testguard-cli 0.8.0 → 0.8.1

package/CHANGELOG.md

@@ -7,6 +7,75 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Fixed
+- **A release that cannot open its pull request says why.** `GITHUB_TOKEN`
+  cannot call `createPullRequest` unless "Allow GitHub Actions to create and
+  approve pull requests" is enabled, and v0.8.1 hit exactly that: the branch,
+  the bump and the diff were all correct and the run still ended in a bare
+  `GraphQL: GitHub Actions is not permitted to create or approve pull
+  requests`. Both `scheduled-release.yml` and `release.yml`'s `homebrew-sha`
+  job now name the setting, give the one-line `gh api` equivalent and the
+  manual `gh pr create` fallback, and say what stays stale until it is fixed.
+  The failure is still a failure: the branch exists without a PR, and for the
+  formula `detect-version` keeps reporting the hash owed on every sweep.
+
+## [0.8.1] - 2026-09-18
+
+Automated weekly release — everything merged since `v0.8.0`.
+
+### Changed
+
+- fix(release): the release allow-list is derived, not retyped (#100)
+- fix(release): the weekly release verifies the tree it is about to ship (#99)
+- ci(release): set the Homebrew sha256 from the published tarball (#98)
+- chore(homebrew): sha256 for v0.8.0, from the published tarball (#97)
+
+
+### Fixed
+- **A release is no longer blocked by an allow-list that forgot one of its own
+  surfaces.** `sync-release-version.mjs` rewrites
+  `packaging/gitlab/testguard.gitlab-ci.yml`, and that path was missing from
+  both release guards: `scheduled-release.yml` would have failed with
+  "unexpected file in release diff" for a file the release exists to write,
+  and `auto-merge.yml` would have held every release PR for human review. The
+  script gained `--list-surfaces`, derived from the same table the writes use;
+  `scheduled-release.yml` now builds its allow-list from that instead of a
+  retyped copy. `auto-merge.yml` keeps an explicit list on purpose — it is the
+  gate that merges without review — and a test now fails when that list omits
+  any release surface. Claim `TG-RELEASE-SYNC-CHECK-FAILS-ON-DRIFT` gains a
+  fifth fault.
+- **The weekly release workflow can actually cut a release.** Its "verify the
+  tree is still green" step probed in worktree mode straight after syncing the
+  version surfaces, so the probe refused to run: the sync leaves
+  `packaging/gitlab/testguard.gitlab-ci.yml` uncommitted and that file is the
+  fault target of `TG-GITLAB-PROBE-EXIT-PRESERVED`, which worktree mode
+  correctly treats as a dirty defender (exit 2). It now probes with
+  `--include-dirty`, which verifies the bumped tree that is about to be
+  released rather than the version before it. `scheduled-release.yml` had
+  never completed a run since the GitLab template became both a sync surface
+  and a fault target on 2026-09-17; every release so far was cut by hand.
+- **The Homebrew formula's `sha256` matches its own `url`.** It had carried
+  `385d69f9…` unchanged across v0.6.0, v0.7.0 and v0.8.0 while
+  `release:sync` bumped the `url` each time — a hash that matches none of
+  the 0.4.0–0.7.0 tarballs, so `brew install` from the staged formula could
+  never have verified. Set to the sha256 of the published
+  `testguard-cli-0.8.0.tgz` (`5305ce22…`), computed from the registry, not
+  from a local `npm pack`.
+- **`release.yml` sets the Homebrew `sha256` itself, after publishing to npm.**
+  The formula header used to tell a human to run `curl | shasum` each release,
+  and nobody did. `sync-release-version.mjs --sha256` now waits for the
+  registry to serve the tarball (a publish is `PUT 202`; the file can lag by
+  minutes), hashes exactly the bytes Homebrew will download, and writes the
+  formula only when the value changes; a `200` that is not a gzip tarball is
+  refused, never hashed. `main` is protected, so the change lands as a bot PR
+  with auto-merge armed and CI dispatched by the workflow. The hash is a
+  release surface like the URL beside it: `detect-version` compares the
+  formula against the tarball (`--check --online`) on every hourly sweep, so
+  a failed run is retried the way a failed publish is, and `--check` refuses
+  the `385d69f9…` placeholder outright. Claim
+  `TG-RELEASE-SYNC-CHECK-FAILS-ON-DRIFT` gains three faults for the new modes.
+  Only the next release exercises the workflow path end to end.
+
 ## [0.8.0] - 2026-09-18
 
 A calibration you can quote.

package/README.md

@@ -126,9 +126,9 @@ raises coverage. TestGuard admits it because it fails when the claim is false.
 | npm | `npm i -D testguard-cli` then `npx testguard probe` |
 | pip | `pip install testguard-cli` then `testguard probe` (needs Node ≥ 20) |
 | Homebrew | `brew tap raccioly/tap && brew install testguard` |
-| GitHub Action | `uses: raccioly/testguard@v0.8.0` — see [`action.yml`](./action.yml) |
+| GitHub Action | `uses: raccioly/testguard@v0.8.1` — see [`action.yml`](./action.yml) |
 | pre-commit | `repo: https://github.com/raccioly/testguard`, hooks `testguard-claims`, `testguard-probe` |
-| GitLab CI | `include: - remote: https://raw.githubusercontent.com/raccioly/testguard/v0.8.0/packaging/gitlab/testguard.gitlab-ci.yml` with `inputs:` — see [`packaging/gitlab/`](./packaging/gitlab/testguard.gitlab-ci.yml) |
+| GitLab CI | `include: - remote: https://raw.githubusercontent.com/raccioly/testguard/v0.8.1/packaging/gitlab/testguard.gitlab-ci.yml` with `inputs:` — see [`packaging/gitlab/`](./packaging/gitlab/testguard.gitlab-ci.yml) |
 
 Projects that set `min-release-age` in `.npmrc` cannot see a version published
 less than that many days ago (`ENOVERSIONS`); install that one with
@@ -427,12 +427,12 @@ detected base that does not resolve is a warning for `status` and `brief`
 # GitHub Actions
 - uses: actions/checkout@v4
   with: { fetch-depth: 0 }
-- uses: raccioly/testguard@v0.8.0
+- uses: raccioly/testguard@v0.8.1
   with: { command: gate }
 
 # GitLab CI — the component-shaped template: gate + probe, brief as an artifact and, opted in, as a merge-request note
 include:
-  - remote: 'https://raw.githubusercontent.com/raccioly/testguard/v0.8.0/packaging/gitlab/testguard.gitlab-ci.yml'
+  - remote: 'https://raw.githubusercontent.com/raccioly/testguard/v0.8.1/packaging/gitlab/testguard.gitlab-ci.yml'
     inputs: { dir: backend, post_note: true }   # post_note needs TESTGUARD_GITLAB_TOKEN (api scope); one note, updated in place
 ```
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "testguard-cli",
-  "version": "0.8.0",
+  "version": "0.8.1",
   "description": "Breaks your code on purpose and reports every promise your tests did not notice breaking. Mutation testing bound to the claims a project makes — vitest, jest, Playwright, pytest and unittest.",
   "type": "module",
   "license": "MIT",