v1.2.0

Highlights

• add remediation guidance to pinact workflow when SHA pinning fails
• adopt npm Trusted Publishing in reusable release workflow (no more NPM_TOKEN secret)
• ensure npm 11.5.1+ before running changesets publish
• document OIDC requirements for downstream repositories

Required Action

• register the release workflow + environment as a Trusted Publisher in npm before publishing

Verification

• pinact run --check

v1.1.0

Highlights

• add pinact validation workflow to enforce full-length commit SHAs
• repin reusable workflows and composite action to immutable commits
• document pinning policy and local act commands for pinact
• harden workflow permissions and disable persisted checkout credentials

Verification

• act -j pinact -W .github/workflows/pinact.yml --container-architecture linux/amd64

v1.0.0

Initial stable release of reusable CI workflows.

Highlights

• Reusable workflows: lint (Biome), test (Vitest), typecheck (TypeScript), release (Changesets)
• Internal composite action: setup-bun (relative reference for GitHub and act)
• PR-time static checks: actionlint via reviewdog
• Docs: AGENTS.md contributor guide and enriched README
• Local dev: actrc.example for Apple Silicon defaults

Notes

• Consumers should use (latest v1.x) or pin to
• release.yml requires NPM_TOKEN in the consumer repository