From 8c98bc8653f2f4b98792f39ce6c91f5330a73fbc Mon Sep 17 00:00:00 2001 From: Robert Wlodarczyk Date: Tue, 19 May 2026 20:16:48 -0700 Subject: [PATCH 1/2] fix(release): sign release tags with git tag -s in just release v1.2.0 was PGP-signed but v1.2.1 shipped unsigned because the recipe used `git tag -a` (annotated, unsigned). Switch to `-s` so `just release` produces signed tags using the maintainer's configured signing key. Co-Authored-By: Claude Opus 4.7 (1M context) --- justfile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/justfile b/justfile index bf7a18e..f138165 100644 --- a/justfile +++ b/justfile @@ -23,7 +23,7 @@ ci: fmt-check clippy openssl-check nextest schema-diff image [doc('Tag and push a release. Usage: just release 1.0.0')] release version: @echo "Creating release v{{version}}..." - git tag -a "v{{version}}" -m "Release v{{version}}" + git tag -s "v{{version}}" -m "Release v{{version}}" git push origin "v{{version}}" @echo "Release v{{version}} tagged and pushed. CI will build and publish." From 5cd33d7e0b1ddad73d9fdf081a1df7145b0b1535 Mon Sep 17 00:00:00 2001 From: Robert Wlodarczyk Date: Tue, 19 May 2026 20:17:17 -0700 Subject: [PATCH 2/2] docs(state): log signed-release-tag fast task Co-Authored-By: Claude Opus 4.7 (1M context) --- .planning/STATE.md | 1 + 1 file changed, 1 insertion(+) diff --git a/.planning/STATE.md b/.planning/STATE.md index 881dc48..c14480f 100644 --- a/.planning/STATE.md +++ b/.planning/STATE.md @@ -185,6 +185,7 @@ Items acknowledged and deferred at v1.1 milestone close on 2026-04-24. All six s |----|------|-------------|---------|-----------| | 260421-nn3 | 2026-04-22 | Fix `get_dashboard_jobs` Postgres `j.enabled = true` BIGINT bug (queries.rs lines 615 + 628) + add Postgres regression test `tests/dashboard_jobs_pg.rs` mirroring v13_timeline_explain harness. Closes the deferred item logged in Phase 13 plan 06. | `07d81bb`, `7cb1a10`, `7917502` | `.planning/quick/260421-nn3-fix-get-dashboard-jobs-postgres-j-enable/` | | 260519-qcp | 2026-05-19 | Close THREAT_MODEL T-I4 webhook-URL credential gap: add `strip_url_credentials` helper (src/db/mod.rs) + scrub userinfo at every webhook URL/error sink before log/persist (dispatcher tracing spans, `WebhookError::Network`, DLQ `url`/`last_error`); fix `examples/cronduit.toml` header (6→8 jobs); ignore `*.swp`. For v1.2.1. | `7e33ff5`, `fb93c50`, `f3b041b`, `2cf1f9e` | `.planning/quick/260519-qcp-webhook-url-credential-scrubbing-t-i4-fi/` | +| fast-260519 | 2026-05-19 | `just release` now creates a **signed** tag (`git tag -s`, was `-a`) so releases are PGP-signed like v1.2.0 (v1.2.1 shipped unsigned). | `8c98bc8` | (fast task — justfile) | v1.0 quick task `260414-gbf` is archived in `.planning/milestones/v1.0-MILESTONE-AUDIT.md`.