gh-upload-file 0.12.1 → 0.13.1

package/CHANGELOG.md

@@ -1,5 +1,23 @@
 # gh-upload-log
 
+## 0.13.1
+
+### Patch Changes
+
+- 4003e97: Recover partial releases from the original workflow SHA without consuming newer changesets or bumping again. Give npm consumer installation a bounded 25-minute visibility window with fresh metadata, preserve install diagnostics and fail promptly on permanent errors. Create missing GitHub releases from the exact version commit.
+
+## 0.13.0
+
+### Minor Changes
+
+- Fix CI/CD false positives, false negatives and warnings: release scripts now fail on any failed git, npm or gh command instead of reporting success, and no longer evaluate code downloaded from unpkg. GitHub release notes are published as Changesets wrote them (nested lists, later entries and text after `---` are no longer dropped, every entry's pull request is linked), the npm badges no longer render as "badge not found", and a release reads exactly its own CHANGELOG.md section. The workflow adopts the pipeline template's practices (change detection, a pipeline-status gate, release preflight annotations, pinned runners and actions, per-job timeouts and concurrency, secret scanning, Markdown link checking, documentation and file-size checks, actionlint, ShellCheck, zizmor, CodeQL and dependency audits), and the lockfiles no longer contain known high or moderate advisories.
+
+  The release step now fails when GitHub refuses to create the release (under Bun, command-stream 0.7.1 reported exit code 0 for a failing command fed through stdin), a version-commit push that lost a race with another merge is rebased and retried while a push refused by a repository rule fails at once with the rule's output, npm publication is verified for up to 25 minutes and an E409 "already published" answer counts as landed, and a release that died after the version commit or the publish is finished by the next push to main instead of being forgotten.
+
+  Authentication and registry errors (E404, E401, E403, ENEEDAUTH) from `npm publish` are no longer retried, every published npm name is installed from the registry and smoke-tested (each bin's `--help` and the library import) before the GitHub release is created, and shell scripts and the git hook keep LF line endings on Windows checkouts, where CRLF made Bash fail with `set: pipefail\r: invalid option name`.
+
+  Sanitize every upload with sensitive-data-sanitizer in streaming credentials-only mode, preserving public account details and binary bytes while reporting rule counts. Block uploads on sanitization errors. Check npm package bootstrap before versioning releases, retain synchronized gh-upload-log publication, and document required npm owner recovery steps.
+
 ## 0.12.1
 
 ### Patch Changes

package/README.md

@@ -679,10 +679,9 @@ node experiments/issue-37-package-smoke.mjs
 ```
 
 Both automatic and manual releases check npm package existence before versioning.
-The first `gh-upload-file` publication and trusted publisher setup require an
-authorized npm account. Follow the [exact recovery procedure](./docs/npm-publishing.md),
-which preserves synchronized `gh-upload-log` releases. Publication remains
-blocked until those owner steps are completed.
+Both package names are published through OIDC as of 0.13.0. The
+[release recovery procedure](./docs/npm-publishing.md) explains bounded registry
+visibility retries and resuming an interrupted release without another version bump.
 
 ## Contributing
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gh-upload-file",
-  "version": "0.12.1",
+  "version": "0.13.1",
   "description": "Upload text and binary files to GitHub as Gists or chunked repository archives",
   "type": "module",
   "main": "src/index.js",
@@ -9,21 +9,6 @@
     "gh-upload-file": "src/cli.js",
     "gh-upload-log": "src/cli.js"
   },
-  "scripts": {
-    "test": "bun test --timeout 30000",
-    "lint": "eslint . --max-warnings 0",
-    "lint:fix": "eslint . --fix",
-    "format": "prettier --write .",
-    "format:check": "prettier --check .",
-    "check:file-size": "bun scripts/check-file-size.mjs",
-    "check:docs": "node scripts/check-required-docs.mjs",
-    "check": "bun run lint && bun run format:check && bun run check:file-size && bun run check:docs",
-    "prepare": "node scripts/install-git-hooks.mjs",
-    "changeset": "changeset",
-    "changeset:version": "bun scripts/changeset-version.mjs",
-    "changeset:publish": "bun scripts/publish-to-npm.mjs",
-    "changeset:status": "changeset status --since=origin/main"
-  },
   "keywords": [
     "github",
     "gist",
@@ -51,31 +36,6 @@
     "use-m": "^8.13.7",
     "yargs": "^17.7.2"
   },
-  "devDependencies": {
-    "@changesets/changelog-github": "^0.5.1",
-    "@changesets/cli": "^2.29.7",
-    "eslint": "^9.38.0",
-    "eslint-config-prettier": "^10.1.8",
-    "eslint-plugin-prettier": "^5.5.4",
-    "husky": "^9.1.7",
-    "lint-staged": "^16.2.6",
-    "prettier": "^3.6.2",
-    "test-anywhere": "^0.8.48"
-  },
-  "lint-staged": {
-    "*.{js,mjs,cjs}": [
-      "eslint --fix --max-warnings 0 --no-warn-ignored",
-      "prettier --write",
-      "prettier --check"
-    ],
-    "*.md": [
-      "prettier --write",
-      "prettier --check"
-    ]
-  },
-  "publishAliases": [
-    "gh-upload-log"
-  ],
   "files": [
     "src",
     "README.md",