Skip to content

v1.0.3 — Verified publishing + self-ingestion fix

Choose a tag to compare

View all tags
@castnettech castnettech released this 02 Apr 15:31
· 7 commits to main since this release
Immutable release. Only release title and notes can be modified.
v1.0.3
77ebb6a

What's New

Verified PyPI Publishing (v1.0.3)

  • Added OIDC trusted publisher workflow for verified releases on PyPI
  • All GitHub Actions SHA-pinned to prevent supply chain attacks
  • Environment-gated deployment with required reviewer approval
  • Signed SLSA artifact attestation on every release
  • Tag-to-version verification prevents stale builds

Bug Fixes & Improvements (v1.0.2)

  • Fixed self-ingestion bug where mnemosyne could index its own database files
  • Fixed benchmark root path resolution
  • README overhaul — clearer install, usage, and architecture docs

Security

  • Zero secrets/tokens in CI — pure OIDC authentication
  • Least-privilege permissions on every workflow job
  • Build and publish are isolated jobs (build env cannot publish)

Full Changelog: v1.0.2...v1.0.3

Assets 3
Loading