Skip to content

chore(main): release 1.4.0 - #66

Merged
ANT1OFF merged 2 commits into
mainfrom
release-please--branches--main--components--gram
Nov 2, 2026
Merged

chore(main): release 1.4.0#66
ANT1OFF merged 2 commits into
mainfrom
release-please--branches--main--components--gram

Conversation

@github-actions

@github-actions github-actions Bot commented Nov 2, 2026 •
edited by gram-release-please Bot
Loading

Copy link
Copy Markdown
Contributor

Desktop release metadata proposal only. Merging this PR does not publish or tag Gram; follow docs/RELEASING.md to release.

1.4.0 (2026-11-02)

Features

  • agents: identify Gram's Claude processes as the gram entrypoint (#91) (f7dd703)
  • desktop: run on Linux (#82) (1d37deb)
  • desktop: turn voice input off on Linux with one check (#79) (470ff8b)
  • orchestration: a person's PR comment wakes the worker that owns it (#86) (19bdc1c)
  • orchestration: a wrap-up turn when a worker stops without reporting (#88) (36a07fb)
  • orchestration: workers say what they ruled out and check before repeating (#90) (8bdce01)
  • release: publish and update Linux AppImage and .deb (#95) (c33c464)
  • voice: an accurate mode with a Parakeet pass on each pause (#83) (2b04a52)
  • voice: hold one key to talk, with a tone at each end (#87) (1a9b3ef)
  • voice: start capture at the press, and an opt-in ready microphone (#81) (505d240)
  • web: a Done section that keeps the last 7 days (#65) (8c7bd49)
  • web: Done lists every finished chat (#67) (c91d9ac)
  • web: one attention count, quieter rows, a sidebar and board that agree (#92) (f193da4)
  • web: orchestrator → workers in the sidebar, a board that matches (#80) (686e737)

Bug Fixes

  • desktop: harden the Linux key vault and autostart entry (#85) (4b35eac)
  • e2e: hold the t-flaky turn while the smoke test reads its opening line (#93) (2edc4ac)
  • e2e: release the dictation tap as soon as a word is heard (#94) (7781194)
  • prepare only approved local-check sources (#32) (af3fab7)
  • repair main after #32 (#68) (ce352e6)
  • voice: keep the last word after release (#78) (cc40a47)

This PR was generated with Release Please. See documentation.

@github-actions github-actions Bot added the autorelease: pending Release-please: merged, not yet released label Nov 2, 2026
@github-actions
github-actions Bot force-pushed the release-please--branches--main--components--gram branch 3 times, most recently from 66e94a9 to 698fd0c Compare November 2, 2026 03:04
@ANT1OFF ANT1OFF mentioned this pull request Nov 2, 2026
Merged
ANT1OFF added a commit that referenced this pull request Nov 2, 2026
@ANT1OFF
ci: let release-please PRs run checks without approval (#69)
e2062a4 
## Why

Every push to the release-please PR (#66) leaves "Application checks"
and "Scaffold boundaries" at `action_required`, so they only run after
someone clicks **Approve workflows to run**.

**Cause.** Since June 2026, GitHub holds `pull_request` runs (`opened`,
`synchronize`, `reopened`) for approval when `GITHUB_TOKEN` created or
updated the PR
([changelog](https://github.blog/changelog/2026-06-11-bot-created-pull-requests-can-run-workflows-if-approved/),
[GITHUB_TOKEN
docs](https://docs.github.com/en/actions/concepts/security/github_token)).
The repository's fork-PR approval policy (`all_external_contributors`)
plays no part:
- run 41381041436 (head `698fd0c`): `event=pull_request`,
`actor=github-actions[bot]` (Bot),
`triggering_actor=github-actions[bot]`, head repository `ANT1OFF/gram`,
so the PR comes from a branch in this repository, not a fork;
- all 10 recent `action_required` runs on release-please's branch look
the same.

The docs name only one way around it: create or update the PR with a
GitHub App installation token or a PAT. No repository setting exempts
the bot, so the approval policy stays as it is.

## Repository setting changed

- **Environments.** Before: none (`total_count: 0`). After:
`release-please`, with deployment branch policy `custom_branch_policies:
true` and one branch policy, `main` (type `branch`), and
`can_admins_bypass` set to `false` (it was created as `true`). There are
no reviewers or wait timers and no secrets yet.
- **Unchanged:** `fork-pr-contributor-approval` is still
`all_external_contributors`. Allowed actions, SHA pinning and default
workflow permissions are untouched.

## What

- `release-please.yml`: the `propose` job now runs in the
`release-please` environment, so the app key can be read only from
`main`. If the environment variable `RELEASE_PLEASE_APP_CLIENT_ID` is
set, the `propose` job first mints a GitHub App installation token with
`actions/create-github-app-token`, pinned to the v3.3.0 SHA. The token
is scoped to this repository, carries only `contents: write` and
`pull-requests: write`, and is revoked when the job ends. release-please
then uses that token. Without the variable, it uses `github.token`
exactly as it does today.
- Hardening is unchanged. The job is still triggered only by pushes to
`main` or `workflow_dispatch` and is still API-only, with no checkout or
script while it holds a write token. Default and top-level permissions
stay read-only. No PR-triggered workflow can read the secret.
`actions/*` is already in the allowed-actions list. Fork approval still
applies to new external contributors.
- `tools/test-release-please.mjs`: the workflow assertions now cover the
new step, its pin, its exact inputs and the token fallback.
- `docs/RELEASING.md`: a short "Release app" section with the one-time
setup steps.

## Setup (the owner has to do this; until then nothing changes)

The steps are in `docs/RELEASING.md#release-app`: create a GitHub App
with Contents and Pull requests read/write and no webhook, install it on
`ANT1OFF/gram` only, then set the secret
`RELEASE_PLEASE_APP_PRIVATE_KEY` and the variable
`RELEASE_PLEASE_APP_CLIENT_ID` in the `release-please` environment
(`--env release-please`).

## Verification

- `node tools/test-release-please.mjs <pinned action npm-ci dir>`: 10/10
pass
- `node tools/check-release-please.mjs`: OK
- `bun run check:scaffold`: pass
- `bun run fmt:check`: pass

**Not verified live.** Proving that the app token removes the approval
needs the app and its secret, which only the owner can create. After
setup, run `gh workflow run release-please.yml --repo ANT1OFF/gram`,
then confirm the `app-token` step ran and that the release PR's runs on
its next push are not `action_required`.

Independent review of 60a252e, then a re-review of 6fade81: nothing
blocking either time. The re-review also confirmed that the step `if`
resolves environment-level `vars` and that runs on main pass the branch
policy. Following its advice, admin bypass is off. It also cautions that
any future main-branch workflow on an untrusted trigger
(`pull_request_target`, `workflow_run`) must not name this environment.
First review: Its two non-blocking points are fixed in 6fade81: the key
now sits in a main-only environment, and docs step 5 says what happens
to runs already held.

Known limits:
- Every release-please run now records a deployment to the
`release-please` environment.
- Release-please pushes to the PR only when the proposed content
changes, so the first run that clears approval may be the one after the
next `feat:`/`fix:` merge.
@gram-release-please
gram-release-please Bot force-pushed the release-please--branches--main--components--gram branch 14 times, most recently from b680710 to cc51fdb Compare November 2, 2026 18:05
@gram-release-please
gram-release-please Bot force-pushed the release-please--branches--main--components--gram branch from cc51fdb to 68efcdc Compare November 2, 2026 18:13
@ANT1OFF
ANT1OFF marked this pull request as ready for review November 2, 2026 18:35
@ANT1OFF
ANT1OFF self-requested a review as a code owner November 2, 2026 18:35
@ANT1OFF
ANT1OFF merged commit 1f0e913 into main Nov 2, 2026
23 checks passed
@ANT1OFF
ANT1OFF deleted the release-please--branches--main--components--gram branch November 2, 2026 18:53
@ANT1OFF ANT1OFF added autorelease: tagged Release-please: released and removed autorelease: pending Release-please: merged, not yet released labels Nov 2, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@ANT1OFF ANT1OFF Awaiting requested review from ANT1OFF ANT1OFF is a code owner

Assignees

No one assigned

Labels

autorelease: tagged Release-please: released

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@ANT1OFF