Release CodeTruss CLI v0.2.38 - #21
Conversation
Bring the public mirror up to the shipped release. The mirror sat at 0.2.37 while codetruss.com served 0.2.38; the newest attested tag should never trail the bytes the site hands out. Source is mirrored from the 0.2.38 release commit 8fe9727, not from in-progress work: 114 files across packages/cli and packages/analyzer-engine, zero content mismatches and zero file-mode mismatches against that commit's trees. `pnpm release:artifact` rebuilds the bundle to the exact published digest 8b6093e502e10402fa6f84cd2cac86c7db9c3e54502c7566f1635ce993b32ff7, and `pnpm release:verify` confirms it byte-for-byte against the immutable website archive now recorded in release-reference.json. The archive, its SBOM, and the latest.json manifest downloaded from codetruss.com this run are byte-identical to the ones built from this tree. - Add the immutable 0.2.38 archive, checksum, and SBOM to public/downloads and repoint the latest.* aliases and manifest. The 0.2.37 archive stays: it is a tagged, attested release. - Update release-reference.json to the published archive, its SBOM, and the bundle digest 8d6039e227c2b959dc509bd2f4cf02d1d874203fb53b911656d15916aa4dcc03. - Mirror the one source change 0.2.38 carries — scope-inference.ts and its tests — plus the packaged changelog, and regenerate the root changelog from it so the release body stays byte-identical to what ships inside the archive. - Repoint the version-pinned README install and verification examples. The receipt excerpt keeps its "real 0.2.36 run" provenance: receipt.ts, signing.ts and local-evidence.ts are byte-identical 0.2.37 to 0.2.38, so relabelling it would assert a run that was never made. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
|
Warning Review limit reached
Next review available in: 3 minutes You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (14)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
@coderabbitai review |
|
|
@coderabbitai review |
|
1 participant
Scope
8fe9727, publish the immutable 0.2.38 artifacts, propagate the packaged changelog, and repoint the version-pinned README examples.Validation
Exit codes were captured directly into variables, never read through a pipe.
pnpm install --frozen-lockfilepnpm typecheckpnpm release:artifact8b6093e502e10402fa6f84cd2cac86c7db9c3e54502c7566f1635ce993b32ff7, byte-identical to the published archive; no drift inpublic/downloadsafter the rebuildpnpm testpnpm release:verifyVerified immutable CodeTruss CLI 0.2.38 release (8b6093e5…)pnpm test:installMirror fidelity: 114 files from release commit
8fe9727acrosspackages/cliandpackages/analyzer-engine, zero content mismatches and zero file-mode mismatches. (packages/cli/SBOM.cdx.jsonis generated at release time and is not tracked here; every other file underpackages/is compared.)Bytes match the live site. The archive, its SBOM, and
codetruss-cli-latest.jsonin this branch are byte-identical (cmp, exit 0) to the ones downloaded from codetruss.com this run, and the versioned URL, thelatestalias, and the digest recorded inlatest.jsonall agree:Falsification controls
Every verifier was proven to reject a known-bad input before its pass was trusted. Exit codes were captured explicitly — a
| headpipeline reports head's status, so the same known-bad input reads as exit 0 through a pipe and exit 1 under direct capture. That was demonstrated on a real tampered archive, not assumed:direct exit=1, '| head' exit=0.codetruss-cli-0.2.38.tgzrelease:verifyrelease metadata is not the canonical manifest for CLI 0.2.38latest.tgzaliased to a different real release (0.2.37)release:verifylatest.tgz does not match immutable codetruss-cli-0.2.38.tgzrelease:verify.sha256sidecarrelease:verifyis not the canonical checksumpackages/cli/README.mddrifted from the packaged copyrelease:verifydoes not contain the current README.mdcodetruss-cli-latest.jsonrelease:verify## 0.2.37heading deleted from the changelogrelease:artifactrelease chain breaks between 0.2.38 and 0.2.36## Unreleasedwith no version headingrelease:artifactshasum -a 256 -cGITHUB_REF_NAME=v0.2.37against this package versionrelease.ymltag-parity guardtag v0.2.37 does not match v0.2.38; the same guard acceptsv0.2.38(exit 0)Every control was reverted and the tree reverified clean afterwards:
git statusempty,release:verifyexit 0.README claims, rechecked against the shipped binary
cli.cjs --versionon the extracted 0.2.38 archivecodetruss 0.2.38verify-policy trust-keyin--helpcli.cjs --helplocal-registry-v2receipt.ts,signing.ts,local-evidence.tsat both release commitsThe receipt excerpt still reads "Abridged from a real 0.2.36 run" because that is its true provenance, and the rendering code is byte-identical under 0.2.38. Relabelling it would assert a run that was never made.
packages/cli/src/scope-inference.tsis the only source file that changed between the two release commits.Privacy and network impact
The one source change narrows an in-memory scope-inference rule. It reads the working set that was already collected and touches no I/O.
Release impact
packages/cli/CHANGELOG.mdmirrored verbatim, rootCHANGELOG.mdregenerated from it so its release body stays byte-identical,release-reference.jsonrepointed to the 0.2.38 archive (8b6093e5…), its SBOM (182f1b01…), and the bundle digest (8d6039e2…).What 0.2.38 fixes
With no allow globs configured, a single changed file could seat its own parent directory as an inferred scope root. On a turn touching several directories with one file each, every directory vouched for itself, so scope drift — the detection that runs on an unconfigured first run — could not fire at all. The scope was being read off the very change it was meant to judge. The single-file allowance stays, narrowed back to what it was introduced as in 0.2.32: the whole turn's fallback, not a grant each directory can claim for itself.
Receipt schema,
inferredclassification disclosure, and every signed Markdown rendering are unchanged, so receipts already on disk verify byte for byte.npm
npm
latestis@codetruss/cli@0.2.24(verified against the registry this run — it is still the only published version). Publication remains a separate, manually dispatched, reviewer-gated workflow.