Release v1.5.0 - #14
Merged
Merged
Conversation
- establish reliable in-container commands for audit/semgrep/git-secrets (no yarn findPackageLocation state bug) - record slither (errors: crytic-compile KeyError) + tests best-effort as not-hardened - baseline.md invocations table; read-only, no source/config/hook changed - includes pre-push-security-gates project plan + M0 milestone/epic breakout scaffolding Task 5.0 in tasks-e1-reproduce-gates-in-container.md Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
- record per-gate findings in baseline.md (secret-safe: ids + file:line only) - CORRECTION: npm audit is 26 advisories (13 high/13 moderate; axios+lodash), not 2 lodash (planning tail-truncation) -> M1 must be re-scoped - semgrep: all 10 findings are typescript-any-usage in src/cli/diamond-abi-cli.ts -> refines M2 - slither errors (crytic-compile), git-secrets clean, tests 51/0; authored tooling-repo rationale for M2/M3 Task 4.0 in tasks-e2-findings-baseline.md Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
- M1 re-scoped: 26 audit advisories (13 high/13 mod) from unused direct deps axios+lodash -> REMOVE (no breaking upgrade), triage residual transitive - M2 refined: all 10 semgrep findings are typescript-any-usage in src/cli/diamond-abi-cli.ts (not Solidity-on-fixtures) - updated objectives O1, milestone map, risk register, rollback, deliverables, open questions Upward reconciliation from M0-E2 Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
- axios+lodash: 0 usages (src/scripts/test/config), not re-exported; yarn why = @diamondslab/diamonds sole direct dependent - all 26 advisories are on axios(23)/lodash(3) directly, 0 transitive -> removal clears ALL 26 - GO recorded in baseline.md; M1-E3 owner gate OP-M1-1 not expected to fire Task 4.0 in tasks-e1-confirm-unused-enumerate.md Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
- axios + lodash were unused direct dependencies (0 imports; M1-E1 GO) accounting for all 26 npm-audit advisories (13 high/13 moderate) - removed from package.json dependencies; regenerated yarn.lock from clean base - yarn npm audit --severity moderate now exits 0 (audit gate GREEN) - they remain only as transitive devDependency pulls; no longer direct/production deps, so audit + published package are clean Task 4.0 in tasks-e2-remove-unused-deps.md Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
- audit exit 0; npm run build green; test:unit 19/0 (no regression) - clarified: baseline '51/0' was from feature/resolution-seam (PR #12); main-based branches = 19/0 - no residual advisory -> owner gate OP-M1-1 did not fire; M1 CLOSED Task 2.0 in tasks-e3-residual-verify.md Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
- all 10 in src/cli/diamond-abi-cli.ts: 6 cleanly fixable (Fragment/Artifact/result type), 3 loose ABI items, 1 justified (hre) - recommended posture: mix (fix+annotate); alternatives annotate-all / tune-rule Task 4.0 in tasks-e1-enumerate-classify.md Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
…> 0) - fix 8 sites via inference/typing (ethers Fragment callbacks; typed analyzeAbi artifact param -> ABI items infer) - annotate 2 genuinely-dynamic sites (hre, generation result) with inline // nosemgrep + reason - yarn semgrep:scan --error -> 0 findings; build green; test:unit 19/0 (no regression) - type-level only, no runtime change; no .semgrep.yml change Task 4.0 in tasks-e2-disposition-gate-green.md Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
- remove slither block from .husky/pre-push + yarn slither:scan from security-check - keep slither:scan/slither:check scripts + slither.config.json as optional-manual (owner choice A) - rationale: diamonds is a TS tool, contracts are test fixtures, slither errors in-container (M0); audit+semgrep+secrets stay enforced Task 4.0 in tasks-e1-remove-slither-gate.md Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Lock pinned @diamondslab/hardhat-diamonds ^1.0.0 (1.1.2) while the manifest declares ^1.2.0; the mismatch broke Yarn's install state (M0-E3 finding F2). Refresh resolves 1.2.1.
- exports: add ./dist/* wildcard + ./package.json (fixes blocked deep imports, e.g. hardhat-diamonds dist/repositories usage) - files: whitelist gains CHANGELOG.md - stop emitting source/declaration maps (referenced absent src/)
Bare README.md/CHANGELOG.md matched nested copies under yarn pack; leading-slash anchors restore npm/yarn tarball parity (88 files both)
- shields.io scoped npm badge; MIT badge links to the repo LICENSE - explicit Prerequisites (node >=18, yarn >=4) matching the engines field - npm + yarn install commands for the scoped package - new Entry points section documenting ., ./core, ./dist/* back-compat deep imports (FileDeploymentRepository example) and ./package.json; notes that source/declaration maps are not shipped - fix Multi-Facet Upgrade snippet: Diamond.repository is private, so the example now receives the FileDeploymentRepository it constructs - Contributing section links to CONTRIBUTING.md
Backfilled from git history (v1.3.3 line..v1.4.0 and v1.4.0..c0ae918): - 1.4.0 (2026-06-30): deployInclude additive, deployExclude Remove cut uses address(0) on upgrade, pure selector-resolution core + tests, dead higherPrioritySplit branch removed - 1.4.1 (2026-07-01): standalone importability — zod to dependencies, defender-sdk lazy-loaded, guarded .env load Also adds Unreleased/1.4.1/1.4.0 compare-link refs.
Instantiated from the productization-fleet community-docs kit (no prior files
existed, so no merges were needed):
- CONTRIBUTING.md: Yarn 4 + Node >=18, actual working scripts (build/test/
test:unit/test:integration/test:coverage/format; yarn lint omitted because it
still points at the removed tslint config), Conventional Commits, PRs to main
- SECURITY.md: 1.5.x support table + GitHub private vulnerability reporting
- CODE_OF_CONDUCT.md: Contributor Covenant 2.1
- .github/ISSUE_TEMPLATE/{bug_report,feature_request}.md + PULL_REQUEST_TEMPLATE.md
LICENSE verified: non-empty MIT, Copyright (c) 2024-2026 DiamondsLab (no change).
- ci.yml: Node 18/20/22 matrix, corepack yarn 4, immutable install, build + test (lint gate deferred: eslint reports ~3.3k formatting findings pending a dedicated pass) - release.yml: v* tag-only OIDC provenance publish (kit-proven shape)
- replaces the manual yarn npm publish flow with the tag-triggered pipeline procedure; un-ignores only notes/RELEASE_RUNBOOK.md
Bare process.loadEnvFile threw ENOENT without .env (Node 20/22 CI) and TypeError on Node 18 (API absent). Same never-throw guard as defenderClients; approach per 702f723 on feature/cicd-updates.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Productization release line for v1.5.0 (fleet M1): packaging correctness (exports back-compat subpaths, deterministic 88-file tarball, standard metadata), docs (README pass, 1.4.x changelog backfill, community docs), CI + OIDC release pipeline, security-gates rework merged (audit 26->0, semgrep clear, slither advisory), .env made optional (CI/Node18 fix).
Full details: CHANGELOG.md [1.5.0] section.
Checklist
yarn buildpassesyarn testpasses (81 passing)Notes for reviewers
Merging this PR + pushing the
v1.5.0tag triggers the OIDC npm publish (release.yml). Runbook: notes/RELEASE_RUNBOOK.md.🤖 Generated with Claude Code