@plasius/gpu-renderer 0.2.44 → 0.2.45

package/CHANGELOG.md

@@ -18,6 +18,26 @@ All notable changes to this project will be documented in this file.
   - (placeholder)
 
 - **Fixed**
+  - (placeholder)
+
+- **Security**
+  - (placeholder)
+
+## [0.2.45] - 2026-09-07
+
+- **Added**
+  - (placeholder)
+
+- **Changed**
+  - Refreshed compatible @plasius/* lockfile resolutions to the latest published releases.
+ - (placeholder)
+
+- **Fixed**
+  - Documented verified locked-branch runner admission for trusted push checks,
+    including exact-commit verification and removal before branch updates.
+  - Restored trusted-push-only CI on explicit self-hosted runners, preserving
+    required check names and excluding external fork execution; bounded scheduled
+    dependency validation to self-hosted main runs.
   - Preserved hosted pull-request isolation, bounded validation runtime, and
     disabled package-manager cache finalization on self-hosted main validation.
   - (placeholder)
@@ -1106,3 +1126,4 @@ All notable changes to this project will be documented in this file.
 [0.2.42]: https://github.com/Plasius-LTD/gpu-renderer/releases/tag/v0.2.42
 [0.2.43]: https://github.com/Plasius-LTD/gpu-renderer/releases/tag/v0.2.43
 [0.2.44]: https://github.com/Plasius-LTD/gpu-renderer/releases/tag/v0.2.44
+[0.2.45]: https://github.com/Plasius-LTD/gpu-renderer/releases/tag/v0.2.45

package/README.md

@@ -691,9 +691,23 @@ npm run pack:check
 ## Release integrity
 
 CI keeps the administrative contributor registry outside Git and npm package
-artifacts using exact, case-normalised path checks. External fork heads are
-rejected; same-repository pull requests validate on GitHub-hosted runners and
-main pushes validate on approved self-hosted runners. Release preparation and
+artifacts using exact, case-normalised path checks. CI runs only for pushes to
+repository-owned branches on explicit `[self-hosted, Linux, X64]` runners.
+External fork pull requests trigger no CI execution; a maintainer must review
+and move a contribution to a repository-owned branch to produce required checks.
+Before branch CI starts, an authorised maintainer reviews the exact commit and
+locks its repository branch as read-only, enforcing the lock for administrators
+and disabling force pushes, deletion, and fork syncing. After reading back the
+lock and commit SHA, admit only that branch's fully qualified workflow ref for
+`gpu-renderer/.github/workflows/ci.yml` in `Public CI - Quarantined`. Top-level
+push jobs identify their workflow by branch ref; SHA-only admission did not
+schedule the reviewed job. Remove the temporary workflow entry and verify its
+removal before unlocking or updating the branch, and after delivery. Preserve all
+other group restrictions. Never admit mutable branch or PR refs. See
+[ADR-0028](docs/adrs/adr-0028-locked-branch-runner-admission.md) for the procedure.
+The trusted admission, build-test, and artifact-integrity checks keep their
+existing names for branch protection. Scheduled dependency validation also uses
+bounded self-hosted capacity and accepts only `main`. Release preparation and
 publication use a two-run exact-main protocol on GitHub-hosted Node.js 24.18.0
 LTS. A read-only job seals the package tarball and SBOM before a dependency-free
 production job publishes that exact artifact through npm OIDC with provenance;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@plasius/gpu-renderer",
-  "version": "0.2.44",
+  "version": "0.2.45",
   "description": "Framework-agnostic WebGPU renderer runtime for Plasius projects.",
   "type": "module",
   "sideEffects": false,