pi-openai-codex-compat 0.0.6 → 0.0.7-alpha.0

package/CHANGELOG.md

@@ -2,6 +2,10 @@
 
 ## Unreleased
 
+### Security
+
+- Require npm releases to match a locally built SHA-256 recorded in an SSH-signed release commit before trusted publishing can stage the package.
+
 ## 0.0.6 - 2026-08-10
 
 ### Added

package/README.md

@@ -404,7 +404,13 @@ search, and compaction continuation.
 
 ## Release staging
 
-The GitHub Actions workflow stages npm releases when a `v*` tag is pushed. The tag must match the `package.json` version, point at a commit whose subject is `release: v<version>`, and be a lightweight tag. Create it with `git tag v<version>`; do not use `git tag -a`, `git tag -s`, `git tag -m`, or `cog bump --annotated`.
+1. Run `npm run release -- X.Y.Z` from a clean, synchronized `main`.
+2. The command builds the exact package locally, records its SHA-256 in an SSH-signed release commit, proves a clean rebuild is reproducible, and creates a lightweight tag.
+3. Inspect the result, then push atomically with `git push --atomic origin main vX.Y.Z`.
+4. A read-only GitHub Actions job validates and packs the package. A separate GitHub-owned job verifies the signature and signed digest before attesting and staging that exact archive through npm trusted publishing.
+5. Approve the staged package on npmjs.com, or with `npm stage approve <stage-id>`.
+
+Stable releases use `latest`; prereleases derive their npm dist-tag from the first prerelease identifier.
 
 ## Acknowledgements
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-openai-codex-compat",
-  "version": "0.0.6",
+  "version": "0.0.7-alpha.0",
   "description": "OpenAI Codex compatibility for Pi with native compaction, fast mode, and Codex-optimized capabilities",
   "keywords": [
     "pi-package"
@@ -33,6 +33,7 @@
     "test": "node --test --test-concurrency=1 test/*.test.ts",
     "test:live:codex": "PI_CODEX_LIVE_TEST=1 node --test --test-concurrency=1 test/codex-host.live.test.ts",
     "pack:dry": "npm pack --dry-run --allow-directory=all",
+    "release": "node scripts/release.ts",
     "fmt": "oxfmt",
     "lint": "oxlint",
     "lint:fix": "oxlint --fix"