0.2.10

Fixes

• rust-packages — pin the preflight macOS runner to macos-14. macos-latest rolled to an Xcode whose clang runtime path breaks the compiler-rt link (ld: library 'clang_rt.osx' not found), flaking every consumer's macOS preflight. macos-14 matches the runner the dist-build aarch64 leg already uses.

0.2.9

Fixes

• rust-packages — run Homebrew formula hardening from a versioned rust/harden-homebrew-formula composite instead of a .github/scripts/... path in the consumer checkout. Binary release repos now resolve the script through coroboros/ci@v0 and no longer fail dist-host after the crate publish has succeeded.

0.2.8

Summary

• Harden cargo-dist Homebrew formulae before release upload and tap publish.
• Add a macOS verify-homebrew-formula gate before dist-publish.
• Document the new binary-distribution step and bump the CI package to 0.2.8.

Verification

• actionlint -shellcheck=shellcheck
• yamllint -c .yamllint .
• python3 -m py_compile .github/scripts/harden-homebrew-formula.py
• Generated skillward formula from the original cargo-dist output passes brew audit --strict --online and brew fetch.
• Generated scrybe formula from the original cargo-dist output passes brew audit --strict --online and brew fetch.
• gitleaks git --no-banner --redact

0.2.7

Fixes

• security — review-dependencies no longer blocks the release: the advisory layer's never-blocks contract now covers it, not only check-licenses. A high-severity CVE, or a repo without Dependency graph enabled, reports instead of failing the check.

0.2.6

Fixes

• generate-changelog — fail loud when the newest CHANGELOG.md section's version was never tagged and ≠ the release tag, instead of auto-generating a degraded one-liner over a mis-bumped hand-curated section and committing it back. Gated on the release tag resolving locally, so a shallow checkout can't false-positive.

Refactor

• All workflows — align every remaining job id to the verb-noun convention: self-lint → check-actions/check-yaml/check-shell; self-security → scan-secrets/scan-deps; self-release → move-rolling-tag; self-test → test-<composite>; security-gate → scan-supply-chain/scan-secrets; security → review-dependencies/check-licenses. Job ids only — consumers uses: the workflows, so @v0 references are unaffected.

0.2.5

Refactor

• javascript-npm-packages / rust-packages — align job ids to GitLab CI's verb-noun naming: publish → publish-package in both pipelines, and the Rust package job → verify-package (it verify-builds the crate rather than producing an artifact). Reusable-workflow job ids only — filenames, inputs, secrets, and composite-action paths are untouched, so consumer @v0 references are unaffected.

0.2.4

Fixes

• rust-packages — dist-publish passes the npm shim tarball as ./${pkg} so npm publish reads it as a file path. A bare dist-global/…tar.gz matches npm's owner/repo GitHub shorthand, so npm tried to clone it over SSH (git ls-remote ssh://git@github.com/dist-global/…, exit 128) instead of publishing the tarball.

0.2.3

Fixes

• rust-packages — dist-host seeds target/distrib/dist-manifest.json from the plan manifest and redirects the global build's own manifest to $RUNNER_TEMP. dist build --artifacts=global reads dist-manifest.json to assemble the installers, Homebrew formula, and npm shim; the previous > target/distrib/dist-manifest.json truncated that file before dist read it (EOF while parsing JSON), so the first native-CLI binary release never produced the formula or shim.

0.2.2

Configuration

• Bump the pinned action SHAs (Dependabot): actions/checkout v6, actions/setup-node v6, actions/upload-artifact v7, actions/download-artifact v8, actions/dependency-review-action (v4 SHA), renovatebot/github-action v46.1.15.

0.2.1

Refactor

• self.yml → self-lint, self-actions → self-test — align the self-CI workflow names (self-lint · self-test · self-security · self-release).

Tests

• self-test — self-test rust/base end-to-end on a Rust fixture crate (test/fixtures/rust-crate): stage it at the workspace root, run the composite, assert fmt / clippy / test pass.
• self-security — self-test the security-gate.yml and security.yml reusable workflows via local ./ refs, now that v0 carries the security composites.

Documentation

• README — add a Self-CI section documenting how the repo tests its own workflows and composites.

Configuration

• .gitignore — add target/ for Rust build artifacts.