From 3aea2b695cc0da5d841280384147a51356a5d312 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=D0=A0=D0=BE=D0=B1=D0=BE=D1=82?= Date: Sat, 10 Oct 2026 20:37:05 +0200 Subject: [PATCH] docs: record 0.1.3 release and registry readback Release run, annotated tag, the new step's pass line on the real tag, and the registry tarball byte-compared to the release commit. Co-Authored-By: Claude Opus 5.5 (1M context) --- .../releases/2026-10-10-tag-gate/README.md | 15 +++++++++++++++ 1 file changed, 15 insertions(+) create mode 100644 docs/evidence/releases/2026-10-10-tag-gate/README.md diff --git a/docs/evidence/releases/2026-10-10-tag-gate/README.md b/docs/evidence/releases/2026-10-10-tag-gate/README.md new file mode 100644 index 0000000..65a55c1 --- /dev/null +++ b/docs/evidence/releases/2026-10-10-tag-gate/README.md @@ -0,0 +1,15 @@ +# Annotated-tag release gate — 2026-10-10 + +`0.1.3` adds one step to `release.yml`: right after checkout, `git cat-file -t` on the tag +must print `tag`, or the release job fails before anything is published (umbrella plan +2026-10-10, T5 / REQ-6). + +| Step | Evidence | +|---|---| +| Refusal planted | The step's `run:` body, extracted by YAML parse from `release.yml`, replayed in a scratch repository: lightweight `v9.9.9` → `::error::v9.9.9 is a commit, not an annotated tag object…`, exit 1; annotated `v9.9.10` → exit 0 | +| Merge | [PR 4](https://github.com/ssheleg/web3d-dev/pull/4), squash `5f7c3273163cff05e73707159805fb3e6592def1`; tip subject carries `(#4)` | +| Tag | `v0.1.3` annotated (`git cat-file -t v0.1.3` → `tag`), dereferences to the merge commit | +| Release run | [38075437837](https://github.com/ssheleg/web3d-dev/actions/runs/38075437837): validate, house audit, release and **publish** all `success`; the new step printed `v0.1.3 is annotated` | +| Registry | `npm view @ssheleg/web3d-dev version` → `0.1.3`; integrity `sha512-1jnWncadV7Dd7PX5VF9TYjb7D3ObM0JqEpWiKo1+Cb2RrGcv8xj6WAIWqqlMQSUz8f83TFiTG7TAbPmHx6EbvA==` recomputed from the downloaded tarball; all 20 files byte-equal to `git show :`; SLSA provenance advertised | + +Installation in a host and the umbrella re-pin are outside this record.