v0.10.0

Features

• lock publish to OIDC and a protected GitHub Environment (#6)

v0.9.0

Features

• add verify-lifecycle-scripts gate for install-hook defence (#5)

v0.8.9

Bug Fixes

• create annotated tags so --follow-tags actually pushes them (release)

v0.8.8

Bug Fixes

• double tag-propagation retry budget to 60s (auto-release)

v0.8.7

Bug Fixes

• route reproducibility-mode input through env in the new validation step
• support subpath pattern exports and document anchor limitation
• validate reproducibility-mode input and tighten workflow consistency
• harden record-tarball filename validation and publish-npm diagnostics

v0.8.6

Bug Fixes

• wait for tag ref propagation before dispatching release

v0.8.5

Bug Fixes

• preserve non-blocking semantics of warn reproducibility-mode
• tighten changelog-extract to word-bounded version match and sanitise name in verify recipe
• serialise auto-release runs on the same branch
• harden npm pack JSON parse against prepack-script injection
• verify-action-pins parses quoted uses: lines correctly
• close reproduce-skipped bypass in strict mode

v0.8.4

Docs

• add no-warranty disclaimer near top of README for Marketplace listing

v0.8.3

Docs

• tighten action.yml description for Marketplace card display
• add sponsor badge and funding section
• add composite-action signpost in Quick start for Marketplace visitors

v0.8.2

Bug Fixes

• strip lifecycle-script stdout before parsing npm pack --json