chore(release): sync main into dev#586
Merged
Merged
Conversation
## Summary - promote the OIDC-only npm publishing policy from dev to main - release workflow no longer passes NPM_TOKEN - publishing docs now require the safe bootstrap path: one manual interactive 2FA publish, then npm trusted publishing ## Verification already completed - PR #504 CI passed - dev merge queue CI passed - npm publish --dry-run passed locally - GitHub Actions NPM_TOKEN secret was deleted - @the-open-engine/zeroshot@5.4.0 exists on npm with latest pointing at 5.4.0 ## Hold before merge Package creation is complete. Do not merge this PR until npm trusted publishing is configured for: - owner: the-open-engine - repo: zeroshot - workflow filename: release.yml - action: npm publish --------- Co-authored-by: Eivind Meyer <eiv.meyer@gmail.com> Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com> Co-authored-by: Eivind Meyer <eivind.meyer@ksat.no> Co-authored-by: Michael Eichelbeck <141341133+mkceichelbeck@users.noreply.github.com> Co-authored-by: Michael Eichelbeck <michael.eichelbeck.ext@wtsde.onmicrosoft.de> Co-authored-by: Ubuntu <ubuntu@ip-172-31-38-53.eu-north-1.compute.internal> Co-authored-by: Eivind <eivind@covibes.ai> Co-authored-by: CI Test <ci-test@covibes.ai> Co-authored-by: Codex <codex@example.com>
## Summary - Promote the current dev snapshot to main for the critical PR-mode validation fix. - The functional release delta is the config-validator hook output contract fix from #511. - Also includes the already-merged doc/license updates currently on dev. ## Expected release - semantic-release should classify this as a patch release from the squash title: 6.0.0 -> 6.0.1. ## Validation - PR #511 CI passed on the branch PR. - Dev merge queue CI passed: https://github.com/the-open-engine/zeroshot/actions/runs/27843629736 - Local validation before #511 merge: - npm test -- tests/unit/pr-mode-cluster-validation.test.js - npm test -- tests/unit/pr-mode-cluster-validation.test.js tests/two-stage-validation.test.js tests/unit/template-validation-pr-mode.test.js tests/unit/template-simulation.test.js - npm test -- tests/unit/pr-mode-cluster-validation.test.js tests/two-stage-validation.test.js tests/unit/template-validation-pr-mode.test.js tests/unit/template-simulation.test.js tests/verify-github-pr-hook.test.js - npm run validate:templates - npm run lint - npm run typecheck - npm test --------- Co-authored-by: Eivind Meyer <eiv.meyer@gmail.com> Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com> Co-authored-by: Eivind Meyer <eivind.meyer@ksat.no> Co-authored-by: Michael Eichelbeck <141341133+mkceichelbeck@users.noreply.github.com> Co-authored-by: Michael Eichelbeck <michael.eichelbeck.ext@wtsde.onmicrosoft.de> Co-authored-by: Ubuntu <ubuntu@ip-172-31-38-53.eu-north-1.compute.internal> Co-authored-by: Eivind <eivind@covibes.ai> Co-authored-by: CI Test <ci-test@covibes.ai> Co-authored-by: Codex <codex@example.com>
## Summary - Promote dev to main after PR #513 fixed the updater install-prefix bug and legacy @covibes bridge. - The new CLI updater now targets the owning global npm prefix instead of whichever npm is first on PATH. - Adds the @covibes/zeroshot bridge package/workflow so legacy installs show migration guidance and Current version: 6.0.1 Checking for updates... Latest version: 6.0.1 ✓ You are already on the latest version! force-installs @the-open-engine/zeroshot. ## Expected release - semantic-release should classify this as a patch release: 6.0.1 -> 6.0.2. ## Validation - PR #513 CI passed. - Dev merge queue CI passed: https://github.com/the-open-engine/zeroshot/actions/runs/27845636128 - Local validation before #513 merge: - npm test -- tests/update-checker.test.js tests/legacy-covibes-bridge.test.js - npm test -- tests/preflight.test.js - npm run test:coverage - npx prettier --check cli/index.js tests/run-tests.js - npm run lint - npm run typecheck - npm run validate:templates - npm test - npm publish --dry-run --access public in legacy/covibes-zeroshot-bridge - temp-prefix old-to-bridge and bridge-to-new CLI migration proof --------- Co-authored-by: Eivind Meyer <eiv.meyer@gmail.com> Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com> Co-authored-by: Eivind Meyer <eivind.meyer@ksat.no> Co-authored-by: Michael Eichelbeck <141341133+mkceichelbeck@users.noreply.github.com> Co-authored-by: Michael Eichelbeck <michael.eichelbeck.ext@wtsde.onmicrosoft.de> Co-authored-by: Ubuntu <ubuntu@ip-172-31-38-53.eu-north-1.compute.internal> Co-authored-by: Eivind <eivind@covibes.ai> Co-authored-by: CI Test <ci-test@covibes.ai> Co-authored-by: Codex <codex@example.com>
## Summary Promote the Windows provider-detection fix from `dev` to `main` for release. ## Included change - #516: detect provider CLIs on Windows using `where` instead of POSIX-only `command -v` - Closes the same bug family tracked by #515 and #456 ## Release impact This should produce the next patch release after `v6.0.2` via semantic-release once the main CI and release workflow complete. ## Verification - #516 `check` passed before merge to `dev` - `main..dev` diff contains only `lib/provider-detection.js` and `tests/provider-detection.test.js` --------- Co-authored-by: Eivind Meyer <eiv.meyer@gmail.com> Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com> Co-authored-by: Eivind Meyer <eivind.meyer@ksat.no> Co-authored-by: Michael Eichelbeck <141341133+mkceichelbeck@users.noreply.github.com> Co-authored-by: Michael Eichelbeck <michael.eichelbeck.ext@wtsde.onmicrosoft.de> Co-authored-by: Ubuntu <ubuntu@ip-172-31-38-53.eu-north-1.compute.internal> Co-authored-by: Eivind <eivind@covibes.ai> Co-authored-by: CI Test <ci-test@covibes.ai> Co-authored-by: Codex <codex@example.com> Co-authored-by: Atharv Singh <132380045+atharvwasthere@users.noreply.github.com>
## Summary Promote `dev` to `main` for the cmdproof command-reuse release. ## Included changes - #522: proof-backed command reuse via configurable `zeroshot-command-proofs` JSON blocks and repo settings - #521: isolate trigger sandbox globals ## Release impact This should produce the next minor release after `v6.0.3` via semantic-release once the main merge queue, CI, and release workflow complete. ## Verification - #522 PR CI passed - #522 merge-group CI passed - `main..dev` diff checked before opening --------- Co-authored-by: Eivind Meyer <eiv.meyer@gmail.com> Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com> Co-authored-by: Eivind Meyer <eivind.meyer@ksat.no> Co-authored-by: Michael Eichelbeck <141341133+mkceichelbeck@users.noreply.github.com> Co-authored-by: Michael Eichelbeck <michael.eichelbeck.ext@wtsde.onmicrosoft.de> Co-authored-by: Ubuntu <ubuntu@ip-172-31-38-53.eu-north-1.compute.internal> Co-authored-by: Eivind <eivind@covibes.ai> Co-authored-by: CI Test <ci-test@covibes.ai> Co-authored-by: Codex <codex@example.com> Co-authored-by: Atharv Singh <132380045+atharvwasthere@users.noreply.github.com>
## Summary - release the cmdproof action-key single-flight fix on top of current `main` - prevents concurrent validators from launching duplicate raw fallback CI for the same cmdproof action key - keeps fallback behavior unchanged when verify output has no action key ## Why this PR uses `tomdps:dev` The normal upstream `dev -> main` PR (#525) is conflicted because `dev` lost the main ancestry edge when the merge queue squashed the no-file sync PR. The repo guard allows `main` PRs only from a branch named `dev`; this fork branch is named `dev` and is based directly on current `main`, so the release diff is clean and limited to the intended two files. ## Validation - #524 feature PR CI passed - #524 merge-group CI passed into upstream dev - This PR should run the required main CI/install matrix on the clean main-based patch
Merge origin/main (v6.2.0) into dev, resolving conflicts in favor of dev: - README.md: keep dev's unified README rewrite (#535-#537), which already documents cmdproof and quality gates in condensed form - cli/index.js: keep dev's PATH-check feature (#552) Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
tomdps
enabled auto-merge
July 9, 2026 01:56
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Merges
main(v6.2.0) back intodevto resolve the divergence created by squash-merge release promotions, unblocking the release PR #585.Conflict resolution (all in favor of dev, which is a content superset of main):
README.md: kept dev's unified README rewrite (docs(readme): unify Zeroshot README + brand with The Open Engine #535–docs(readme): add polished homepage + social buttons #537), which already documents cmdproof and quality gates in condensed formcli/index.js: kept dev's PATH-check feature (feat: enhancement: first-run wizard should detect its bin dir isn't on PATH and print the export line #552)src/orchestrator.js: dropped a duplicated cmdproof block the auto-merge introduced (took dev's version verbatim)The resulting tree is byte-identical to current
dev— this merge changes no content, only graph ancestry. Lint passes (0 errors) and the full test suite passes locally (1392 tests).🤖 Generated with Claude Code