Repository navigation
ci(release): automate drafts with the audited official CLI - #32
Merged
Merged
Conversation
Add draft-PR configuration and a local release preparation helper while preserving signed candidate and publication boundaries. Keep execution disabled pending a patched upstream Action bundle. Release-Type: none
Replace the affected prebuilt Action with a frozen 162-package graph and verified patched Node runtime. Preserve signed candidates and publication gates, and exclude installed tooling from documentation scans and source artifacts. Release-Type: none
CruxExperts
changed the title
CruxExperts
marked this pull request as ready for review
October 23, 2026 20:55
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Replace the affected prebuilt Release Please Action with official Release Please CLI 17.11.2 and a repository-owned lockfile. The fresh 162-package graph resolves patched Handlebars 4.7.10 and other current transitive fixes. OSV, GitHub reviewed/malware advisories, and npm reported no findings for the exact graph; all registry artifact URLs and integrity values matched. The workflow bootstraps patched Node 22.23.4 from its official archive with SHA256 verification.
Release Please prepares draft PRs only. It defers while the current VERSION lacks a published release, preserving one deliberate release candidate. Required signed commits, signed tags, exact main CI, artifact checks, and signed-checksum publication remain intact. No private signing key or personal token is installed in Actions.
Validation: independent workflow/security review accepted the implementation; 33 preparation/release-provenance tests and four Markdown tests passed. Static/documentation/generated checks, wheel and sdist builds, installed artifact smoke, and archive inventory checks passed. Installed npm dependencies and private state are excluded from the source archive. Exact-HEAD CI runs on this PR.
This resolves the previously recorded activation blocker through a separately locked, audited CLI graph; it does not execute the affected v5 Action bundle. Follow the signed candidate workflow in docs/VERSIONING.md for the 2.0.6 release.
Release-Type: none