From 717d558067fe7e20dd007674b606d0f41aa2b648 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Sat, 3 Oct 2026 07:42:37 +0000 Subject: [PATCH 1/4] chore: pin Squad CLI activation to 1.0.0 Refs #1825 --- docs/src/content/docs/guide/gh-aw.md | 2 +- workflows/shared/squad.md | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/docs/src/content/docs/guide/gh-aw.md b/docs/src/content/docs/guide/gh-aw.md index ce1703e1a..9b67cc987 100644 --- a/docs/src/content/docs/guide/gh-aw.md +++ b/docs/src/content/docs/guide/gh-aw.md @@ -671,7 +671,7 @@ Squad from npm. Set a repository variable to select a specific standalone releas | Variable | Purpose | Default | |----------|---------|---------| -| `SQUAD_CLI_VERSION` | Standalone GitHub Release tag to install during activation | `v0.13.1` | +| `SQUAD_CLI_VERSION` | Standalone GitHub Release tag to install during activation | `v1.0.0` | Set it in **Settings → Secrets and variables → Actions → Variables**. A value without the leading `v` is accepted for compatibility with older configurations. diff --git a/workflows/shared/squad.md b/workflows/shared/squad.md index 2b45d4de6..783a02a33 100644 --- a/workflows/shared/squad.md +++ b/workflows/shared/squad.md @@ -22,7 +22,7 @@ # SQUAD_GITHUB_TOKEN > github.token. # # Optional custom Squad CLI version: vars.SQUAD_CLI_VERSION. -# Default is v0.13.1. +# Default is v1.0.0. # This is a GitHub Release tag whose standalone assets are installed without # npm; values without a leading `v` are normalized for older configs. # @@ -493,7 +493,7 @@ jobs: - name: Resolve Squad standalone release id: squad-release env: - SQUAD_CLI_VERSION: ${{ vars.SQUAD_CLI_VERSION || 'v0.13.1' }} + SQUAD_CLI_VERSION: ${{ vars.SQUAD_CLI_VERSION || 'v1.0.0' }} run: | set -euo pipefail release_tag="${SQUAD_CLI_VERSION}" From a5f9145bf6961b43f1b3a0b1355d25b1663bdb55 Mon Sep 17 00:00:00 2001 From: Copilot Date: Sat, 3 Oct 2026 11:31:44 +0300 Subject: [PATCH 2/4] chore: regenerate stale gh-aw package workflows for v1.0.0 default Rebasing onto updated dev picked up the v0.13.1 -> v1.0.0 SQUAD_CLI_VERSION default bump; regenerate the derived package/*.md and manifest digests via npm run gh-aw:integrity:write so the integrity check passes. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --- workflows/package/squad-deps-worker.md | 2 +- workflows/package/squad-implement-worker.md | 2 +- workflows/package/squad-retro.md | 2 +- workflows/package/squad.md | 2 +- workflows/squad-workflows.manifest.json | 26 ++++++++++----------- 5 files changed, 17 insertions(+), 17 deletions(-) diff --git a/workflows/package/squad-deps-worker.md b/workflows/package/squad-deps-worker.md index 68f1ddd72..db5c14079 100644 --- a/workflows/package/squad-deps-worker.md +++ b/workflows/package/squad-deps-worker.md @@ -603,7 +603,7 @@ jobs: - name: Resolve Squad standalone release id: squad-release env: - SQUAD_CLI_VERSION: ${{ vars.SQUAD_CLI_VERSION || 'v0.13.1' }} + SQUAD_CLI_VERSION: ${{ vars.SQUAD_CLI_VERSION || 'v1.0.0' }} run: | set -euo pipefail release_tag="${SQUAD_CLI_VERSION}" diff --git a/workflows/package/squad-implement-worker.md b/workflows/package/squad-implement-worker.md index b05bb05dd..5912e4ed1 100644 --- a/workflows/package/squad-implement-worker.md +++ b/workflows/package/squad-implement-worker.md @@ -738,7 +738,7 @@ jobs: - name: Resolve Squad standalone release id: squad-release env: - SQUAD_CLI_VERSION: ${{ vars.SQUAD_CLI_VERSION || 'v0.13.1' }} + SQUAD_CLI_VERSION: ${{ vars.SQUAD_CLI_VERSION || 'v1.0.0' }} run: | set -euo pipefail release_tag="${SQUAD_CLI_VERSION}" diff --git a/workflows/package/squad-retro.md b/workflows/package/squad-retro.md index 117481230..36301c569 100644 --- a/workflows/package/squad-retro.md +++ b/workflows/package/squad-retro.md @@ -723,7 +723,7 @@ jobs: - name: Resolve Squad standalone release id: squad-release env: - SQUAD_CLI_VERSION: ${{ vars.SQUAD_CLI_VERSION || 'v0.13.1' }} + SQUAD_CLI_VERSION: ${{ vars.SQUAD_CLI_VERSION || 'v1.0.0' }} run: | set -euo pipefail release_tag="${SQUAD_CLI_VERSION}" diff --git a/workflows/package/squad.md b/workflows/package/squad.md index 7aea66ac1..208ee76a6 100644 --- a/workflows/package/squad.md +++ b/workflows/package/squad.md @@ -668,7 +668,7 @@ jobs: - name: Resolve Squad standalone release id: squad-release env: - SQUAD_CLI_VERSION: ${{ vars.SQUAD_CLI_VERSION || 'v0.13.1' }} + SQUAD_CLI_VERSION: ${{ vars.SQUAD_CLI_VERSION || 'v1.0.0' }} run: | set -euo pipefail release_tag="${SQUAD_CLI_VERSION}" diff --git a/workflows/squad-workflows.manifest.json b/workflows/squad-workflows.manifest.json index 62b8b131b..d8a96720e 100644 --- a/workflows/squad-workflows.manifest.json +++ b/workflows/squad-workflows.manifest.json @@ -14,18 +14,18 @@ "source": "workflows/package/squad.md", "destination": ".github/workflows/squad.md", "lock": ".github/workflows/squad.lock.yml", - "source_sha256": "450e9d3d7ef1b173cedd054d89e72700d8545406bd1fe0acd813d5ed76e04e91", - "lock_sha256": "c5d6e1b7a42e7f4b7dd748ae59c762d08acba9f20e0d6328290eec72e5358717", - "package_lock_sha256": "d0688be3e9492288091c103bd55d6e2845f4541f9e6915db2d4a84e488d4b763" + "source_sha256": "13410dac23af6144454e29a7fbf697fe7808fd30d2c848a1d3887cc822fdf3f0", + "lock_sha256": "a34fc39cae668ec2dd6fdae615110ec8d270a910b293c6a49bb3b3ab4b175f67", + "package_lock_sha256": "b7d60a96cf9251bfe2ca30274d523618b0495f903bb187518c4e3c0e026732ac" }, { "name": "squad-implement-worker", "source": "workflows/package/squad-implement-worker.md", "destination": ".github/workflows/squad-implement-worker.md", "lock": ".github/workflows/squad-implement-worker.lock.yml", - "source_sha256": "40067547110aa4c3186091265a2d77a1f05b8e1c0cca92a274470838d12e1ec3", - "lock_sha256": "11610f64c32403acb69b8f111f0fe584572a0e715bcb53eccaa5bd0cacaa57b5", - "package_lock_sha256": "c6b34a8ae8e9848bbc964a0ca73080ab9c06a9b9238de860954f84f0ba1bf5d7" + "source_sha256": "8ad749285633009e5f51d5d2bf61f2e9a916a89f4ad652a67948f8242c86c84b", + "lock_sha256": "826e8ae57f71a1feda39cab749dbaba959f3e0f9fbe31248ba60f1134edc35ee", + "package_lock_sha256": "a6832e5cc8b6c5a1c688fdd2e172d479cdf84f1a9edc5cc574595f642126972c" }, { "name": "squad-review", @@ -41,18 +41,18 @@ "source": "workflows/package/squad-deps-worker.md", "destination": ".github/workflows/squad-deps-worker.md", "lock": ".github/workflows/squad-deps-worker.lock.yml", - "source_sha256": "8057ff2e4cb2a6be55da43092397a890880fb94cadfe8d0dd15766dd22f1fe9e", - "lock_sha256": "31ece8146cf21ca5aec2880fd5daa01b982f037a961d3fd0b7c50a6eb3893dd4", - "package_lock_sha256": "59f035683a2b2dbecabdb685ff8280b05c4a081cf3d934a1f77591902b8e83a1" + "source_sha256": "1ff0e1553c25647182b51ea0462c245e1a0b6e24da1de7739e7dbbe8ed9b766b", + "lock_sha256": "238010921a3acae1336c999e23e786d08fbfc343e1c4f69c463f03dd649898ab", + "package_lock_sha256": "04322d836ef81f1512038ef3c5118ea507e82c49325c9d3371db62ea1cc9879e" }, { "name": "squad-retro", "source": "workflows/package/squad-retro.md", "destination": ".github/workflows/squad-retro.md", "lock": ".github/workflows/squad-retro.lock.yml", - "source_sha256": "8d7e1fdd5fa337da8208832b1cc7c6dbfd253dde2c1b45a7f68a805eb9025620", - "lock_sha256": "41fe367f5391eea781a0045adff8cb5039a689123b5b1798367a0078e19073e9", - "package_lock_sha256": "19933818ea4a2a89040e9e12706f80b56e6b6d6e53925f92c66f88d99676184f" + "source_sha256": "bd788f921eed90bebc16ee18527c457ac51e8e5a32a1295ca7ee0c0fbbf025ce", + "lock_sha256": "f5dfa3fc2000710f2a3d4dd40443c46926d1f09a556e88c2fe1ef9c91cf55e3b", + "package_lock_sha256": "baa17a0f571f2e821e6d204e8b4edf98687da62d95ed6e22923fff20fd6a9367" }, { "name": "squad-improvement-worker", @@ -161,7 +161,7 @@ "package_destination": ".github/aw/squad/runtime/shared/squad.md", "destination": ".github/workflows/shared/squad.md", "ownership": "manifest", - "sha256": "4cddc662ecd98f9fcd8e8623e908a2bd1a75c30c12bbcf98e3ad26db93135a66" + "sha256": "8c36f9dd49d5a2e9dcbeaa40f4f38659c427950a362ac1f8efeb6405944860ce" }, { "path": "shared/squad-planning-ontology.md", From 42c056545694ad607425acf45649e16834cf02b1 Mon Sep 17 00:00:00 2001 From: Copilot Date: Sat, 3 Oct 2026 11:34:17 +0300 Subject: [PATCH 3/4] docs: fix remaining v0.13.1 reference in gh-aw activation walkthrough Addresses copilot-pull-request-reviewer finding: the activation guide's job-1 walkthrough still cited the old default at line 2032. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --- docs/src/content/docs/guide/gh-aw.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/src/content/docs/guide/gh-aw.md b/docs/src/content/docs/guide/gh-aw.md index 9b67cc987..50299fb82 100644 --- a/docs/src/content/docs/guide/gh-aw.md +++ b/docs/src/content/docs/guide/gh-aw.md @@ -2029,7 +2029,7 @@ Understanding the two-job architecture helps when debugging. The activation job runs with full network access: 1. Optionally mints a GitHub App installation token -2. Resolves `SQUAD_CLI_VERSION` (default `v0.13.1`) and downloads the matching +2. Resolves `SQUAD_CLI_VERSION` (default `v1.0.0`) and downloads the matching standalone GitHub Release bundle with checksum verification — no npm install 3. Preserves a committed team with roster entries, or runs `squad init --preset default --state-backend local` when no usable team exists From 1a244eacb56ba8f2e59bf941640e9544829ba7df Mon Sep 17 00:00:00 2001 From: Copilot App <223556219+Copilot@users.noreply.github.com> Date: Sat, 3 Oct 2026 14:00:29 +0300 Subject: [PATCH 4/4] test: regenerate stale compiled-digest literals for v1.0.0 activation pin The strict-compile canonical-package-integrity contract tests assert hardcoded SHA256 digests of the compiled .github/workflows/squad.lock.yml content. workflows/shared/squad.md and workflows/package/squad.md (this PR's version bump) change the compiled lock content, which changes those digests. Regenerate the two hardcoded literals (workflow and package source-binding variants) to the values the real gh-aw compiler now produces, as surfaced by the failing hosted CI run: https://github.com/bradygaster/squad/actions/runs/37110298788/job/111166743943 - workflow binding: c86cd65d...5d6bd6 -> e59431b2...fb9a95 - package binding: 206fcc93...e5065a -> 919f1c77...ce71de No workflow/runtime source changed here; only the test's expected digest literals were stale relative to this PR's own content change. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --- test/gh-aw-quality.test.ts | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/test/gh-aw-quality.test.ts b/test/gh-aw-quality.test.ts index b7bd77950..035363c64 100644 --- a/test/gh-aw-quality.test.ts +++ b/test/gh-aw-quality.test.ts @@ -4001,8 +4001,8 @@ describe('gh-aw: canonical package integrity contract', () => { expect(mutable).not.toContain(actionReference); expect(createHash('sha256').update(normalizeCompiledLock(mutable, revisionA)).digest('hex')) .toBe(sourceBinding === 'workflow' - ? 'c86cd65d09ee74d8da4dfec27f64ccba818d22f282c5a4acf33f04e04f5d6bd6' - : '206fcc936e5c03e81928565104bc7b2fef9c492f9e8152b17df563bd07e5065a'); + ? 'e59431b2a2fa9872287449df5cb779c11ce4361206397c181047051446fb9a95' + : '919f1c77ee340bda1ca79d3e1c513fc2ddb2f3d89428133691e2b62699ce71de'); expect(() => validateCompilerActionPins(mutable)).toThrow(/invalid immutable action pin/); writeFileSync(lockPath, mutable); expect(verifyInstall(root).failures.join('\n')) @@ -4056,7 +4056,7 @@ describe('gh-aw: canonical package integrity contract', () => { compile(); const unpinned = readText(lockPath); expect(createHash('sha256').update(normalizeCompiledLock(unpinned, revisionA)).digest('hex')) - .toBe('206fcc936e5c03e81928565104bc7b2fef9c492f9e8152b17df563bd07e5065a'); + .toBe('919f1c77ee340bda1ca79d3e1c513fc2ddb2f3d89428133691e2b62699ce71de'); expect(verifyInstall(root).failures.join('\n')).toContain('Installed digest mismatch'); const seedPins = () => spawnSync(process.execPath, ['--input-type=module', '-e', seed!], {