chore(release): restore main ancestry into dev#587
Merged
Conversation
## Summary - promote the OIDC-only npm publishing policy from dev to main - release workflow no longer passes NPM_TOKEN - publishing docs now require the safe bootstrap path: one manual interactive 2FA publish, then npm trusted publishing ## Verification already completed - PR #504 CI passed - dev merge queue CI passed - npm publish --dry-run passed locally - GitHub Actions NPM_TOKEN secret was deleted - @the-open-engine/zeroshot@5.4.0 exists on npm with latest pointing at 5.4.0 ## Hold before merge Package creation is complete. Do not merge this PR until npm trusted publishing is configured for: - owner: the-open-engine - repo: zeroshot - workflow filename: release.yml - action: npm publish --------- Co-authored-by: Eivind Meyer <eiv.meyer@gmail.com> Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com> Co-authored-by: Eivind Meyer <eivind.meyer@ksat.no> Co-authored-by: Michael Eichelbeck <141341133+mkceichelbeck@users.noreply.github.com> Co-authored-by: Michael Eichelbeck <michael.eichelbeck.ext@wtsde.onmicrosoft.de> Co-authored-by: Ubuntu <ubuntu@ip-172-31-38-53.eu-north-1.compute.internal> Co-authored-by: Eivind <eivind@covibes.ai> Co-authored-by: CI Test <ci-test@covibes.ai> Co-authored-by: Codex <codex@example.com>
## Summary - Promote the current dev snapshot to main for the critical PR-mode validation fix. - The functional release delta is the config-validator hook output contract fix from #511. - Also includes the already-merged doc/license updates currently on dev. ## Expected release - semantic-release should classify this as a patch release from the squash title: 6.0.0 -> 6.0.1. ## Validation - PR #511 CI passed on the branch PR. - Dev merge queue CI passed: https://github.com/the-open-engine/zeroshot/actions/runs/27843629736 - Local validation before #511 merge: - npm test -- tests/unit/pr-mode-cluster-validation.test.js - npm test -- tests/unit/pr-mode-cluster-validation.test.js tests/two-stage-validation.test.js tests/unit/template-validation-pr-mode.test.js tests/unit/template-simulation.test.js - npm test -- tests/unit/pr-mode-cluster-validation.test.js tests/two-stage-validation.test.js tests/unit/template-validation-pr-mode.test.js tests/unit/template-simulation.test.js tests/verify-github-pr-hook.test.js - npm run validate:templates - npm run lint - npm run typecheck - npm test --------- Co-authored-by: Eivind Meyer <eiv.meyer@gmail.com> Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com> Co-authored-by: Eivind Meyer <eivind.meyer@ksat.no> Co-authored-by: Michael Eichelbeck <141341133+mkceichelbeck@users.noreply.github.com> Co-authored-by: Michael Eichelbeck <michael.eichelbeck.ext@wtsde.onmicrosoft.de> Co-authored-by: Ubuntu <ubuntu@ip-172-31-38-53.eu-north-1.compute.internal> Co-authored-by: Eivind <eivind@covibes.ai> Co-authored-by: CI Test <ci-test@covibes.ai> Co-authored-by: Codex <codex@example.com>
## Summary - Promote dev to main after PR #513 fixed the updater install-prefix bug and legacy @covibes bridge. - The new CLI updater now targets the owning global npm prefix instead of whichever npm is first on PATH. - Adds the @covibes/zeroshot bridge package/workflow so legacy installs show migration guidance and Current version: 6.0.1 Checking for updates... Latest version: 6.0.1 ✓ You are already on the latest version! force-installs @the-open-engine/zeroshot. ## Expected release - semantic-release should classify this as a patch release: 6.0.1 -> 6.0.2. ## Validation - PR #513 CI passed. - Dev merge queue CI passed: https://github.com/the-open-engine/zeroshot/actions/runs/27845636128 - Local validation before #513 merge: - npm test -- tests/update-checker.test.js tests/legacy-covibes-bridge.test.js - npm test -- tests/preflight.test.js - npm run test:coverage - npx prettier --check cli/index.js tests/run-tests.js - npm run lint - npm run typecheck - npm run validate:templates - npm test - npm publish --dry-run --access public in legacy/covibes-zeroshot-bridge - temp-prefix old-to-bridge and bridge-to-new CLI migration proof --------- Co-authored-by: Eivind Meyer <eiv.meyer@gmail.com> Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com> Co-authored-by: Eivind Meyer <eivind.meyer@ksat.no> Co-authored-by: Michael Eichelbeck <141341133+mkceichelbeck@users.noreply.github.com> Co-authored-by: Michael Eichelbeck <michael.eichelbeck.ext@wtsde.onmicrosoft.de> Co-authored-by: Ubuntu <ubuntu@ip-172-31-38-53.eu-north-1.compute.internal> Co-authored-by: Eivind <eivind@covibes.ai> Co-authored-by: CI Test <ci-test@covibes.ai> Co-authored-by: Codex <codex@example.com>
## Summary Promote the Windows provider-detection fix from `dev` to `main` for release. ## Included change - #516: detect provider CLIs on Windows using `where` instead of POSIX-only `command -v` - Closes the same bug family tracked by #515 and #456 ## Release impact This should produce the next patch release after `v6.0.2` via semantic-release once the main CI and release workflow complete. ## Verification - #516 `check` passed before merge to `dev` - `main..dev` diff contains only `lib/provider-detection.js` and `tests/provider-detection.test.js` --------- Co-authored-by: Eivind Meyer <eiv.meyer@gmail.com> Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com> Co-authored-by: Eivind Meyer <eivind.meyer@ksat.no> Co-authored-by: Michael Eichelbeck <141341133+mkceichelbeck@users.noreply.github.com> Co-authored-by: Michael Eichelbeck <michael.eichelbeck.ext@wtsde.onmicrosoft.de> Co-authored-by: Ubuntu <ubuntu@ip-172-31-38-53.eu-north-1.compute.internal> Co-authored-by: Eivind <eivind@covibes.ai> Co-authored-by: CI Test <ci-test@covibes.ai> Co-authored-by: Codex <codex@example.com> Co-authored-by: Atharv Singh <132380045+atharvwasthere@users.noreply.github.com>
## Summary Promote `dev` to `main` for the cmdproof command-reuse release. ## Included changes - #522: proof-backed command reuse via configurable `zeroshot-command-proofs` JSON blocks and repo settings - #521: isolate trigger sandbox globals ## Release impact This should produce the next minor release after `v6.0.3` via semantic-release once the main merge queue, CI, and release workflow complete. ## Verification - #522 PR CI passed - #522 merge-group CI passed - `main..dev` diff checked before opening --------- Co-authored-by: Eivind Meyer <eiv.meyer@gmail.com> Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com> Co-authored-by: Eivind Meyer <eivind.meyer@ksat.no> Co-authored-by: Michael Eichelbeck <141341133+mkceichelbeck@users.noreply.github.com> Co-authored-by: Michael Eichelbeck <michael.eichelbeck.ext@wtsde.onmicrosoft.de> Co-authored-by: Ubuntu <ubuntu@ip-172-31-38-53.eu-north-1.compute.internal> Co-authored-by: Eivind <eivind@covibes.ai> Co-authored-by: CI Test <ci-test@covibes.ai> Co-authored-by: Codex <codex@example.com> Co-authored-by: Atharv Singh <132380045+atharvwasthere@users.noreply.github.com>
## Summary - release the cmdproof action-key single-flight fix on top of current `main` - prevents concurrent validators from launching duplicate raw fallback CI for the same cmdproof action key - keeps fallback behavior unchanged when verify output has no action key ## Why this PR uses `tomdps:dev` The normal upstream `dev -> main` PR (#525) is conflicted because `dev` lost the main ancestry edge when the merge queue squashed the no-file sync PR. The repo guard allows `main` PRs only from a branch named `dev`; this fork branch is named `dev` and is based directly on current `main`, so the release diff is clean and limited to the intended two files. ## Validation - #524 feature PR CI passed - #524 merge-group CI passed into upstream dev - This PR should run the required main CI/install matrix on the clean main-based patch
Merge origin/main (v6.2.0) into dev with dev's tree taken verbatim (dev is a content superset of main; PR #586 synced content but was squashed, losing ancestry). This commit changes no content - it only records main as an ancestor of dev so release PRs compute a clean merge-base. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
tomdps
enabled auto-merge
July 9, 2026 02:03
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Follow-up to #586, which synced content but was squashed by the merge queue — losing the ancestry link, so release PR #585 stayed conflicting.
This PR is a merge commit of
main(v6.2.0) intodevwhose tree is byte-identical to currentdev(created withgit commit-tree dev^{tree} -p dev -p main). It changes zero content; it only recordsmainas an ancestor ofdevso the release PR computes a clean merge-base.The dev merge queue's method has been temporarily set to MERGE so this lands as a true merge commit; it will be restored to SQUASH immediately after.
🤖 Generated with Claude Code