From 41690395e46f5f156b710fb86da11fe3b1e943be Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Sat, 18 Jul 2026 14:54:31 +0000 Subject: [PATCH 1/2] chore(main): release quota-axi 0.1.7 --- .release-please-manifest.json | 2 +- CHANGELOG.md | 17 +++++++++++++++++ package.json | 2 +- 3 files changed, 19 insertions(+), 2 deletions(-) diff --git a/.release-please-manifest.json b/.release-please-manifest.json index 0f24e47..55c86c8 100644 --- a/.release-please-manifest.json +++ b/.release-please-manifest.json @@ -1,3 +1,3 @@ { - ".": "0.1.6" + ".": "0.1.7" } diff --git a/CHANGELOG.md b/CHANGELOG.md index 107b569..ddeebf8 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,5 +1,22 @@ # Changelog +## [0.1.7](https://github.com/ruby-dlee/quota-axi/compare/quota-axi-v0.1.6...quota-axi-v0.1.7) (2026-07-18) + + +### Features + +* harden managed provider isolation ([54dae3a](https://github.com/ruby-dlee/quota-axi/commit/54dae3a3003a59d5e9ce1ddc482621f45ca65604)) +* honor Claude config homes in quota reads ([3da0054](https://github.com/ruby-dlee/quota-axi/commit/3da00546704a9d1fa03e166aba800dd63ecd2a1d)) +* **providers:** isolate managed Claude and Codex profiles ([962844a](https://github.com/ruby-dlee/quota-axi/commit/962844a52d611c5366fa535582fb72029dcd029c)) + + +### Bug Fixes + +* **claude:** bind Keychain reads to exact account ([9943b39](https://github.com/ruby-dlee/quota-axi/commit/9943b39d5fa3a786a742a3306192fa00500b2ae2)) +* **claude:** bind Keychain reads to exact macOS account ([d61cbcf](https://github.com/ruby-dlee/quota-axi/commit/d61cbcfcec08a79f5f48654b9bafd5e346c770da)) +* **claude:** emit exact Keychain account ([b1b313c](https://github.com/ruby-dlee/quota-axi/commit/b1b313ce85c1fb7e4eae41a313db59ef01beefcd)) +* **render:** expose Keychain account in TOON ([a704a73](https://github.com/ruby-dlee/quota-axi/commit/a704a73b4792d7ef782b1283496f1c570ce9e1ae)) + ## [0.1.6](https://github.com/kunchenguid/quota-axi/compare/quota-axi-v0.1.5...quota-axi-v0.1.6) (2026-07-17) diff --git a/package.json b/package.json index eda8e9a..878c224 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "quota-axi", - "version": "0.1.6", + "version": "0.1.7", "packageManager": "pnpm@11.1.1", "description": "AXI CLI that reports local agent-provider quota windows without routing or mutation", "type": "module", From 385e598c4b7f9fd32075e6daba15b50a1b4e1af5 Mon Sep 17 00:00:00 2001 From: Dongkeun Lee Date: Sat, 18 Jul 2026 11:29:29 -0400 Subject: [PATCH 2/2] fix(ci): allow verified manual release PRs --- .github/workflows/guard-generated-files.yml | 42 ++++++++++++++++++++- 1 file changed, 41 insertions(+), 1 deletion(-) diff --git a/.github/workflows/guard-generated-files.yml b/.github/workflows/guard-generated-files.yml index 0071366..d1dbc82 100644 --- a/.github/workflows/guard-generated-files.yml +++ b/.github/workflows/guard-generated-files.yml @@ -18,7 +18,9 @@ jobs: name: Generated files must not be hand-edited runs-on: ubuntu-latest # release-please owns CHANGELOG.md and .release-please-manifest.json; its PR - # is the one legitimate place those files change, so we exempt its author. + # is the one legitimate place those files change. The repository owner can + # also submit that generated commit through no-mistakes when Actions PR + # creation is disabled, so the script verifies that manual release path. if: >- github.event.pull_request.user.login != 'github-actions[bot]' && github.event.pull_request.user.login != 'release-please[bot]' @@ -33,10 +35,44 @@ jobs: env: BASE_SHA: ${{ github.event.pull_request.base.sha }} HEAD_SHA: ${{ github.event.pull_request.head.sha }} + PR_AUTHOR: ${{ github.event.pull_request.user.login }} + PR_BODY: ${{ github.event.pull_request.body }} + PR_TITLE: ${{ github.event.pull_request.title }} + REPOSITORY_OWNER: ${{ github.repository_owner }} run: | set -eu files=$(git diff --name-only "${BASE_SHA}...${HEAD_SHA}") + is_verified_manual_release() { + [ "$PR_AUTHOR" = "$REPOSITORY_OWNER" ] || return 1 + case "$PR_TITLE" in + "chore: release quota-axi "*) ;; + *) return 1 ;; + esac + printf '%s' "${PR_BODY:-}" | grep -qF -- \ + 'Updates from [git push no-mistakes](https://github.com/kunchenguid/no-mistakes)' || return 1 + + release_commit=$(git rev-list --reverse "${BASE_SHA}..${HEAD_SHA}" | sed -n '1p') + [ -n "$release_commit" ] || return 1 + [ "$(git show -s --format=%P "$release_commit")" = "$BASE_SHA" ] || return 1 + [ "$(git show -s --format=%ae "$release_commit")" = \ + '41898282+github-actions[bot]@users.noreply.github.com' ] || return 1 + case "$(git show -s --format=%s "$release_commit")" in + "chore(main): release quota-axi "*) ;; + *) return 1 ;; + esac + + release_files=$(git diff-tree --no-commit-id --name-only -r "$release_commit" | LC_ALL=C sort) + expected_release_files=$(printf '%s\n' \ + .release-please-manifest.json CHANGELOG.md package.json | LC_ALL=C sort) + [ "$release_files" = "$expected_release_files" ] || return 1 + + # CI-fix commits may follow the generated commit, but the immutable + # release outputs themselves must remain byte-for-byte unchanged. + git diff --quiet "$release_commit" "$HEAD_SHA" -- \ + .release-please-manifest.json CHANGELOG.md package.json + } + violated="" for path in CHANGELOG.md .release-please-manifest.json; do if printf '%s\n' "$files" | grep -qxF -- "$path"; then @@ -50,6 +86,10 @@ jobs: done if [ -n "$violated" ]; then + if is_verified_manual_release; then + echo "Verified repository-owner release PR raised through no-mistakes. OK." + exit 0 + fi { echo "::error::This PR modifies release-please-generated files:${violated}" echo