Repository navigation
🦋 New version release - #10
Merged
Merged
Conversation
brentrager
pushed a commit
that referenced
this pull request
Aug 20, 2026
The new format:check gate immediately caught its own motivating case: release #10 appended a changesets-generated 0.3.0 entry to CHANGELOG.md, and that output is not oxfmt-clean. Exactly what the `pnpm run version` change in this PR prevents from recurring — this commit clears the one already on main. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0152bbE1veqfG1SVJdyLCBxC
brentrager
added a commit
that referenced
this pull request
Aug 20, 2026
…tead (#11) * Stop the release job formatting its own tree, and gate formatting instead The 0.2.1 release published to npm and PyPI and then FAILED on crates.io: error: 1 files in the working directory contain changes that were not yet committed into git: rust/audit/Cargo.toml Cause: release.yml ran `pnpm format` — WRITE mode — as a step, and nothing committed the result. main was not format-clean, so the formatter dirtied the tree, and `cargo publish` refused. That is the only thing `--allow-dirty` was ever masking, and it was masking it blindly: the flag would have shipped whatever the formatter happened to change. Because that job aborted, the Go tag and the NuGet push never ran either, so 0.2.1 exists on npm + PyPI only. The next release restores lockstep across all five; nothing is published by hand here. - release.yml formats nothing. It runs `pnpm format:check`. - pr-checks.yml gains the same gate — the repo had NO format check at all, which is how main drifted out of format in the first place. - New `format:check` (oxfmt --check + ruff format --check + the existing rust/go check scripts) and `python:format-check`. - The repo is formatted once, so the gate is green from the start. - `pnpm run version` now ends with `pnpm format`. Verified necessary, not decorative: a changesets-generated CHANGELOG.md is NOT oxfmt-clean, so format:check would have redded every release PR — the same self-inflicted break in a new place. Simulated the full lifecycle (`changeset version` -> sync -> format) and confirmed both format:check and version:check pass on the resulting tree at 0.3.0. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0152bbE1veqfG1SVJdyLCBxC * Format the 0.3.0 CHANGELOG entry the release wrote unformatted The new format:check gate immediately caught its own motivating case: release #10 appended a changesets-generated 0.3.0 entry to CHANGELOG.md, and that output is not oxfmt-clean. Exactly what the `pnpm run version` change in this PR prevents from recurring — this commit clears the one already on main. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0152bbE1veqfG1SVJdyLCBxC --------- Co-authored-by: Brent <brent@smoo.ai> Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR was opened by the Changesets release GitHub action. When you're ready to do a release, you can merge this and the packages will be published to npm automatically. If you're not ready to do a release yet, that's fine, whenever you add more changesets to main, this PR will be updated.
Releases
@smooai/audit@0.3.0
Minor Changes
a6a0293: Ship chain verification in all five languages, and prove it with corrupted-chain
corpus vectors.
verifyChain— the function that actually DETECTS a broken hash chain — existedonly in TypeScript. Python carried a docstring describing how one would verify;
Rust, Go, and .NET had nothing. A service in four of five languages could seal a
chain it could never audit, which makes "tamper-evident" a claim rather than a
capability.
verify_chain(Python, Rust),VerifyChain(Go),HashChain.Verify(.NET). All five return the same verdict shape:
ok,brokenAt, and a sharedfailure code —
hash_previous_mismatch(the link is wrong) orhash_current_mismatch(the event body was edited after sealing).verifyChaingains an optionalgenesisPreviousHash, so a slice continuing anexisting chain can be verified at all. Without it, only a first-of-day chain
was verifiable. TypeScript additionally gains a
codefield alongside theexisting human-readable
reason(additive;reasonis unchanged).spec/parity-corpus.jsongainschainFixtures: 11 real chains, sealed by thebuilder and then genuinely tampered with, each with the verdict every language
must return. All five suites load them. The corpus previously proved sealing
only, which is what let the asymmetry hide.
still verifies. Replay cannot see it; catching it needs an external anchor.