLAUDE.md mapping project files
(README.md, .github/workflows/*.yml) to their respective review skills.
2026-03-29 17:16:56 -04:00
dagecko
28a1fbc3f2
fix: pin 6 actions to commit SHA, extract 1 expression to env var
2026-03-28 15:57:55 -04:00
Affaan Mustafa
48b883d741
feat: deliver v1.8.0 harness reliability and parity updates
2026-03-04 14:48:06 -08:00
ericcai and GitHub
d2191d09a2
fix: sync plugin.json version with latest tag ( #171 )
...
Sync plugin.json version to 1.4.1, add CI check to verify versions match on release, and add release.sh script. Fixes #170 .
2026-02-08 16:18:49 -08:00
Roei Bar Aviv and GitHub
7c0bc25982
feat: add comprehensive CI/CD pipeline
...
Adds GitHub Actions workflows for CI, maintenance, and releases with multi-platform testing matrix.
2026-01-28 23:05:43 -08:00
haelyra