🚀 - 3.10.0 - Release v3.10.0 repository verification setup and onboarding #659

Release Type

Minor

Release Version

3.10.0

Changelog

• Prepare repository verification dependencies with a native, repository-owned composite action. Execute the reviewed trusted-main snapshot before candidate verification, with isolated credentials and native post-step cleanup (✨ - Support repository owned verification setup hooks without editing generated workflows #647, feat: prepare repository verification with native composite actions #652).
• Generate .github/actions/copilot-verification-setup/action.yml only when absent, preserve existing consumer actions and their auxiliary files, and expose opt-in VERIFICATION_SETUP activation in the shared web/terminal assistant. Include the starter in npm and document staged upgrades and rollback (✨🧑‍💻 - Generate verification setup starter preserve consumer actions and expose wizard activation #656, feat(#656): generate verification setup actions and expose wizard activation #657).
• Improve unsupported stored-configuration recovery, actionable SDD ownership diagnostics, companion SDD case/acceptance consistency, and Bugbot finding mutation and duplicate reconciliation diagnostics (🐛🧑‍💻 - Improve diagnostics and recovery for unsupported PR configuration schemas #635, 🐛🧑‍💻 - Pre branch SDD ownership analysis fails without an actionable issue diagnostic or clarification card #636, 🐛🧑‍💻 - bug Bugbot persists a review then fails reconciliation with opaque provider.unavailable #646, 🐛🧑‍💻 - bug generated companion SDD publishes colliding case IDs and inconsistent acceptance mappings #653, 🐛🧑‍💻 - Bugbot reconciliation retains an orphan unknown finding alongside duplicate semantic reports #655; PRs fix: diagnose unsupported stored configuration with safe recovery #642, fix: publish actionable SDD ownership diagnostics #650, fix: retain actionable finding mutation diagnostics #651, fix(sdd): validate companion case and acceptance consistency #654, fix: Bugbot reconciliation retains an orphan unknown finding alongside duplicate semantic reports (#655) #658).
• Forward live merge-queue attestations through release/hotfix publication, stabilize hosted Windows permission-journal coverage, and keep bounded RepoWise analysis available on demand (🐛🧑‍💻 - bugfix intermittent hosted Windows permission journal test exceeds Jest timeout #577, 📝🧑‍💻 - Clarify deployment queue syntax and managed AGENTS.md hash scope #637, 🔧 - Run RepoWise only on demand to avoid CI bottlenecks #639, 🐛🧑‍💻 - Release and hotfix publication callbacks omit live merge queue attestations #643, 🔧🧑‍💻 - Optimize manual RepoWise analysis and complete bounded dead code and history scans #644; PRs fix: bugfix intermittent hosted Windows permission journal test exceeds Jest timeout (#577) #638, docs: clarify deployment queues and managed pointer hashes #640, chore: run RepoWise only on manual dispatch #641, chore: complete bounded manual RepoWise analysis #645, fix: forward live queue attestations on publication #649).

Additional Context

The maintainer explicitly authorized preparing and publishing the next minor release, then reporting the published version and exact upgrade steps for repositories already configured with Copilot. The latest verified npm/GitHub version is 3.9.3; this operation targets 3.10.0. No active release issue was found.

Cut the release from the Action-owned snapshot of develop. The development tip inspected before admission was c055c6c9fe31f3e2189017772a281629d3989968, containing verification setup PRs #652 and #657 and the companion consistency and reconciliation fixes #654 and #658. Preserve the frozen origin recorded by the Action.

Use the installed release preparation, protected production promotion, npm trusted publication, GitHub Release, major Action reference update, and development reconciliation flow. Wait for the current-head checks and complete review with no unresolved findings before any merge. Do not bypass branch rules or manually create release branches, tags, or publication artifacts.

Before declaring completion, verify that package.json, immutable v3.10.0 tag, npm @vypdev/copilot@3.10.0 gitHead, GitHub Release, and the updated v3 Action ref identify the accepted production commit; verify development reconciliation and issue completion. Verify the published CLI and setup starter from the registry package. Keep verification setup disabled during consumer preparation, customize the starter on trusted MAIN_BRANCH before enabling it, and document updating both workflow YAML and any pinned Action references.