From 74835d62bdc91bf1e822306d0d8cadfbca08f9bb Mon Sep 17 00:00:00 2001 From: BL Date: Tue, 13 Oct 2026 16:32:38 +0000 Subject: [PATCH] docs: record qualified codec 0.2.0 publication Co-Authored-By: Claude Opus 5.5 --- .../010-move-the-codec-to-stable-effect-4-0-x.md | 4 ++++ .github/RELEASE_EVIDENCE/010/registry-release.json | 12 ++++++++++++ 2 files changed, 16 insertions(+) create mode 100644 .github/RELEASE_EVIDENCE/010/registry-release.json diff --git a/.github/ISSUE_SPECS/010-move-the-codec-to-stable-effect-4-0-x.md b/.github/ISSUE_SPECS/010-move-the-codec-to-stable-effect-4-0-x.md index 66a3980..01cec71 100644 --- a/.github/ISSUE_SPECS/010-move-the-codec-to-stable-effect-4-0-x.md +++ b/.github/ISSUE_SPECS/010-move-the-codec-to-stable-effect-4-0-x.md @@ -27,3 +27,7 @@ Base: origin/main `10abab98191b878482a02c0d8e9a2572c8eb0958` (codec 0.1.1). Bran ## Release contract and blockers Release follows `.github/RELEASING.md`: merge a reviewed, green PR; run `npm-publish.yml` on `main` with `mode=publish`, the exact 40-character merge SHA, and `expected_version=0.2.0`; create the `v0.2.0` release/tag at that commit; record the run URL, registry integrity, and decoder hash here and in `.github/RELEASE_EVIDENCE/010/registry-release.json`. Blockers: the adapter PR installs this codec from the throwaway branch `effect-4.0.4-ci-dist` and must be flipped to the published 0.2.0 after release; delete that branch afterwards. Publication has not been performed. + +## Published release + +Codec 0.2.0 was merged in PR #9 at `56383ab56c2a389a6856b27d8207695f6153c0fe` and published through trusted publishing: https://github.com/misofm/codec/actions/runs/38429325908 . Its qualification and `npm publish` (signed provenance) succeeded; the job then failed its post-publish convergence check only because the registry took more than two minutes to list the version, so its registry-consumer job was skipped. A `mode=verify` dispatch at the same commit, https://github.com/misofm/codec/actions/runs/38430320099 , passed qualification, registry comparison, and the full registry-consumer matrix against the published tarball (read-only; it does not itself claim an OIDC publication). The `v0.2.0` annotated tag and release point to that revision: https://github.com/misofm/codec/releases/tag/v0.2.0 . Registry integrity, tarball SHA-256, and decoder hash are recorded in `.github/RELEASE_EVIDENCE/010/registry-release.json`; the decoder asset is unchanged (`70caf381…`). The adapter PR (https://github.com/misofm/engine-web-adapter/pull/130) moves to the published package; the throwaway `effect-4.0.4-ci-dist` branch is retained until that lands. diff --git a/.github/RELEASE_EVIDENCE/010/registry-release.json b/.github/RELEASE_EVIDENCE/010/registry-release.json new file mode 100644 index 0000000..f719702 --- /dev/null +++ b/.github/RELEASE_EVIDENCE/010/registry-release.json @@ -0,0 +1,12 @@ +{ + "version": "0.2.0", + "dist.integrity": "sha512-nbhiEKPBElcwB4sc57McQLWh/1hdXLgPH2W2Dz2qU3luxiiNXtCwbCU/BunGuTrRNVudnrJod8rITv5ksUmqGA==", + "tarballSha256": "dcc058497b59187528703b4b2dba9b2ea09a4d6604754bbf23a4c6502c88e999", + "workflow": "https://github.com/misofm/codec/actions/runs/38429325908", + "workflowNote": "mode=publish: qualify succeeded and `npm publish` succeeded with signed provenance; the job's post-publish convergence check failed only because the registry took more than two minutes to list the version, so registry-consumer was skipped.", + "verifyWorkflow": "https://github.com/misofm/codec/actions/runs/38430320099", + "verifyWorkflowNote": "mode=verify at the same commit: qualify, publish-or-compare and registry-consumer all succeeded against the published tarball; read-only, so it does not itself claim an OIDC publication.", + "sourceRevision": "56383ab56c2a389a6856b27d8207695f6153c0fe", + "release": "https://github.com/misofm/codec/releases/tag/v0.2.0", + "decoderSha256": "70caf38185675dff89498e89f98171d49ec6f143a56c6895088d93c35e2018cd" +}