Release CodeTruss CLI v0.2.40 - #29
Merged
Merged
Conversation
Syncs the 0.2.40 source from the private monorepo. This sync lands after 0.2.40 was already distributed from the website: the original release train halted on a Windows-only test failure, and the tag, GitHub release, and attestation were never created. The published archive has therefore had no verifiable provenance since it went up, which is the one thing this project promises about every artifact it ships. The content here is 0.2.40 as published. A local rebuild of this tree reproduces the distributed archive byte for byte: codetruss-cli-0.2.40.tgz sha256 5d64313b8b60acbd1f93e2246557967885a98fdc8c486ea7b2a6417fd8acdac2 That is the digest the website serves and the digest recorded in release-reference.json, so the release workflow can rebuild it, assert the match, and attest bytes that were genuinely reproduced rather than asserted. The Windows test isolation fix is included. It touches only files under packages/cli/test, which the package `files` allowlist excludes, so it cannot and does not change the released archive. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Syncs the 0.2.40 source from the private monorepo, closing a verification gap.
0.2.40 has been distributed from the website since it shipped, but its release
train halted on a Windows-only test failure. No tag, no GitHub release, and no
attestation were ever created, so
gh attestation verifyreturns 404 for anarchive users can download today. Every other published version verifies.
What makes this attestable rather than asserted
A rebuild of this tree reproduces the distributed archive byte for byte:
That is the digest the website serves, the digest in
release-reference.json,and the digest
release.ymlwill independently rebuild and check before itsigns anything. Nothing here asks anyone to trust bytes that were not
reproduced.
Windows fix
The test-isolation fix that unblocked the original train is included. It
touches only
packages/cli/test/**, which the packagefilesallowlistexcludes, so it cannot change the released archive — and does not: the archive
digest is identical with and without it.
Sync fidelity
147 mirrored files were compared byte for byte against the monorepo source
after a fresh checkout, including the new
public/downloads/grammars/artifacts. Zero mismatches. Mirror-owned files (workflows, README, packaging
metadata) are untouched.
Historical changelog entries and version labels are unchanged.