From 99feabc93a8fe479bac1a09d182b336ba50d5892 Mon Sep 17 00:00:00 2001
From: Bin Le <bin.le.code@gmail.com>
Date: Wed, 12 Aug 2026 21:56:49 -0400
Subject: [PATCH] Release v1.9.1: fix guard-release pagination
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Both gh api calls in guard-release.yml ran un-paginated. The REST API
returns 30 items per page, so with 90 tags and only the newest 30
releases visible the guard flagged the 60 older tags as missing a
release object. Every release from v1.6.9 through v1.9.0 failed the
gate on phantom findings; all 90 tags in fact had releases.

A permanently-red gate reports nothing, so the one real failure it
exists to catch — a bare `git tag` push that skips tag_release.sh —
would have been invisible in the noise.

Added --paginate to both calls: /releases so the comparison set is
complete, and git/refs/tags so the tag list does not silently truncate
past its own page cap later (a false negative is the worse failure
mode for an integrity gate).

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 .github/workflows/guard-release.yml | 11 +++++++++--
 CHANGELOG.md                        | 16 ++++++++++++++++
 pyproject.toml                      |  2 +-
 uv.lock                             |  2 +-
 4 files changed, 27 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/guard-release.yml b/.github/workflows/guard-release.yml
index 63f7aca..102964d 100644
--- a/.github/workflows/guard-release.yml
+++ b/.github/workflows/guard-release.yml
@@ -25,8 +25,15 @@ jobs:
         run: |
           set -euo pipefail
 
-          TAGS="$(gh api "repos/${GH_REPO}/git/refs/tags" --jq '.[].ref | ltrimstr("refs/tags/")' | grep '^v' | sort -V)"
-          RELEASES="$(gh api "repos/${GH_REPO}/releases" --jq '.[].tag_name' | sort -V | uniq)"
+          # --paginate is load-bearing on BOTH calls: the REST API returns 30
+          # items per page, so an un-paginated /releases sees only the newest 30
+          # and reports every older tag as missing (this guard was red from
+          # v1.6.9 to v1.9.0 for exactly that reason — 90 tags vs 30 visible
+          # releases = 60 phantom failures). The tags endpoint returns all 90
+          # today, but will start silently under-checking past its own page cap,
+          # which is the worse failure for an integrity gate: a false negative.
+          TAGS="$(gh api --paginate "repos/${GH_REPO}/git/refs/tags" --jq '.[].ref | ltrimstr("refs/tags/")' | grep '^v' | sort -V)"
+          RELEASES="$(gh api --paginate "repos/${GH_REPO}/releases" --jq '.[].tag_name' | sort -V | uniq)"
 
           missing=()
           while IFS= read -r tag; do
diff --git a/CHANGELOG.md b/CHANGELOG.md
index cef62fb..dbfdb0d 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -6,6 +6,22 @@ This project follows a Keep a Changelog-style format and uses version tags for r
 
 ## [Unreleased]
 
+## [1.9.1] - 2026-08-12
+
+### Fixed
+
+- **`guard-release` never actually guarded anything.** Both `gh api` calls in
+  the workflow ran un-paginated, and the REST API returns 30 items per page.
+  With 90 tags and only the newest 30 releases visible, the guard reported the
+  60 older tags as having no GitHub Release object — every release from v1.6.9
+  through v1.9.0 failed the gate on phantom findings while every tag in fact
+  had its release. A permanently-red integrity gate reports nothing, so the
+  one real failure it exists to catch (a bare `git tag` push that skips
+  `tag_release.sh`) would have been invisible in the noise. Added `--paginate`
+  to both calls: `/releases` so the comparison set is complete, and
+  `git/refs/tags` so the tag list does not silently truncate past its own page
+  cap later — a false negative being the worse failure mode for a guard.
+
 ## [1.9.0] - 2026-08-12
 
 ### Changed
diff --git a/pyproject.toml b/pyproject.toml
index 3441c1a..aaeccc6 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "actop"
-version = "1.9.0"
+version = "1.9.1"
 description = "Apple Silicon (M1–M4) power, GPU, ANE & memory-bandwidth monitor — sudoless TUI + Python API for profiling local LLM / MLX / CoreML inference"
 readme = "README.md"
 license = { text = "MIT" }
diff --git a/uv.lock b/uv.lock
index a84e74c..e4d1173 100644
--- a/uv.lock
+++ b/uv.lock
@@ -15,7 +15,7 @@ resolution-markers = [
 
 [[package]]
 name = "actop"
-version = "1.9.0"
+version = "1.9.1"
 source = { editable = "." }
 dependencies = [
     { name = "rich" },