chore(release): 0.1.0 on the released plugin SDK 0.2.0

CHANGELOG.md

@@ -8,6 +8,21 @@ release (RELEASING.md).
 
 ## [Unreleased]
 
+## [0.1.0] - 2026-11-07
+
+The first release, on npm's `latest` dist-tag. Experimental: QAuth loads it
+only with `PLUGIN_API_ENABLED=true`, and its plugin API may change before
+QAuth 1.0.
+
+### Changed
+
+- For QAuth 0.2.0 and later on the 0.2 line. The plugin depends on the
+  released `@qauth-labs/plugin-sdk` `0.2.0` instead of its release candidate
+  `0.2.0-rc.1`. The AuthMethod contract is unchanged,
+  `qauth-auth-method/1-rc.0`.
+- The end-to-end suite runs against QAuth's released `0.2.0` server and
+  migration-runner images, pinned by digest.
+
 ## [0.1.0-rc.0]
 
 The first release candidate. Experimental: QAuth loads it only with
@@ -37,5 +52,6 @@ The first release candidate. Experimental: QAuth loads it only with
 - A release workflow that stages the package on npm through trusted
   publishing, for a maintainer's approval with 2FA.
 
-[Unreleased]: https://github.com/qauth-labs/plugin-github/compare/v0.1.0-rc.0...HEAD
+[Unreleased]: https://github.com/qauth-labs/plugin-github/compare/v0.1.0...HEAD
+[0.1.0]: https://github.com/qauth-labs/plugin-github/compare/v0.1.0-rc.0...v0.1.0
 [0.1.0-rc.0]: https://github.com/qauth-labs/plugin-github/releases/tag/v0.1.0-rc.0

README.md

@@ -20,6 +20,7 @@ and has its own version line.
 
 | Plugin       | QAuth server                    | AuthMethod contract        | Plugin SDK   |
 | ------------ | ------------------------------- | -------------------------- | ------------ |
+| `0.1.0`      | `0.2.0` and later on `0.2`      | `qauth-auth-method/1-rc.0` | `0.2.0`      |
 | `0.1.0-rc.0` | `0.2.0-rc.1` and later on `0.2` | `qauth-auth-method/1-rc.0` | `0.2.0-rc.1` |
 
 ## How it signs a person in
@@ -88,7 +89,7 @@ would need a real account.
 
 ## Install it (operators)
 
-You need QAuth `0.2.0-rc.1` or later, and an image you build on top of
+You need QAuth `0.2.0` or later, and an image you build on top of
 QAuth's released one.
 
 ### 1. Register the app on GitHub
@@ -118,13 +119,13 @@ your build context, without installing anything:
 mkdir plugins && cd plugins
 npm init --yes > /dev/null
 npm install --package-lock-only --save-exact --omit=dev --omit=peer \
-  --install-strategy=nested --ignore-scripts @qauth-labs/plugin-github@0.1.0-rc.0
+  --install-strategy=nested --ignore-scripts @qauth-labs/plugin-github@0.1.0
 ```
 
 Read `package-lock.json` and commit both files. Then:
 
 ```dockerfile
-ARG QAUTH_IMAGE=ghcr.io/qauth-labs/qauth/auth-server:0.2.0-rc.1@sha256:<digest>
+ARG QAUTH_IMAGE=ghcr.io/qauth-labs/qauth/auth-server:0.2.0@sha256:<digest>
 
 # The build stage writes the files the server will run: pin it by digest too.
 FROM node:26-alpine@sha256:<digest> AS plugin

e2e/Dockerfile

@@ -7,7 +7,7 @@
 # without its peer dependencies, so it uses the server's zod, and without
 # install scripts. An operator installs a released version from a lockfile
 # with `npm ci`; this test installs the tarball it has just packed.
-ARG QAUTH_IMAGE=ghcr.io/qauth-labs/qauth/auth-server:0.2.0-rc.1@sha256:a4b199c5b1e896346d09c348f0a6cb055ab4f64bf82e0654740b0aa2631e5e8c
+ARG QAUTH_IMAGE=ghcr.io/qauth-labs/qauth/auth-server:0.2.0@sha256:8e3ffac13decc059b5dc8c0ba9cc3f9f9331718fb74771f65364688d83aff705
 
 FROM node:26-alpine@sha256:c6ad9e9c1d80f6eb607c26b4b0a132ff7a2344fad1c78ea3baa2a7d4c8de6d94 AS plugin
 WORKDIR /plugin

e2e/compose.yml

@@ -85,7 +85,7 @@ services:
       retries: 30
 
   migrate:
-    image: ghcr.io/qauth-labs/qauth/migration-runner:0.2.0-rc.1@sha256:d4c47545e04b1fd78f16146ffd8e20f02983722d20a71ffbfde4c4c8c95599f6
+    image: ghcr.io/qauth-labs/qauth/migration-runner:0.2.0@sha256:4393d4cc7aad293f37c3c4a10ffefca9cde2e8792db43885b80b1fe19030ebe4
     environment:
       DATABASE_URL: postgres://qauth:qauth@postgres:5432/qauth
     depends_on:

package.json

@@ -1,6 +1,6 @@
 {
   "name": "@qauth-labs/plugin-github",
-  "version": "0.1.0-rc.0",
+  "version": "0.1.0",
   "description": "GitHub sign-in for QAuth, as an AuthMethod plugin: OAuth 2.0 with PKCE and GitHub's user API, keyed by the numeric GitHub user id. Experimental.",
   "keywords": [
     "qauth",
@@ -51,7 +51,7 @@
     "prepack": "pnpm run build"
   },
   "dependencies": {
-    "@qauth-labs/plugin-sdk": "0.2.0-rc.1"
+    "@qauth-labs/plugin-sdk": "0.2.0"
   },
   "peerDependencies": {
     "zod": "^4.6.7"

pnpm-workspace.yaml

@@ -9,9 +9,9 @@
 minimumReleaseAge: 10080
 minimumReleaseAgeExclude:
   # QAuth's plugin SDK, provenance-signed by qauth-labs/qauth's release-npm
-  # workflow at tag v0.2.0-rc.1: the contract this plugin is written against.
-  # Published 2026-11-05T09:17:29Z: remove after 2026-11-12T09:18Z.
-  - '@qauth-labs/plugin-sdk@0.2.0-rc.1'
+  # workflow at tag v0.2.0: the contract this plugin is written against.
+  # Published 2026-11-07T15:46:24Z: remove after 2026-11-14T15:47Z.
+  - '@qauth-labs/plugin-sdk@0.2.0'
 
 # Never auto-install before a script runs; warn when node_modules is stale.
 verifyDepsBeforeRun: warn