From 5fe1d9a00f5a9be6ba5147f96b45b1925807928c Mon Sep 17 00:00:00 2001 From: Sebastian Mendel Date: Wed, 23 Sep 2026 19:56:58 +0200 Subject: [PATCH] chore(release): v1.1.0 Signed-off-by: Sebastian Mendel Assisted-by: claude-code:claude-opus-5-5 Agent-Session: https://claude.ai/code/session_016xPfc6NoiwpbHFanfQVTqP Agent-Host: 32116e --- .claude-plugin/plugin.json | 2 +- CHANGELOG.md | 6 ++++-- plugin.json | 2 +- skills/github-release/SKILL.md | 2 +- 4 files changed, 7 insertions(+), 5 deletions(-) diff --git a/.claude-plugin/plugin.json b/.claude-plugin/plugin.json index d6d06ed..e569281 100644 --- a/.claude-plugin/plugin.json +++ b/.claude-plugin/plugin.json @@ -1,6 +1,6 @@ { "name": "github-release", - "version": "1.0.4", + "version": "1.1.0", "description": "Safe, automated GitHub releases with supply chain security. Prevents dangerous gh release commands, orchestrates version bumps, signed tags, and CI-driven releases across ecosystems (TYPO3, PHP, Node.js, Go, Python, Rust, skill repos).", "author": { "name": "Netresearch DTT GmbH", diff --git a/CHANGELOG.md b/CHANGELOG.md index 9febeb9..4bca991 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -11,6 +11,8 @@ their notes were not backfilled here rather than reconstructed after the fact. ## [Unreleased] +## [1.1.0] - 2026-09-23 + ### Changed - `guard-gh-release.py` allows `gh release create` when `--verify-tag` is set. gh's own help (2.100.0) reads *"Abort in case the git tag doesn't already exist in the remote repository"*, so the invocation cannot create the lightweight tag that the block exists to prevent — it can only publish a tag that was pushed on purpose, and `guard-lightweight-tag.py` is what keeps that tag annotated and signed. `--verify-tag=false` and `--verify-tag=0` stay blocked, and a mention of the flag inside a quoted argument is not the flag. Without the exemption the guard blocked the one correct step in a repository whose supply-chain workflows listen on `release: published`: that event never fires for a release created with `GITHUB_TOKEN`, so nothing but a human credential can start the provenance and SBOM jobs, and the release had to be published around the guard @@ -32,7 +34,6 @@ their notes were not backfilled here rather than reconstructed after the fact. - `release-status.sh --watch` waits while the tag's publishing workflow has not completed, prints each state change to stderr, and then gives the normal verdict. Until now the release side had no counterpart to `pr-status.sh --watch`, and every wait on a release run was a hand-written loop - ## [1.0.4] - 2026-09-20 ### Changed @@ -157,7 +158,8 @@ their notes were not backfilled here rather than reconstructed after the fact. ([#92](https://github.com/netresearch/github-release-skill/issues/92)). - The `netresearch/skill-repo-skill` pre-commit hook moves to v2.0.1. -[Unreleased]: https://github.com/netresearch/github-release-skill/compare/v1.0.4...HEAD +[Unreleased]: https://github.com/netresearch/github-release-skill/compare/v1.1.0...HEAD +[1.1.0]: https://github.com/netresearch/github-release-skill/compare/v1.0.4...v1.1.0 [1.0.4]: https://github.com/netresearch/github-release-skill/compare/v1.0.3...v1.0.4 [1.0.3]: https://github.com/netresearch/github-release-skill/compare/v1.0.2...v1.0.3 [1.0.2]: https://github.com/netresearch/github-release-skill/compare/v1.0.1...v1.0.2 diff --git a/plugin.json b/plugin.json index c6f20bc..cdc670d 100644 --- a/plugin.json +++ b/plugin.json @@ -1,7 +1,7 @@ { "$schema": "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json", "name": "github-release", - "version": "1.0.4", + "version": "1.1.0", "description": "Safe, automated GitHub releases with supply chain security. Prevents dangerous gh release commands, orchestrates version bumps, signed tags, and CI-driven releases across ecosystems (TYPO3, PHP, Node.js, Go, Python, Rust, skill repos).", "author": { "name": "Netresearch DTT GmbH", diff --git a/skills/github-release/SKILL.md b/skills/github-release/SKILL.md index e5cebbb..350d5a4 100644 --- a/skills/github-release/SKILL.md +++ b/skills/github-release/SKILL.md @@ -5,7 +5,7 @@ license: "(MIT AND CC-BY-SA-4.0). See LICENSE-MIT and LICENSE-CC-BY-SA-4.0" compatibility: "Requires gh CLI, git with GPG/SSH signing configured." metadata: author: Netresearch DTT GmbH - version: "1.0.4" + version: "1.1.0" repository: https://github.com/netresearch/github-release-skill allowed-tools: Bash(gh:*) Bash(git:*) Read Write Edit Glob Grep ---