You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Still open by design: signed release provenance/attestations are owned by T09-03 and must be verified on an actual release path before this task can close.
Implemented by PR #509 and merged to master as 60abf8a.
Repository-side signed release and attestation support is complete: build-once exact tarball publishing, npm OIDC trusted publishing, provenance and SBOM attestations, clean-room artifact verification, release verification, and rollback planning. All available workflows on the merge commit completed successfully.
The first live npm publication remains an explicit owner-controlled external gate: claim/bootstrap the package interactively, configure npm trusted publishing for .github/workflows/publish.yml, then create the release tag. No long-lived CI publishing token was introduced.
Activity
edithatogo commentedon Aug 9, 2026
Still open by design: signed release provenance/attestations are owned by T09-03 and must be verified on an actual release path before this task can close.
edithatogo commentedon Aug 9, 2026
Implemented by PR #509 and merged to master as 60abf8a.
Repository-side signed release and attestation support is complete: build-once exact tarball publishing, npm OIDC trusted publishing, provenance and SBOM attestations, clean-room artifact verification, release verification, and rollback planning. All available workflows on the merge commit completed successfully.
The first live npm publication remains an explicit owner-controlled external gate: claim/bootstrap the package interactively, configure npm trusted publishing for .github/workflows/publish.yml, then create the release tag. No long-lived CI publishing token was introduced.