Release v1.9.1: fix guard-release pagination

.github/workflows/guard-release.yml

@@ -25,8 +25,15 @@ jobs:
         run: |
           set -euo pipefail
 
-          TAGS="$(gh api "repos/${GH_REPO}/git/refs/tags" --jq '.[].ref | ltrimstr("refs/tags/")' | grep '^v' | sort -V)"
-          RELEASES="$(gh api "repos/${GH_REPO}/releases" --jq '.[].tag_name' | sort -V | uniq)"
+          # --paginate is load-bearing on BOTH calls: the REST API returns 30
+          # items per page, so an un-paginated /releases sees only the newest 30
+          # and reports every older tag as missing (this guard was red from
+          # v1.6.9 to v1.9.0 for exactly that reason — 90 tags vs 30 visible
+          # releases = 60 phantom failures). The tags endpoint returns all 90
+          # today, but will start silently under-checking past its own page cap,
+          # which is the worse failure for an integrity gate: a false negative.
+          TAGS="$(gh api --paginate "repos/${GH_REPO}/git/refs/tags" --jq '.[].ref | ltrimstr("refs/tags/")' | grep '^v' | sort -V)"
+          RELEASES="$(gh api --paginate "repos/${GH_REPO}/releases" --jq '.[].tag_name' | sort -V | uniq)"
 
           missing=()
           while IFS= read -r tag; do

CHANGELOG.md

@@ -6,6 +6,22 @@ This project follows a Keep a Changelog-style format and uses version tags for r
 
 ## [Unreleased]
 
+## [1.9.1] - 2026-08-12
+
+### Fixed
+
+- **`guard-release` never actually guarded anything.** Both `gh api` calls in
+  the workflow ran un-paginated, and the REST API returns 30 items per page.
+  With 90 tags and only the newest 30 releases visible, the guard reported the
+  60 older tags as having no GitHub Release object — every release from v1.6.9
+  through v1.9.0 failed the gate on phantom findings while every tag in fact
+  had its release. A permanently-red integrity gate reports nothing, so the
+  one real failure it exists to catch (a bare `git tag` push that skips
+  `tag_release.sh`) would have been invisible in the noise. Added `--paginate`
+  to both calls: `/releases` so the comparison set is complete, and
+  `git/refs/tags` so the tag list does not silently truncate past its own page
+  cap later — a false negative being the worse failure mode for a guard.
+
 ## [1.9.0] - 2026-08-12
 
 ### Changed

pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "actop"
-version = "1.9.0"
+version = "1.9.1"
 description = "Apple Silicon (M1–M4) power, GPU, ANE & memory-bandwidth monitor — sudoless TUI + Python API for profiling local LLM / MLX / CoreML inference"
 readme = "README.md"
 license = { text = "MIT" }