From f78de49682521f2a48a2c98baaba3ee518bfa3f7 Mon Sep 17 00:00:00 2001 From: Genie Date: Sat, 25 Jul 2026 19:58:54 -0300 Subject: [PATCH 1/3] chore(release): re-enable the tag-orphan alarm MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The workflow header's re-enable condition — verified against a fresh sample of tags — is now met. Manual dispatch 30178531358 ran against the debris of the 2026-07-20..25 release outage and detected exactly the 8 genuine orphans (v5.260725.1-.8: tags pushed, no Release), filing issues #2651-#2658 with zero false positives from the 1000+ historical v1.0.x tags excluded by the 24h upper bound. That outage is the scenario this alarm exists for: five days of releases died between tag-push and release-publish and nothing surfaced it automatically — every discovery was manual. --- .github/workflows/release-orphan-alert.yml | 18 ++++++++++++------ 1 file changed, 12 insertions(+), 6 deletions(-) diff --git a/.github/workflows/release-orphan-alert.yml b/.github/workflows/release-orphan-alert.yml index a505775c4..2b2d4e661 100644 --- a/.github/workflows/release-orphan-alert.yml +++ b/.github/workflows/release-orphan-alert.yml @@ -21,12 +21,18 @@ name: Release Orphan Alert # surface; this workflow makes it automatic. on: - # Schedule disabled while the false-positive backlog is being - # cleaned up. Re-enable after the cron logic is verified against - # a fresh sample of tags. Until then, this workflow only fires - # via manual workflow_dispatch. - # schedule: - # - cron: '*/30 * * * *' + # Re-enabled 2026-07-25. The re-enable condition — "verified against + # a fresh sample of tags" — was met by manual dispatch run 30178531358 + # against the debris of the 2026-07-20..25 release outage: it detected + # exactly the 8 genuine orphans (v5.260725.1-.8, tags pushed with no + # Release) and filed issues #2651-#2658, with zero false positives from + # the 1000+ historical v1.0.x tags the 24h upper bound excludes. + # + # That outage is precisely the scenario this alarm exists for: five days + # of releases died between tag-push and release-publish and nothing + # surfaced it automatically. + schedule: + - cron: '*/30 * * * *' workflow_dispatch: permissions: From 24682a565dfb5b52221d9a6246ffb6d47438f6b7 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" Date: Sat, 25 Jul 2026 23:00:49 +0000 Subject: [PATCH 2/3] chore(version): bump to 5.260725.10 [auto-version] --- .claude-plugin/marketplace.json | 2 +- package.json | 2 +- plugins/genie/.claude-plugin/plugin.json | 2 +- plugins/genie/.codex-plugin/plugin.json | 2 +- plugins/genie/package.json | 2 +- plugins/hermes-genie/plugin.yaml | 2 +- 6 files changed, 6 insertions(+), 6 deletions(-) diff --git a/.claude-plugin/marketplace.json b/.claude-plugin/marketplace.json index 292f40cd2..74afe255e 100644 --- a/.claude-plugin/marketplace.json +++ b/.claude-plugin/marketplace.json @@ -10,7 +10,7 @@ "plugins": [ { "name": "genie", - "version": "5.260725.8", + "version": "5.260725.10", "source": "./plugins/genie", "description": "Human-AI partnership for Claude Code. Share a terminal, orchestrate workers, evolve together. Brainstorm ideas, wish them into plans, make with parallel agents, ship as one team. A coding genie that grows with your project." } diff --git a/package.json b/package.json index 9aa6ff05f..3a00c8a62 100644 --- a/package.json +++ b/package.json @@ -1,7 +1,7 @@ { "name": "@automagik/genie", - "version": "5.260725.8", + "version": "5.260725.10", "description": "Collaborative terminal toolkit for human + AI workflows. NOTE: npm distribution discontinued 2026-05-09 — install via `curl -fsSL https://raw.githubusercontent.com/automagik-dev/genie/main/install.sh | bash` (cosign + SLSA verified). See https://automagik.dev/genie/release-process", "license": "MIT", diff --git a/plugins/genie/.claude-plugin/plugin.json b/plugins/genie/.claude-plugin/plugin.json index 789ffd7f7..1c77f9e01 100644 --- a/plugins/genie/.claude-plugin/plugin.json +++ b/plugins/genie/.claude-plugin/plugin.json @@ -1,6 +1,6 @@ { "name": "genie", - "version": "5.260725.8", + "version": "5.260725.10", "description": "Human-AI partnership for Claude Code. Share a terminal, orchestrate workers, evolve together. Brainstorm ideas, turn them into wishes, execute with /work, validate with /review, and ship as one team.", "author": { "name": "Namastex Labs" diff --git a/plugins/genie/.codex-plugin/plugin.json b/plugins/genie/.codex-plugin/plugin.json index 507107a1e..0118a4ae1 100644 --- a/plugins/genie/.codex-plugin/plugin.json +++ b/plugins/genie/.codex-plugin/plugin.json @@ -1,6 +1,6 @@ { "name": "genie", - "version": "5.260725.8", + "version": "5.260725.10", "description": "Plan, execute, review, and ship software with Genie workflows in Codex.", "author": { "name": "Namastex Labs", diff --git a/plugins/genie/package.json b/plugins/genie/package.json index 3f132366d..e39f6d93f 100644 --- a/plugins/genie/package.json +++ b/plugins/genie/package.json @@ -1,6 +1,6 @@ { "name": "genie-plugin", - "version": "5.260725.8", + "version": "5.260725.10", "private": true, "description": "Runtime dependencies for genie bundled CLIs", "license": "MIT", diff --git a/plugins/hermes-genie/plugin.yaml b/plugins/hermes-genie/plugin.yaml index b38f694f4..1a28d9f63 100644 --- a/plugins/hermes-genie/plugin.yaml +++ b/plugins/hermes-genie/plugin.yaml @@ -1,5 +1,5 @@ name: genie -version: 5.260725.8 +version: 5.260725.10 description: "Native Hermes surface for Genie orchestration: read-only status plus work-plan and review-plan gap tools that the MCP board surface does not cover, hooks, commands, and a thin cockpit skill. Board/task truth comes from the genie MCP tools." provides_tools: # Default surface: exactly the three gap tools the MCP board surface does not cover. From ee0f02cad455e51c60dcacd53849ea07ee1bf532 Mon Sep 17 00:00:00 2001 From: Genie Date: Sat, 25 Jul 2026 20:06:05 -0300 Subject: [PATCH 3/3] fix(release): pin upload-artifact to a SHA that exists MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit release-publish.yml pinned actions/upload-artifact to b7c4aadc2c921a8ff42c1c6b0e8950fc060e7c7e, which resolves to no commit in actions/upload-artifact. Every job using it failed immediately with 'Unable to resolve action', taking down Build canonical delivery descriptors, Independent candidate security gate, and Require complete Codex native dogfood matrix on v5.260725.10 — the first release to reach those jobs at all. Replaced with ea165f8d65b6e75b540449e92b4886f43607fa02, the real v4 tag, matching the existing '# v4' comment and the download-artifact v4 pin already used in the same file. Audited every pinned action across all workflows and composite actions against the GitHub API: 10 unique pins, this was the only unresolvable one. --- .github/workflows/release-publish.yml | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/.github/workflows/release-publish.yml b/.github/workflows/release-publish.yml index 6687eb53f..ffb6c31af 100644 --- a/.github/workflows/release-publish.yml +++ b/.github/workflows/release-publish.yml @@ -324,7 +324,7 @@ jobs: } >> "$GITHUB_OUTPUT" - name: Upload manifest-derived native dogfood matrix - uses: actions/upload-artifact@b7c4aadc2c921a8ff42c1c6b0e8950fc060e7c7e # v4 + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 with: name: codex-dogfood-candidate-matrix path: candidate-dogfood-matrix.json @@ -332,7 +332,7 @@ jobs: retention-days: 30 - name: Upload exact verified previous-stable inputs - uses: actions/upload-artifact@b7c4aadc2c921a8ff42c1c6b0e8950fc060e7c7e # v4 + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 with: name: codex-dogfood-previous-release path: previous-release @@ -340,7 +340,7 @@ jobs: retention-days: 30 - name: Upload exact candidate manifest bytes - uses: actions/upload-artifact@b7c4aadc2c921a8ff42c1c6b0e8950fc060e7c7e # v4 + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 with: name: delivery-candidate-manifests path: candidate-manifests/.well-known/*.json @@ -348,7 +348,7 @@ jobs: retention-days: 1 - name: Upload canonical descriptor subjects - uses: actions/upload-artifact@b7c4aadc2c921a8ff42c1c6b0e8950fc060e7c7e # v4 + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 with: name: delivery-descriptors path: descriptors/*.delivery.json @@ -393,7 +393,7 @@ jobs: cp "$BUNDLE_PATH" "${DESCRIPTOR}.sigstore.json" - name: Upload persisted endorsement - uses: actions/upload-artifact@b7c4aadc2c921a8ff42c1c6b0e8950fc060e7c7e # v4 + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 with: name: delivery-endorsement-${{ matrix.channel }}-${{ matrix.platform }} path: descriptors/*.sigstore.json @@ -607,7 +607,7 @@ jobs: --inputs-root dogfood-entry - name: Upload exact per-entry evidence and referenced inputs - uses: actions/upload-artifact@b7c4aadc2c921a8ff42c1c6b0e8950fc060e7c7e # v4 + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 with: name: codex-dogfood-evidence-${{ matrix.platform }} path: dogfood-entry @@ -686,7 +686,7 @@ jobs: --output aggregate/codex-dogfood-completeness.json - name: Upload complete Codex dogfood evidence - uses: actions/upload-artifact@b7c4aadc2c921a8ff42c1c6b0e8950fc060e7c7e # v4 + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 with: name: codex-dogfood-completeness path: aggregate/codex-dogfood-completeness.json @@ -908,7 +908,7 @@ jobs: ' security-gate/verified/*.json > security-gate/stable-release-security-gate.json - name: Upload independent security evidence - uses: actions/upload-artifact@b7c4aadc2c921a8ff42c1c6b0e8950fc060e7c7e # v4 + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 with: name: stable-release-security-gate path: security-gate/stable-release-security-gate.json