feat(suzuki-shunsuke/cmdx): GitHub immutable release config

[scop]

All releases are marked immutable, but only >= 2.0.2-0 contain the required release attestations needed for verification.

This got me thinking, maybe the related registry property would be better renamed as github_release_attestations rather than github_immutable_release?

Check List

• Read CONTRIBUTING.md
  • Read OSS Contribution Guide
• All commits are signed
  • This repository enables Require signed commits, so all commits must be signed
• Avoid force push
• Install and execute the package and confirm if the package works well
• Execute cmdx s to scaffold code

Summary by CodeRabbit

• Chores
  • Added support for cmdx version 2.0.1 in package registry configurations.
  • Updated package manifests with new version constraints and asset specifications.
  • Enabled immutable release tracking for enhanced package management stability.
  • Implemented checksum verification and SLSA provenance tracking for improved package integrity verification.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 22814ec3-2842-42d4-a32f-571dff772a54

📥 Commits

Reviewing files that changed from the base of the PR and between d9443e7 and 4390f47.

📒 Files selected for processing (3)

• pkgs/suzuki-shunsuke/cmdx/pkg.yaml
• pkgs/suzuki-shunsuke/cmdx/registry.yaml
• registry.yaml

---

📝 Walkthrough

Walkthrough

Adds version-specific configuration for cmdx v2.0.1 across registry files, including checksum verification, SLSA provenance, platform-specific overrides, and marks the default version with an immutable release flag.

Changes

Cohort / File(s)	Summary
Package Registry Configuration pkgs/suzuki-shunsuke/cmdx/pkg.yaml, pkgs/suzuki-shunsuke/cmdx/registry.yaml	Added new package entry for version v2.0.1 with asset references, checksums, cosign verification, and SLSA provenance. Modified default entry to include github_immutable_release flag.
Root Registry registry.yaml	Parallel changes adding version constraint semver("\<= 2.0.1") with checksums, certificate identity verification, SLSA provenance, and platform overrides; updated default entry with immutable release marker.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

Suggested labels

enhancement

Poem

🐰 A bunny hops through versions old,
With checksums verified and true,
Now v2.0.1 takes its hold,
Immutable releases, fresh and new,
Registry magic, a rabbit's delight!

🚥 Pre-merge checks | ✅ 2 | ❌ 1

❌ Failed checks (1 inconclusive)

Check name	Status	Explanation	Resolution
Description check	❓ Inconclusive	The description includes context about the change and raises a thoughtful design question, but several checklist items remain unchecked (CONTRIBUTING.md, package testing, code scaffolding), indicating incomplete adherence to the template requirements.	Complete the checklist items: review and check the CONTRIBUTING.md and code scaffolding requirements, or explicitly document why they don't apply to this change.

✅ Passed checks (2 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title accurately summarizes the main change: adding GitHub immutable release configuration to the cmdx package. It directly reflects the core modification across all three modified files.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[suzuki-shunsuke]

This got me thinking, maybe the related registry property would be better renamed as github_release_attestations rather than github_immutable_release?

Good point.
It looks reasonable, but we should also keep the compatibility.