From c4501e1214878ad01e891d621649a0a701417351 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=D0=A0=D0=BE=D0=B1=D0=BE=D1=82?= Date: Sat, 10 Oct 2026 20:18:10 +0200 Subject: [PATCH] =?UTF-8?q?0.2.3=20=E2=80=94=20a=20lightweight=20tag=20can?= =?UTF-8?q?not=20publish=20a=20release?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit release.yml gains one step right after checkout in the release job: git cat-file -t on the tag must print "tag", or the job fails with the remedy before the reachability check, the gates and publish. The 2026-10-09 family wave cut four lightweight member tags that the umbrella then read as each member's previous release (umbrella plan 2026-10-10, T5 / REQ-6). Version bumped in every home; CHANGELOG and ledgers updated. No skill, reference or installer change. Co-Authored-By: Claude Opus 5.5 (1M context) --- .claude-plugin/marketplace.json | 2 +- .github/workflows/release.yml | 14 ++++++++++++++ CHANGELOG.md | 11 +++++++++++ SKILL-CARD.md | 2 +- package.json | 2 +- plugins/telegram-dev/.claude-plugin/plugin.json | 2 +- 6 files changed, 29 insertions(+), 4 deletions(-) diff --git a/.claude-plugin/marketplace.json b/.claude-plugin/marketplace.json index f057409..25d8d0f 100644 --- a/.claude-plugin/marketplace.json +++ b/.claude-plugin/marketplace.json @@ -11,7 +11,7 @@ "name": "telegram-dev", "displayName": "Telegram Dev", "description": "Telegram development, split by the API each surface actually speaks. telegram-bots covers the official HTTP Bot API \u2014 update_id as the only idempotency key, the allowed_updates default that drops three types in silence, the webhook secret header, rate limits as a design constraint, and Telegram Stars with its ten-second pre-checkout window. telegram-userbots covers MTProto and Telethon \u2014 the session file as a credential equal to the password, FloodWaitError as the API working rather than failing, and the account-ban risk a bot token does not carry. telegram-miniapps covers initData verification, the algorithm shipped as a runnable fixture, and the SDK package whose name moved.", - "version": "0.2.2", + "version": "0.2.3", "author": { "name": "ssheleg", "url": "https://x.com/sshlg93" diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 4fbfac0..3d97278 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -48,6 +48,20 @@ jobs: ref: ${{ steps.t.outputs.tag }} fetch-depth: 0 + - name: The tag must be annotated (a lightweight tag hides the release) + run: | + set -eu + # `git describe` and `git submodule status` see annotated tags only; the + # 2026-10-09 wave cut four lightweight tags and the hub read each member + # as its previous release. Refuse here, before anything is published. + TAG="${{ steps.t.outputs.tag }}" + KIND=$(git cat-file -t "$TAG") + if [ "$KIND" != "tag" ]; then + echo "::error::$TAG is a $KIND, not an annotated tag object. Remedy: git tag -a $TAG -m '' at the same commit." + exit 1 + fi + echo "$TAG is annotated" + - name: The tag must be reachable from the default branch env: GH_TOKEN: ${{ github.token }} diff --git a/CHANGELOG.md b/CHANGELOG.md index d097881..b6be142 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,3 +1,14 @@ +## v0.2.3 — a lightweight tag cannot publish a release + +- **The release refuses a lightweight tag.** `release.yml` gains one step, right after + checkout and before any gate: `git cat-file -t` on the tag must print `tag`; a `commit` + fails the job with the remedy (`git tag -a -m ''` at the same commit) + before anything is published. `git describe` and `git submodule status` see annotated + tags only, and the 2026-10-09 family wave cut four lightweight member tags that the + umbrella then read as each member's previous release. The step is identical across the + family (umbrella plan 2026-10-10, T5 / REQ-6). Published tags are not re-cut. +- No skill, reference or installer change. + ## v0.2.2 — «добавь Telegram-бота» reaches the bot skill The 2026-10-08 family routing audit found that a request written with the inflected or diff --git a/SKILL-CARD.md b/SKILL-CARD.md index 6f55808..bdbc2fb 100644 --- a/SKILL-CARD.md +++ b/SKILL-CARD.md @@ -5,7 +5,7 @@ | Field | Value | |---|---| | Pack | `telegram-dev` | -| Version | `0.2.2` | +| Version | `0.2.3` | | Skills | `telegram-bots`, `telegram-userbots`, `telegram-miniapps` | | License | MIT | | Source | https://github.com/ssheleg/telegram-dev | diff --git a/package.json b/package.json index a87e89e..02d645c 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "@ssheleg/telegram-dev", - "version": "0.2.2", + "version": "0.2.3", "description": "Three skills for building on Telegram, separated by which API each one speaks: the official HTTP Bot API for bots, MTProto (Telethon) for user accounts, and Mini Apps for the web layer whose whole security model is one signed blob.", "bin": { "telegram-dev": "bin/telegram-dev.js" diff --git a/plugins/telegram-dev/.claude-plugin/plugin.json b/plugins/telegram-dev/.claude-plugin/plugin.json index 9c5d1cb..7b930b2 100644 --- a/plugins/telegram-dev/.claude-plugin/plugin.json +++ b/plugins/telegram-dev/.claude-plugin/plugin.json @@ -3,7 +3,7 @@ "name": "telegram-dev", "displayName": "Telegram Dev", "description": "Telegram development, split by the API each surface actually speaks. telegram-bots covers the official HTTP Bot API \u2014 update_id as the only idempotency key, the allowed_updates default that drops three types in silence, the webhook secret header, rate limits as a design constraint, and Telegram Stars with its ten-second pre-checkout window. telegram-userbots covers MTProto and Telethon \u2014 the session file as a credential equal to the password, FloodWaitError as the API working rather than failing, and the account-ban risk a bot token does not carry. telegram-miniapps covers initData verification, the algorithm shipped as a runnable fixture, and the SDK package whose name moved.", - "version": "0.2.2", + "version": "0.2.3", "author": { "name": "ssheleg", "url": "https://x.com/sshlg93"