From aeafe455175fee0e507d9bd0490f57379e05643c Mon Sep 17 00:00:00 2001 From: Claude Date: Mon, 20 Jul 2026 17:31:46 +0000 Subject: [PATCH 1/3] ci: adopt mint for versioning + release provenance MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Wire door-kit to mint so future releases are cut in CI from a per-PR intent (deterministic version + changelog + tag) instead of a hand-pushed tag matched to jsr.json by eye. No intent yet — this is the tooling only; the next user-facing change (the scout-wire 0.3.0 client) drops the first intent. - .release/README.md — the intent-drop convention. - version.yml — `mint plan` validates intents + previews the next version on every PR (mint reusable @v0.3.1). - release.yml — on a v* tag, mint in-toto release-provenance + cosign keyless signing (reusable @v0.3.1). - publish.yml (unchanged) still does the JSR publish on the tag via OIDC. Note: package.json (0.6.0) and jsr.json (0.11.0) currently disagree; mint reads jsr.json first and, on the next `mint version`, sets BOTH manifests to the same computed version — reconciling the drift at the next release. Verified locally: `mint plan` → no intents, stays 0.11.0 (green, nothing to release yet). Co-Authored-By: Claude Opus 4.8 Claude-Session: https://claude.ai/code/session_01H7i26MiqwkD1gCRAY85gJY --- .github/workflows/release.yml | 20 ++++++++++++++++++++ .github/workflows/version.yml | 18 ++++++++++++++++++ .release/README.md | 18 ++++++++++++++++++ 3 files changed, 56 insertions(+) create mode 100644 .github/workflows/release.yml create mode 100644 .github/workflows/version.yml create mode 100644 .release/README.md diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml new file mode 100644 index 0000000..ce352fd --- /dev/null +++ b/.github/workflows/release.yml @@ -0,0 +1,20 @@ +name: release + +# Release provenance via the bounded-systems mint capability. On a v tag +# (cut by `mint release`), emits the deterministic in-toto release Statement +# (tag -> version plan -> commit) and keyless-signs it (cosign/OIDC). The JSR +# publish stays in publish.yml; this job owns VERSION + TAG provenance only. +# Pinned to an immutable mint ref. +on: + push: + tags: ["v*"] + +permissions: + contents: write # create / upload to the GitHub release + id-token: write # OIDC — cosign keyless signing + +jobs: + release: + uses: bounded-systems/mint/.github/workflows/release-provenance.yml@v0.3.1 # mint + with: + ref: v0.3.1 diff --git a/.github/workflows/version.yml b/.github/workflows/version.yml new file mode 100644 index 0000000..8fe763e --- /dev/null +++ b/.github/workflows/version.yml @@ -0,0 +1,18 @@ +name: version + +# Versioning via the bounded-systems mint capability. Validates .release/ intents +# (fails closed on a malformed one) and previews the next version on every PR. +# Pinned to an immutable mint ref; bump when mint tags. +on: + push: + branches: [main] + pull_request: + +permissions: + contents: read + +jobs: + version: + uses: bounded-systems/mint/.github/workflows/version.yml@v0.3.1 # mint + with: + ref: v0.3.1 diff --git a/.release/README.md b/.release/README.md new file mode 100644 index 0000000..4646b6b --- /dev/null +++ b/.release/README.md @@ -0,0 +1,18 @@ +# Release intents + +This repo uses [@bounded-systems/mint](https://github.com/bounded-systems/mint) for +versioning. Each PR with a user-facing change drops an intent file here; mint +resolves the strongest bump and cuts the release deterministically. + +Format — `.release/.md`: + + --- + bump: minor # patch | minor | major + --- + short summary of the change (becomes the changelog line) + +The `version` CI job runs `mint plan`, which validates every intent and previews +the next version. At release time `mint version` bumps every manifest present +(`jsr.json` + `package.json`), prepends `CHANGELOG.md`, and consumes the intents; +`mint release` cuts the `v` tag, which drives `publish.yml` (JSR, +keyless OIDC) and `release.yml` (in-toto provenance). From 4ac5dd3b9c098fc2815f708f89448111a50c8058 Mon Sep 17 00:00:00 2001 From: Claude Date: Mon, 20 Jul 2026 17:50:09 +0000 Subject: [PATCH 2/3] ci: add the mint cut-release dispatch (the only path that cuts a tag) A workflow_dispatch job that runs mint version + commit + mint release entirely in CI, so a release tag is only ever cut by mint from the Actions UI. No-op without intents; requires the workflow may push to main. Co-Authored-By: Claude Opus 4.8 Claude-Session: https://claude.ai/code/session_01H7i26MiqwkD1gCRAY85gJY --- .github/workflows/cut-release.yml | 65 +++++++++++++++++++++++++++++++ 1 file changed, 65 insertions(+) create mode 100644 .github/workflows/cut-release.yml diff --git a/.github/workflows/cut-release.yml b/.github/workflows/cut-release.yml new file mode 100644 index 0000000..b2207ea --- /dev/null +++ b/.github/workflows/cut-release.yml @@ -0,0 +1,65 @@ +name: cut release + +# mint is the ONLY thing that cuts a release tag — never a hand-pushed tag. +# Dispatch this (Actions UI) to run, entirely in CI: +# mint version → bump jsr.json + package.json + prepend CHANGELOG + consume +# the .release/ intents +# commit the bump to main +# mint release → cut + PUSH the v tag, which drives publish.yml +# (JSR, keyless OIDC) + release.yml (in-toto provenance) +# +# No-op when there are no intents. REQUIRES: the workflow may push to `main` +# (allow GitHub Actions in branch protection, or swap in a deploy/app token). +on: + workflow_dispatch: {} + +permissions: + contents: write # push the version-bump commit + the release tag + +concurrency: + group: cut-release + cancel-in-progress: false + +jobs: + cut: + runs-on: ubuntu-latest + steps: + - name: Checkout main + uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5 + with: + fetch-depth: 0 + - name: Checkout mint + uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5 + with: + repository: bounded-systems/mint + ref: v0.3.1 + path: .mint + - name: Setup Node + uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5 + with: + node-version: "22" + - name: Install mint deps + working-directory: .mint + run: npm ci --no-audit --no-fund + - name: Git identity + run: | + git config user.name "mint" + git config user.email "noreply@anthropic.com" + - name: mint version — bump + changelog + consume intents + id: mv + run: | + out="$(node .mint/mint.mjs version)"; printf '%s\n' "$out" + next="$(printf '%s\n' "$out" | grep -oE '→ [0-9]+\.[0-9]+\.[0-9]+' | head -1 | tr -dc '0-9.')" + if [ -z "$next" ]; then + echo "released=false" >> "$GITHUB_OUTPUT" + else + echo "released=true" >> "$GITHUB_OUTPUT" + echo "next=$next" >> "$GITHUB_OUTPUT" + fi + - name: Commit the bump, then mint release (cut + push the tag) + if: steps.mv.outputs.released == 'true' + run: | + git add -A + git commit -m "chore(release): v${{ steps.mv.outputs.next }}" + git push origin HEAD:main + node .mint/mint.mjs release # cuts + pushes v From add01a2dd0b5532efde9e5030a8f30435b60b971 Mon Sep 17 00:00:00 2001 From: Claude Date: Mon, 20 Jul 2026 21:35:52 +0000 Subject: [PATCH 3/3] ci: pin mint reusable workflows to v0.5.0 (deno.json support) v0.3.1 predates mint's deno.json support (landed in 0.5.0), so `mint plan` crashed with ENOENT on package.json for deno.json-only repos. Pin the version/release/cut-release workflows to v0.5.0, which reads + bumps deno.json / jsr.json / package.json. Co-Authored-By: Claude Opus 4.8 Claude-Session: https://claude.ai/code/session_01H7i26MiqwkD1gCRAY85gJY --- .github/workflows/cut-release.yml | 2 +- .github/workflows/release.yml | 4 ++-- .github/workflows/version.yml | 4 ++-- 3 files changed, 5 insertions(+), 5 deletions(-) diff --git a/.github/workflows/cut-release.yml b/.github/workflows/cut-release.yml index b2207ea..a97956a 100644 --- a/.github/workflows/cut-release.yml +++ b/.github/workflows/cut-release.yml @@ -32,7 +32,7 @@ jobs: uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5 with: repository: bounded-systems/mint - ref: v0.3.1 + ref: v0.5.0 path: .mint - name: Setup Node uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5 diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index ce352fd..ff45dd2 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -15,6 +15,6 @@ permissions: jobs: release: - uses: bounded-systems/mint/.github/workflows/release-provenance.yml@v0.3.1 # mint + uses: bounded-systems/mint/.github/workflows/release-provenance.yml@v0.5.0 # mint with: - ref: v0.3.1 + ref: v0.5.0 diff --git a/.github/workflows/version.yml b/.github/workflows/version.yml index 8fe763e..29f0f56 100644 --- a/.github/workflows/version.yml +++ b/.github/workflows/version.yml @@ -13,6 +13,6 @@ permissions: jobs: version: - uses: bounded-systems/mint/.github/workflows/version.yml@v0.3.1 # mint + uses: bounded-systems/mint/.github/workflows/version.yml@v0.5.0 # mint with: - ref: v0.3.1 + ref: v0.5.0