diff --git a/CHANGELOG.md b/CHANGELOG.md index e325067..22f5140 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -8,6 +8,21 @@ release (RELEASING.md). ## [Unreleased] +## [0.1.0] - 2026-11-07 + +The first release, on npm's `latest` dist-tag. Experimental: QAuth loads it +only with `PLUGIN_API_ENABLED=true`, and its plugin API may change before +QAuth 1.0. + +### Changed + +- For QAuth 0.2.0 and later on the 0.2 line. The plugin depends on the + released `@qauth-labs/plugin-sdk` `0.2.0` instead of its release candidate + `0.2.0-rc.1`. The AuthMethod contract is unchanged, + `qauth-auth-method/1-rc.0`. +- The end-to-end suite runs against QAuth's released `0.2.0` server and + migration-runner images, pinned by digest. + ## [0.1.0-rc.0] The first release candidate. Experimental: QAuth loads it only with @@ -37,5 +52,6 @@ The first release candidate. Experimental: QAuth loads it only with - A release workflow that stages the package on npm through trusted publishing, for a maintainer's approval with 2FA. -[Unreleased]: https://github.com/qauth-labs/plugin-github/compare/v0.1.0-rc.0...HEAD +[Unreleased]: https://github.com/qauth-labs/plugin-github/compare/v0.1.0...HEAD +[0.1.0]: https://github.com/qauth-labs/plugin-github/compare/v0.1.0-rc.0...v0.1.0 [0.1.0-rc.0]: https://github.com/qauth-labs/plugin-github/releases/tag/v0.1.0-rc.0 diff --git a/README.md b/README.md index b75f5b8..e4221fe 100644 --- a/README.md +++ b/README.md @@ -20,6 +20,7 @@ and has its own version line. | Plugin | QAuth server | AuthMethod contract | Plugin SDK | | ------------ | ------------------------------- | -------------------------- | ------------ | +| `0.1.0` | `0.2.0` and later on `0.2` | `qauth-auth-method/1-rc.0` | `0.2.0` | | `0.1.0-rc.0` | `0.2.0-rc.1` and later on `0.2` | `qauth-auth-method/1-rc.0` | `0.2.0-rc.1` | ## How it signs a person in @@ -88,7 +89,7 @@ would need a real account. ## Install it (operators) -You need QAuth `0.2.0-rc.1` or later, and an image you build on top of +You need QAuth `0.2.0` or later, and an image you build on top of QAuth's released one. ### 1. Register the app on GitHub @@ -118,13 +119,13 @@ your build context, without installing anything: mkdir plugins && cd plugins npm init --yes > /dev/null npm install --package-lock-only --save-exact --omit=dev --omit=peer \ - --install-strategy=nested --ignore-scripts @qauth-labs/plugin-github@0.1.0-rc.0 + --install-strategy=nested --ignore-scripts @qauth-labs/plugin-github@0.1.0 ``` Read `package-lock.json` and commit both files. Then: ```dockerfile -ARG QAUTH_IMAGE=ghcr.io/qauth-labs/qauth/auth-server:0.2.0-rc.1@sha256: +ARG QAUTH_IMAGE=ghcr.io/qauth-labs/qauth/auth-server:0.2.0@sha256: # The build stage writes the files the server will run: pin it by digest too. FROM node:26-alpine@sha256: AS plugin diff --git a/e2e/Dockerfile b/e2e/Dockerfile index 685a582..06aafad 100644 --- a/e2e/Dockerfile +++ b/e2e/Dockerfile @@ -7,7 +7,7 @@ # without its peer dependencies, so it uses the server's zod, and without # install scripts. An operator installs a released version from a lockfile # with `npm ci`; this test installs the tarball it has just packed. -ARG QAUTH_IMAGE=ghcr.io/qauth-labs/qauth/auth-server:0.2.0-rc.1@sha256:a4b199c5b1e896346d09c348f0a6cb055ab4f64bf82e0654740b0aa2631e5e8c +ARG QAUTH_IMAGE=ghcr.io/qauth-labs/qauth/auth-server:0.2.0@sha256:8e3ffac13decc059b5dc8c0ba9cc3f9f9331718fb74771f65364688d83aff705 FROM node:26-alpine@sha256:c6ad9e9c1d80f6eb607c26b4b0a132ff7a2344fad1c78ea3baa2a7d4c8de6d94 AS plugin WORKDIR /plugin diff --git a/e2e/compose.yml b/e2e/compose.yml index 9dc751f..b06a40c 100644 --- a/e2e/compose.yml +++ b/e2e/compose.yml @@ -85,7 +85,7 @@ services: retries: 30 migrate: - image: ghcr.io/qauth-labs/qauth/migration-runner:0.2.0-rc.1@sha256:d4c47545e04b1fd78f16146ffd8e20f02983722d20a71ffbfde4c4c8c95599f6 + image: ghcr.io/qauth-labs/qauth/migration-runner:0.2.0@sha256:4393d4cc7aad293f37c3c4a10ffefca9cde2e8792db43885b80b1fe19030ebe4 environment: DATABASE_URL: postgres://qauth:qauth@postgres:5432/qauth depends_on: diff --git a/package.json b/package.json index f916537..aad906f 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "@qauth-labs/plugin-github", - "version": "0.1.0-rc.0", + "version": "0.1.0", "description": "GitHub sign-in for QAuth, as an AuthMethod plugin: OAuth 2.0 with PKCE and GitHub's user API, keyed by the numeric GitHub user id. Experimental.", "keywords": [ "qauth", @@ -51,7 +51,7 @@ "prepack": "pnpm run build" }, "dependencies": { - "@qauth-labs/plugin-sdk": "0.2.0-rc.1" + "@qauth-labs/plugin-sdk": "0.2.0" }, "peerDependencies": { "zod": "^4.6.7" diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 57fb0ee..093ef4d 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -167,8 +167,8 @@ importers: .: dependencies: '@qauth-labs/plugin-sdk': - specifier: 0.2.0-rc.1 - version: 0.2.0-rc.1(zod@4.6.7) + specifier: 0.2.0 + version: 0.2.0(zod@4.6.7) devDependencies: '@types/node': specifier: ^26.6.5 @@ -448,8 +448,8 @@ packages: cpu: [x64] os: [win32] - '@qauth-labs/plugin-sdk@0.2.0-rc.1': - resolution: {integrity: sha512-HzJdOkoteT1sd8y6iOQ0HVpdBNB1kNuSXQFlhu6CwS8ZEFgRN05Hrx+TLBzQagwig7fXGAQVxj37khOJbjxS/w==} + '@qauth-labs/plugin-sdk@0.2.0': + resolution: {integrity: sha512-K0F90c9aJ2u3f0gtZmPjBaovpae4FBD2wysv/etaTDukcs4cLT3JF+jtcXIqI9GGH6T2qfzLeZX3Cll7PyP/ow==} engines: {node: '>=22'} peerDependencies: zod: ^4.6.7 @@ -996,7 +996,7 @@ snapshots: '@oxlint/binding-win32-x64-msvc@1.88.0': optional: true - '@qauth-labs/plugin-sdk@0.2.0-rc.1(zod@4.6.7)': + '@qauth-labs/plugin-sdk@0.2.0(zod@4.6.7)': dependencies: zod: 4.6.7 diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml index 1d95b50..df36e9a 100644 --- a/pnpm-workspace.yaml +++ b/pnpm-workspace.yaml @@ -9,9 +9,9 @@ minimumReleaseAge: 10080 minimumReleaseAgeExclude: # QAuth's plugin SDK, provenance-signed by qauth-labs/qauth's release-npm - # workflow at tag v0.2.0-rc.1: the contract this plugin is written against. - # Published 2026-11-05T09:17:29Z: remove after 2026-11-12T09:18Z. - - '@qauth-labs/plugin-sdk@0.2.0-rc.1' + # workflow at tag v0.2.0: the contract this plugin is written against. + # Published 2026-11-07T15:46:24Z: remove after 2026-11-14T15:47Z. + - '@qauth-labs/plugin-sdk@0.2.0' # Never auto-install before a script runs; warn when node_modules is stale. verifyDepsBeforeRun: warn