bdo-cli 0.47.0 → 0.47.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +16 -0
- package/README.md +9 -2
- package/package.json +2 -2
package/CHANGELOG.md
CHANGED
|
@@ -5,6 +5,22 @@ All notable changes to Bushido (bdo) will be documented in this file.
|
|
|
5
5
|
The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
|
|
6
6
|
and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
|
|
7
7
|
|
|
8
|
+
## [0.47.1] (2026-10-17)
|
|
9
|
+
|
|
10
|
+
### Security
|
|
11
|
+
|
|
12
|
+
- **Release archives carry GitHub build provenance.** Each platform's archive
|
|
13
|
+
is attested by the release workflow, so a download can be checked with
|
|
14
|
+
`gh attestation verify <file> --repo tedorigawa001/TokenReductionTool-BDO`.
|
|
15
|
+
Unlike the `.sha256` sidecar, which ships in the same release, this proves
|
|
16
|
+
the file was built by this repository's workflow from the tagged commit.
|
|
17
|
+
|
|
18
|
+
- **npm releases are staged and need maintainer approval.** CI now runs
|
|
19
|
+
`npm stage publish` (still via Trusted Publishing), and the trusted publisher
|
|
20
|
+
is allowed nothing else, so a new `bdo-cli` version goes public only when a
|
|
21
|
+
maintainer approves it with 2FA. A compromised CI run can no longer publish
|
|
22
|
+
to npm on its own. The hardening check fails on a direct `npm publish`.
|
|
23
|
+
|
|
8
24
|
## [0.47.0] (2026-10-17)
|
|
9
25
|
|
|
10
26
|
### Features
|
package/README.md
CHANGED
|
@@ -86,7 +86,14 @@ cargo install --git https://github.com/tedorigawa001/TokenReductionTool-BDO
|
|
|
86
86
|
|
|
87
87
|
Download from [releases](https://github.com/tedorigawa001/TokenReductionTool-BDO/releases):
|
|
88
88
|
Archives are named after the crate (`bushido`); the binary inside is `bdo`.
|
|
89
|
-
Each has a `.sha256` sidecar — verify before extracting.
|
|
89
|
+
Each has a `.sha256` sidecar — verify before extracting. From 0.47.1 on, each
|
|
90
|
+
archive also carries GitHub build provenance, which proves it was built by this
|
|
91
|
+
repository's release workflow (the checksum alone cannot: it ships in the same
|
|
92
|
+
release):
|
|
93
|
+
|
|
94
|
+
```bash
|
|
95
|
+
gh attestation verify bushido-aarch64-apple-darwin.tar.xz --repo tedorigawa001/TokenReductionTool-BDO
|
|
96
|
+
```
|
|
90
97
|
|
|
91
98
|
- macOS: `bushido-x86_64-apple-darwin.tar.xz` / `bushido-aarch64-apple-darwin.tar.xz`
|
|
92
99
|
- Linux: `bushido-x86_64-unknown-linux-gnu.tar.xz` / `bushido-aarch64-unknown-linux-gnu.tar.xz`
|
|
@@ -97,7 +104,7 @@ Each has a `.sha256` sidecar — verify before extracting.
|
|
|
97
104
|
### Verify Installation
|
|
98
105
|
|
|
99
106
|
```bash
|
|
100
|
-
bdo --version # Should show "bdo 0.47.
|
|
107
|
+
bdo --version # Should show "bdo 0.47.1"
|
|
101
108
|
bdo gain # Should show token savings stats
|
|
102
109
|
```
|
|
103
110
|
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"artifactDownloadUrls": [
|
|
3
|
-
"https://github.com/tedorigawa001/TokenReductionTool-BDO/releases/download/v0.47.
|
|
3
|
+
"https://github.com/tedorigawa001/TokenReductionTool-BDO/releases/download/v0.47.1"
|
|
4
4
|
],
|
|
5
5
|
"author": "Patrick Szymkowiak",
|
|
6
6
|
"bin": {
|
|
@@ -91,7 +91,7 @@
|
|
|
91
91
|
"zipExt": ".tar.xz"
|
|
92
92
|
}
|
|
93
93
|
},
|
|
94
|
-
"version": "0.47.
|
|
94
|
+
"version": "0.47.1",
|
|
95
95
|
"volta": {
|
|
96
96
|
"node": "18.14.1",
|
|
97
97
|
"npm": "9.5.0"
|