harness-everything 0.20.3 → 0.20.4

package/.claude-plugin/marketplace.json

@@ -10,7 +10,7 @@
       "name": "harness-everything",
       "source": "./",
       "description": "Harness OS: an orchestrated agent operating system — tier routing, circuit breaker guardrails, verification gates, WAL session memory, and self-evolving workspace rules.",
-      "version": "0.20.3",
+      "version": "0.20.4",
       "author": {
         "name": "Miya Daniel"
       },

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "harness-everything",
   "description": "Harness OS: an orchestrated agent operating system — tier routing, circuit breaker guardrails, verification gates, WAL session memory, and self-evolving workspace rules.",
-  "version": "0.20.3",
+  "version": "0.20.4",
   "author": {
     "name": "Miya Daniel"
   },

package/.github/workflows/release.yml

@@ -68,3 +68,11 @@ jobs:
           NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
           NPM_CONFIG_PROVENANCE: "true"
         run: npx --no-install semantic-release
+
+      - name: Upload release SBOM artifact
+        if: ${{ hashFiles('sbom.cdx.json') != '' }}
+        uses: actions/upload-artifact@v4
+        with:
+          name: release-sbom
+          path: sbom.cdx.json
+          if-no-files-found: error

package/.releaserc.json

@@ -103,6 +103,12 @@
     [
       "@semantic-release/github",
       {
+        "assets": [
+          {
+            "path": "sbom.cdx.json",
+            "label": "CycloneDX SBOM"
+          }
+        ],
         "successComment": false,
         "failTitle": false,
         "labels": false,

package/CHANGELOG.md

@@ -2,6 +2,12 @@
 
 All notable changes to this project are documented in this file.
 
+## [0.20.4](https://github.com/dyphn1/Harness-everything/compare/v0.20.3...v0.20.4) (2026-09-22)
+
+### Bug Fixes
+
+* **release:** publish sbom release artifacts ([83eeb96](https://github.com/dyphn1/Harness-everything/commit/83eeb96c1746ccbffcdcba478ba6b54c522887a0)), closes [#222](https://github.com/dyphn1/Harness-everything/issues/222)
+
 ## [0.20.3](https://github.com/dyphn1/Harness-everything/compare/v0.20.2...v0.20.3) (2026-09-22)
 
 ### Bug Fixes

package/RELEASING.md

@@ -40,9 +40,9 @@ A push to `main` runs the full reusable CI gate and then semantic-release. A man
 6. Run `scripts/sync-release-version.js` to synchronize package, Claude, OpenAI/Codex, OpenCode, lockfile, and changed canonical skill version fields.
 7. Regenerate and verify plugin packages, then generate and validate the release-only `sbom.cdx.json` CycloneDX 1.7 file.
 8. Update `CHANGELOG.md` and create `chore(release): X.Y.Z [skip ci]`.
-9. Create tag `vX.Y.Z`, publish npm with provenance (including the generated SBOM), and create the GitHub Release.
+9. Create tag `vX.Y.Z`, publish npm with provenance (including the generated SBOM), create the GitHub Release with the SBOM attached, and retain the same file as an Actions artifact.
 
-The SBOM is generated from the release `package.json`/`package-lock.json` as CycloneDX 1.7, the current 1.x format, to satisfy consumers and regulatory baselines requiring CycloneDX 1.6 or later. It is intentionally not committed to Git. npm packaging is tested to ensure `sbom.cdx.json` is included in the published tarball.
+The SBOM is generated from the release `package.json`/`package-lock.json` as CycloneDX 1.7, the current 1.x format, to satisfy consumers and regulatory baselines requiring CycloneDX 1.6 or later. It is intentionally not committed to Git. The release publishes `sbom.cdx.json` in the npm tarball and as a GitHub Release asset, while the workflow also retains it as an Actions artifact.
 
 Release concurrency is serialized so two updates to `main` cannot publish competing versions.
 
@@ -90,7 +90,8 @@ The release workflow runs the reusable CI gate before semantic-release. After pu
 ```text
 gh run list --workflow release.yml --limit 5
 gh run view <run-id> --json conclusion,headSha,jobs
-gh release view v<version> --json tagName,publishedAt,url
+gh release view v<version> --json tagName,publishedAt,url,assets
+gh run view <run-id> --json conclusion,headSha,jobs,artifacts
 npm view harness-everything version dist-tags --json
 ```
 

package/ci/mechanism-2ap-sbom.test.js

@@ -24,6 +24,22 @@ assert.ok(execPlugin, 'semantic-release exec plugin is required for SBOM generat
 assert.match(execPlugin[1].prepareCmd, /generate-sbom\.js --output sbom\.cdx\.json --version \$\{nextRelease\.version\}/);
 assert.match(execPlugin[1].prepareCmd, /generate-sbom\.js --validate sbom\.cdx\.json --version \$\{nextRelease\.version\}/);
 
+const githubPlugin = releaseConfig.plugins.find(plugin => Array.isArray(plugin) && plugin[0] === '@semantic-release/github');
+assert.ok(githubPlugin, 'semantic-release github plugin is required for release publication');
+assert.ok(Array.isArray(githubPlugin[1].assets), 'GitHub Release assets must be configured');
+assert.ok(
+  githubPlugin[1].assets.some(asset => asset && typeof asset === 'object' && asset.path === 'sbom.cdx.json'),
+  'GitHub Release must publish the generated SBOM as an asset'
+);
+
+const releaseWorkflow = fs.readFileSync(path.join(ROOT, '.github/workflows/release.yml'), 'utf8');
+assert.match(releaseWorkflow, /uses:\s+actions\/upload-artifact@v4/,
+  'release workflow must retain the generated SBOM as an Actions artifact');
+assert.match(releaseWorkflow, /if:\s+\$\{\{\s*hashFiles\('sbom\.cdx\.json'\)\s*!=\s*''\s*\}\}/,
+  'release workflow must skip artifact upload when semantic-release has no release');
+assert.match(releaseWorkflow, /path:\s+sbom\.cdx\.json/,
+  'release workflow artifact must point at the generated SBOM');
+
 const bom = buildBom(ROOT, {
   version: packageJson.version,
   timestamp: '2026-09-21T00:00:00.000Z',

package/opencode-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "harness-enforcement",
   "description": "Repository inventory for the opencode enforcement plugin and its standalone helper",
-  "version": "0.20.3",
+  "version": "0.20.4",
   "runtime": "index.mjs",
   "hooks": {
     "verify": "hooks/verify.js"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "harness-everything",
-  "version": "0.20.3",
+  "version": "0.20.4",
   "description": "Harness OS: An Orchestrated Agent Operating System for AI-driven Development",
   "main": "harness-everything/scripts/bootstrap.js",
   "bin": {

package/plugins/harness-everything/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "harness-everything",
-  "version": "0.20.3",
+  "version": "0.20.4",
   "description": "Invariant-first engineering harness for routing, verification, and failure recovery while preserving agent autonomy.",
   "author": {
     "name": "Miya Daniel",

package/plugins/harness-everything/plugin.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json",
   "name": "harness-everything",
-  "version": "0.20.3",
+  "version": "0.20.4",
   "description": "Invariant-first engineering harness for routing, verification, and failure recovery while preserving agent autonomy.",
   "author": {
     "name": "Miya Daniel",

package/sbom.cdx.json

@@ -2,23 +2,23 @@
   "$schema": "https://cyclonedx.org/schema/bom-1.7.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.7",
-  "serialNumber": "urn:uuid:c82181bb-3272-5951-8990-f785d038f412",
+  "serialNumber": "urn:uuid:478ab7f0-6aaf-55ae-9e1a-9e950ea30f9d",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-09-22T01:49:40.805Z",
+    "timestamp": "2026-09-22T02:13:44.851Z",
     "tools": [
       {
         "vendor": "Harness Everything",
         "name": "generate-sbom.js",
-        "version": "0.20.3"
+        "version": "0.20.4"
       }
     ],
     "component": {
       "type": "application",
-      "bom-ref": "pkg:npm/harness-everything@0.20.3",
+      "bom-ref": "pkg:npm/harness-everything@0.20.4",
       "name": "harness-everything",
-      "version": "0.20.3",
-      "purl": "pkg:npm/harness-everything@0.20.3"
+      "version": "0.20.4",
+      "purl": "pkg:npm/harness-everything@0.20.4"
     }
   },
   "components": [
@@ -1999,7 +1999,7 @@
       ]
     },
     {
-      "ref": "pkg:npm/harness-everything@0.20.3",
+      "ref": "pkg:npm/harness-everything@0.20.4",
       "dependsOn": [
         "pkg:npm/%40commitlint/cli@19.8.1",
         "pkg:npm/%40commitlint/config-conventional@19.8.1",