3 Commits

Include renames

Author	SHA1	Message	Date
gaebal-gajae	57f11ddbed	ci: pin all third-party GitHub Actions to immutable commit SHAs ... - actions/checkout: v4 → 11d5960a326750d5838078e36cf38b85af677262 - actions/setup-python: v5 → a26af69be951a213d495a4c3e4e4022e16d87065 - actions/upload-artifact: v4 → ea165f8d65b6e75b540449e92b4886f43607fa02 - dtolnay/rust-toolchain: stable → 686976e191b89faba57d3206551f0f330d8cb249 - Swatinem/rust-cache: v2 → 49a0bdc70d2e1b713ca9e2869b211fcce03d3c1c - softprops/action-gh-release: v2 → 3bb12739c298aeb8a4eeaf626c5b8d85266b0e65 Improves supply chain security by pinning Actions to specific commits instead of mutable tag references, preventing unexpected behavior changes if action maintainers update tags. Fixes #3287	2026-10-12 22:05:06 +00:00
bellmanandOmX	7d859ae8a2	Close Windows release artifact verification gap ... G009 Stream 8 acceptance requires a Windows release artifact quickstart with checksum evidence, not just source-build docs. Add Windows release asset packaging and make the release-readiness check assert the workflow/docs contract. Constraint: Stream 8 requires release artifact quickstart with checksums and no-credential smoke paths. Rejected: Documenting a future Windows asset without workflow support | would leave acceptance unverifiable. Confidence: high Scope-risk: narrow Tested: python3 .github/scripts/check_release_readiness.py; python3 .github/scripts/check_doc_source_of_truth.py; git diff --check Not-tested: actual GitHub release workflow execution on windows-latest. Co-authored-by: OmX <omx@oh-my-codex.dev>	2026-05-15 10:52:29 +09:00
Yeachan-Heo	bc061ad10f	Add tagged binary release workflow	2026-04-05 18:11:25 +00:00