From 468031134c74a7dcd50f8815904c572e5926c7f2 Mon Sep 17 00:00:00 2001 From: StringKE Date: Wed, 12 Aug 2026 21:51:05 +0400 Subject: [PATCH] chore(release): configure git-cliff for v0.0.1 Signed-off-by: StringKE --- .github/workflows/release.yml | 71 ++++++++++++++ .mise.toml | 1 + CHANGELOG.md | 169 ++++++++++++++++------------------ cliff.toml | 77 ++++++++++++++++ package.json | 3 +- 5 files changed, 231 insertions(+), 90 deletions(-) create mode 100644 .github/workflows/release.yml create mode 100644 cliff.toml diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml new file mode 100644 index 00000000..5717cc21 --- /dev/null +++ b/.github/workflows/release.yml @@ -0,0 +1,71 @@ +name: Release + +on: + push: + tags: + - 'v*.*.*' + +permissions: + contents: write + +jobs: + release: + name: GitHub Release + runs-on: ubuntu-latest + timeout-minutes: 10 + steps: + # actions/checkout v6.0.1 + - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 + with: + fetch-depth: 0 + + - name: Validate annotated SemVer tag + shell: bash + run: | + set -euo pipefail + if [[ ! "$GITHUB_REF_NAME" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]]; then + echo "Unsupported release tag: $GITHUB_REF_NAME" >&2 + exit 1 + fi + test "$(git cat-file -t "refs/tags/$GITHUB_REF_NAME")" = "tag" + package_version="$(node -p \ + "JSON.parse(require('node:fs').readFileSync('package.json', 'utf8')).version")" + test "$GITHUB_REF_NAME" = "v$package_version" + grep -F "## [$package_version]" CHANGELOG.md + + # orhun/git-cliff-action v4.8.0, running git-cliff v2.13.1 + - name: Generate release notes + id: git-cliff + uses: orhun/git-cliff-action@f50e11560dce63f7c33227798f90b924471a88b5 + with: + version: v2.13.1 + config: cliff.toml + args: --current --strip all --verbose + github_token: ${{ secrets.GITHUB_TOKEN }} + env: + OUTPUT: RELEASE_NOTES.md + GITHUB_REPO: ${{ github.repository }} + + - name: Validate release notes + shell: bash + run: | + set -euo pipefail + test -s RELEASE_NOTES.md + grep -F "## [${GITHUB_REF_NAME#v}]" RELEASE_NOTES.md + + - name: Create GitHub Release + env: + GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} + shell: bash + run: | + set -euo pipefail + if gh release view "$GITHUB_REF_NAME" >/dev/null 2>&1; then + echo "GitHub Release $GITHUB_REF_NAME already exists" + exit 0 + fi + # No build, package publication, container, or custom release asset is produced here. + gh release create "$GITHUB_REF_NAME" \ + --verify-tag \ + --title "$GITHUB_REF_NAME" \ + --notes-file RELEASE_NOTES.md \ + --latest diff --git a/.mise.toml b/.mise.toml index b7d3c332..5cf1191e 100644 --- a/.mise.toml +++ b/.mise.toml @@ -3,5 +3,6 @@ # 不用 prettier/eslint:代码质量走 vite-plus 内置 oxlint(lint)+ oxfmt(format),见根 vite.config.ts。 [tools] +git-cliff = "2.13.1" node = "24.15.0" pnpm = "10.33.4" diff --git a/CHANGELOG.md b/CHANGELOG.md index f71ce47b..d6ca57d4 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -5,100 +5,91 @@ All notable changes to this project are documented in this file. The format is based on [Keep a Changelog 1.1.0](https://keepachangelog.com/en/1.1.0/), and this project adheres to [Semantic Versioning 2.0.0](https://semver.org/spec/v2.0.0.html). -## Versioning +This file is generated by [git-cliff](https://github.com/orhun/git-cliff) from Conventional Commits. +Run `pnpm changelog --tag vX.Y.Z` to prepare a release; do not edit it by hand. -| Situation | Identifier | -| --------- | ---------- | -| Pre-release development on `main` | Git **commit SHA** (unique per revision). Root `package.json` remains `0.0.0` until the first tagged release. | -| Published release | Annotated git tag `vMAJOR.MINOR.PATCH` (SemVer), matching a GitHub Release and a CHANGELOG section. | -| Public API stability | Unstable until 1.0.0; breaking changes may land without a long deprecation window while pre-1.0. | - -When a release is cut: add a dated `## [X.Y.Z] - YYYY-MM-DD` section, move items out of -`[Unreleased]`, and tag the repository. Every published release is identified in version control by -that tag. - -### Security entries - -Every **publicly known** vulnerability fixed in a release **must** be listed under a `### Security` -heading in that release’s notes (CVE or advisory URL when available). If a release has no security -fixes, omit the heading. Private reports that never became public need not be listed until -disclosure. - -OpenSSF Best Practices self-certification notes: [`docs/openssf-best-practices.md`](docs/openssf-best-practices.md). - -## [Unreleased] +## [0.0.1] - 2026-08-12 ### Security - -- No publicly disclosed vulnerability fixes in this period. -- Documented OpenSSF-aligned fix timelines (60-day public medium+ fixes, critical prioritization), - cryptography defaults, and static/dynamic analysis practices in `SECURITY.md`. - -### Changed - -- **License changed from Elastic License 2.0 to the MIT License.** XID is now open source under an - OSI-approved license. The Elastic License restrictions (no hosted service offering, no license key - circumvention, no removal of license notices) no longer apply. The only remaining obligation is to - retain the copyright and permission notice. -- Clarified versioning (commit SHA until first SemVer tag) and Security release-note rules in - `CHANGELOG.md`. -- Homepage footer and README community tables now link Support, Security, and Contributing for - feedback and contribution discovery. -- Project status copy no longer claims zero production evidence. It states pre-1.0 API instability, - live first-party L4 on `https://xid.dev`, and that external IdP/SaaS/social/SMS paths stay - non-production-supported until their L4 rows exist (`README*`, `SECURITY.md`, `SUPPORT.md`, site - home evidence blurb). +- **python:** Bump cryptography to 50.x for PKCS#7 oracle fix ([ac58bbb](https://github.com/StringKe/xid/commit/ac58bbb2b002f444f5437808a6586504d8c07750)) +- **deps:** Batch security and dependency upgrades ([0cc782c](https://github.com/StringKe/xid/commit/0cc782c062716e440d1424b74a15395a3d6edec3)) +- **deps:** Resolve all dependabot and audit security alerts ([9b2543f](https://github.com/StringKe/xid/commit/9b2543f29d21645e6911990fc7d94c35b7addf28)) +- **deps:** 修复 brace-expansion 高危依赖 ([7ccfaaa](https://github.com/StringKe/xid/commit/7ccfaaa5b9ac918c10b30654f5ef5d12b28e00bc)) +- **security:** 移除 RSA 漏洞依赖并修复 smoke ([0c68ee2](https://github.com/StringKe/xid/commit/0c68ee2d036821995e234c1bc970874a381eb2e1)) +- **security:** Address remote security checks ([06902db](https://github.com/StringKe/xid/commit/06902dbd9560a709d86225f0a61532838316d604)) +- **security:** Remediate repository security alerts ([31e1d1a](https://github.com/StringKe/xid/commit/31e1d1afbc76cc7c1e7b282a67a2ba88d468f899)) ### Added +- **site:** Launch localized product landing ([1faa63f](https://github.com/StringKe/xid/commit/1faa63f0e3c8eb5fffcc0c2daa8736534662d7a4)) +- **server:** Manage access requests and policy via v1 ([43f508f](https://github.com/StringKe/xid/commit/43f508f60bf6d23bea8c4f6972ae230429170e58)) +- **server:** Access request self-service and approval APIs ([a9c1ac1](https://github.com/StringKe/xid/commit/a9c1ac176c54cfb7270115c0612807a666f9e64f)) +- **server:** Enforce access policy in authorize ([8e2828d](https://github.com/StringKe/xid/commit/8e2828d9648c0dfbc17b0daf841a12ac90fcb4da)) +- **db:** Project access policy and access requests schema ([1e1b022](https://github.com/StringKe/xid/commit/1e1b022fadb44a4a1abf748c40eb7e1045147760)) +- **server:** Org units management API ([e73db5f](https://github.com/StringKe/xid/commit/e73db5f8fd1b8c7457c844545eeebcb58bdf990f)) +- **db:** Org unit tree service and queries ([8a0d761](https://github.com/StringKe/xid/commit/8a0d7615fb1550697a2f8923155d3ec0f10a4f17)) +- **db:** Add org_units and org_unit_members schema ([f00e5e4](https://github.com/StringKe/xid/commit/f00e5e4d55a94762f6ab189ac088c29cafb99c0a)) +- **react:** Add useUpgradeGuest hook ([d0e8173](https://github.com/StringKe/xid/commit/d0e8173a78175f3d8b8da28d828d7625b5c5ba1c)) +- **core:** Add guest passkey upgrade and silent re-authentication ([44a2619](https://github.com/StringKe/xid/commit/44a2619d86980070f39da1bc09241f86d3111f67)) +- **console:** Rebuild console and hosted auth flows on the shared design system ([ce94366](https://github.com/StringKe/xid/commit/ce9436601e771e17d0863a89e22e297002c8947a)) +- **platform:** Complete XID production readiness ([ffca608](https://github.com/StringKe/xid/commit/ffca60834c355ebb5e82d8da295b620f8c182dc9)) +- **auth:** Unify tenant onboarding and email verification ([81bdf03](https://github.com/StringKe/xid/commit/81bdf030ccd06fe23ec7600020664ca2a9f3e62d)) +- **web:** 统一 Nimbus 产品首页与 Workers Builds ([f41856f](https://github.com/StringKe/xid/commit/f41856f39a3ae96bb620adfdfb660addf8f2a34b)) +- Firebase 式访客模式(匿名登录与原地转正) (#25) ([995f65c](https://github.com/StringKe/xid/commit/995f65c6aae0bdc77e8a0fdbf0222f51143ce2d2)) +- Initial public release ([7c80167](https://github.com/StringKe/xid/commit/7c801679ee46862c450de34bf10dcb0169ba558a)) + +### Fixed +- **ci:** Format after comment purge and refresh translation markers ([760eb5a](https://github.com/StringKe/xid/commit/760eb5ab498a04424dff0ba8e67ff7fe7759b130)) +- **ci:** Align smoke with site landing routes ([a23a31a](https://github.com/StringKe/xid/commit/a23a31a40554d9ca836d199aead4aaea49a765f1)) +- **hosted-auth:** Restyle the guest conversion banner as a shell band ([bc1c5fe](https://github.com/StringKe/xid/commit/bc1c5fef497fd60294f0379554818b999c82e535)) +- **console:** Align entry states with the control-plane layout grammar ([a50e263](https://github.com/StringKe/xid/commit/a50e2639bb880d0efe7c82e0e9e94c8045d82c8b)) +- **hosted-auth:** Remove the serial wait before the guest entry appears ([94d4d2f](https://github.com/StringKe/xid/commit/94d4d2f97beaa12f9ad07938272375fac7caa687)) +- **tests:** Follow console trailing-slash redirect in wildcard route probe ([063f237](https://github.com/StringKe/xid/commit/063f23764cc1b06de8a3f0226aa53c0191210625)) +- **build:** Bootstrap workspace deps in app build scripts for Workers Builds ([0cb5bb7](https://github.com/StringKe/xid/commit/0cb5bb7880ce158a39fa7e805d8669a5499375e4)) +- **build:** Build workspace deps before check and test tasks ([ec805a5](https://github.com/StringKe/xid/commit/ec805a5d3d3c68f4ce2ea3ef31f731fe4515193b)) +- **ci:** 为浏览器 smoke 配置 Linux Chrome ([d34ae2b](https://github.com/StringKe/xid/commit/d34ae2b2ab36fabb218939e92497bbfd27ff084d)) +- **web:** 修复远端构建与安全检查 ([32ac45c](https://github.com/StringKe/xid/commit/32ac45c9631f669e825974dfee560d26596bbba3)) -- OpenSSF Best Practices Passing self-certification pack: - [`docs/openssf-best-practices.md`](docs/openssf-best-practices.md) with paste-ready Met/N/A - justifications for project 13783. -- Explicit Testing policy and warnings/static-analysis section in `CONTRIBUTING.md`. - -- Enterprise org structure (OrgUnit): an in-org business tree with adjacency plus materialized path - (depth cap 8), primary/secondary post placement, reporting-line manager resolution walking up the - ancestor chain, and nine Management API endpoints under `/v1/organizations/:orgId/units` (tree - CRUD, move, archive, members), guarded by the new `org-units` API key scope or an org manager - cookie session. OrgUnit carries no tenant-boundary semantics and never enters token claims. -- Project access requests with approval: per-project `access_policy` (`open`/`restricted`/ - `approval_required`) gating the same-org `/authorize` and token-issuance paths, self-service - `/auth/access-requests` and approver `/auth/access-approvals` session endpoints, approver - resolution (OrgUnit reporting line -> `project_manager` -> `org_manager`, self-approval skipped), - approval writing a `user_grants` row with `granted_via_request_id` and an optional `expires_at` - JIT window, read-only `/v1` access-request listing with the new `access-requests` scope, and the - audit events `access_request.created/approved/denied/cancelled/expired` plus - `project.access_policy_changed`. -- Guest one-click passkey upgrade in the SDKs: `@xid-kit/core` `upgradeGuestWithPasskey()` and - `@xid-kit/react` `useUpgradeGuest()` convert an anonymous (guest) session in place -- the passkey - ceremony attaches to the existing user and `sub` is preserved. Same-origin mode only; non-guest - callers and authenticator cancellation map to expected-failure Results. -- Silent re-authentication for OIDC browser applications: `@xid-kit/core` `signInSilent()` runs a - best-effort hidden-iframe `prompt=none` attempt and `signInSilentWithRedirect()` is the reliable - top-level redirect fallback. Silent authorization errors (`login_required`, `consent_required`, - `interaction_required`) map to expected-failure Results instead of throwing. -- Open source governance files: `CONTRIBUTING.md` (with DCO 1.1 sign-off), `CODE_OF_CONDUCT.md` - (Contributor Covenant 2.1), `SECURITY.md`, `SUPPORT.md`, issue and pull request templates, - `CODEOWNERS`, and Dependabot configuration. - -### Capability snapshot at first public commit - -Not a release entry. Recorded so that later changelog entries have a baseline. Every item below is -implemented and verified locally (evidence tiers L1-L3). L4 verification against real external -identity providers, downstream SaaS, social providers, and SMS or WhatsApp delivery is not complete -for any capability, so nothing here is production-supported. - -- Worker: 12 core OIDC/OAuth endpoints (the full route surface under `oidc/` and `oauth/` is larger - and includes 501 stubs), CIBA, federation, SAML inbound and outbound, SCIM 2.0 (Bulk, - ETag), legacy LDAP / WS-Fed / SWA / header auth, Management API under `/v1/*` -- Hosted UI: 12 auth page types, account portal (5 pages), organization console, platform console -- Kernel libraries: protocol, webauthn, crypto, saml, db, i18n, types -- 15 TypeScript SDKs: core, backend, react, nextjs, vue, nuxt, svelte, solid, angular, astro, remix, - react-native, expo, electron, tauri -- 13 native SDKs: Go, Rust, Python, Ruby, PHP, Java, .NET, iOS, macOS, Windows, Linux, Android, - Flutter. These are not published to any package registry. CI runs no language toolchain and none - of their test suites; `tests/native-sdk-contract.test.mjs` only asserts that every platform in the - contract matrix points at a directory that exists. -- i18n: 8 locales (en, zh-Hans, ja, ko, fr, de, es, pt-BR), catalogs fully translated +### Changed +- **web:** 将官网统一为 Nimbus 并隔离 Console ([9b0b37b](https://github.com/StringKe/xid/commit/9b0b37b723083817c35422e9a0af48dbde0a2d8d)) + +### Documentation +- **readme:** Correct project status for live L4 evidence (#61) ([0b722d6](https://github.com/StringKe/xid/commit/0b722d6d4c3bb85fe74db35b19a12632376f6b3e)) +- **security:** Complete OpenSSF Best Practices Passing evidence (#58) ([df3f696](https://github.com/StringKe/xid/commit/df3f6960b2151906e64cff312d428673fc9b86f1)) +- **readme:** Sync capabilities and launch badges (#42) ([7c48bb5](https://github.com/StringKe/xid/commit/7c48bb5ccb6c6e8d92eb85da4dbe581b55efebfd)) +- **design:** Sync access request model into chapters 02/03/06/08 ([5e20f04](https://github.com/StringKe/xid/commit/5e20f04bb0913ea4460efaf833abba48dac5b4a7)) +- **design:** Sync org unit model into chapters 02/08 ([751ce1f](https://github.com/StringKe/xid/commit/751ce1f8fe89af7c697322a9ffc6f86e4f1cbef2)) +- Record guest upgrade and silent re-auth in changelog and readme ([70156b1](https://github.com/StringKe/xid/commit/70156b19ecdfe39b73f32de5acb17836ddd9f5fd)) +- Repair broken markdown tables in protocol and SDK references ([e828336](https://github.com/StringKe/xid/commit/e8283360383cb8fabd91c4bc9754e202548b99b7)) +- **sdks:** Document guest upgrade and silent re-auth APIs in SDK references ([683a016](https://github.com/StringKe/xid/commit/683a0165b9347e1bf2ca294f65c60bbf4aadf9f9)) +- **design:** Add SDK guest one-click upgrade and silent re-auth transport ([b1ae477](https://github.com/StringKe/xid/commit/b1ae477af65dd54e1183e42f0e454830d3f178df)) +- **deployment:** Mark cloudflare security rules as reconciled ([458b785](https://github.com/StringKe/xid/commit/458b785d070993cd68bc50cbf883fd54a6309d1e)) +- **security:** 记录 OpenSSF 项目登记 ([d6c2169](https://github.com/StringKe/xid/commit/d6c21690f50c1b1e2c7176d0be7e3345232272f6)) +- **security:** 完成安全修复证据收尾 ([00a0014](https://github.com/StringKe/xid/commit/00a00148e8559861f9b6ab1c620d07754f8a8fec)) + +### Testing +- **server:** Access request end-to-end flow ([0aa39cd](https://github.com/StringKe/xid/commit/0aa39cd77b6a1011f2684cc4bfdfe41eb7c4521c)) +- **server:** Org unit isolation and guard coverage ([22f3d49](https://github.com/StringKe/xid/commit/22f3d493bbba6056624eb959b35449680dfae0bb)) +- **smoke:** Align console copy assertions with the shared page skeleton ([98cc53e](https://github.com/StringKe/xid/commit/98cc53ea3d205fb39c261f0d2875a71136953575)) +- **crypto:** Allow CI budget for property test ([9c4b3c3](https://github.com/StringKe/xid/commit/9c4b3c3fb364c3ee259cdae390f485ffe31a898d)) + +### Build +- **codeql:** Path-gate native language analysis on pull requests (#60) ([e42180f](https://github.com/StringKe/xid/commit/e42180f7f02cae244fbda3ce43033dbe541fcc10)) + +### Dependencies +- **deps:** Bump the gradle group in /sdk/android with 15 updates ([f177981](https://github.com/StringKe/xid/commit/f1779818d277c2aff1825a69f01f5dd380b35b93)) +- **deps:** Bump the nuget group with 4 updates ([286bdb4](https://github.com/StringKe/xid/commit/286bdb47ccd4d71cccc786e88d2dd80a5aabbac4)) +- **deps:** Bump the pub group in /sdk/flutter with 3 updates ([c0608ae](https://github.com/StringKe/xid/commit/c0608ae8fb062c906c7e93a013efad710ca379ba)) +- **deps:** Bump the cargo group across 2 directories with 8 updates ([6712bf2](https://github.com/StringKe/xid/commit/6712bf281cbe2fc777a3ef493ed72ed83c9c29df)) +- **deps:** Bump the pip group in /sdk/python with 8 updates ([bc5189f](https://github.com/StringKe/xid/commit/bc5189fa5c96699524a4a1e68eaa93f06ef282d3)) +- **deps:** Bump github.com/golang-jwt/jwt/v5 ([cc8c570](https://github.com/StringKe/xid/commit/cc8c570191301c2ab5d148a4f6b57543d514b736)) + +### Maintenance +- **gitignore:** Drop redundant patterns and clarify local AI ignore ([1706cd9](https://github.com/StringKe/xid/commit/1706cd9987ea804f0d85266ed4b8f110c40d14b6)) +- **comments:** Purge residual and compress verbose source comments ([532148b](https://github.com/StringKe/xid/commit/532148b64ae77ee5570921a19de28d4d813dda8b)) +- **db:** Format 0014 snapshot per vp check ([97a4029](https://github.com/StringKe/xid/commit/97a4029f5a4a6b1941a6f18078535e48000f5eab)) +- Retrigger workers builds after webhook loss ([b48d798](https://github.com/StringKe/xid/commit/b48d7984298e4c9428475d4856691d0b0c25d56d)) [Unreleased]: https://github.com/StringKe/xid/commits/main +[0.0.1]: https://github.com/StringKe/xid/releases/tag/v0.0.1 + + diff --git a/cliff.toml b/cliff.toml new file mode 100644 index 00000000..991fbc30 --- /dev/null +++ b/cliff.toml @@ -0,0 +1,77 @@ +# git-cliff configuration for repository releases. +# https://git-cliff.org/docs/configuration + +[changelog] +header = """ +# Changelog + +All notable changes to this project are documented in this file. + +The format is based on [Keep a Changelog 1.1.0](https://keepachangelog.com/en/1.1.0/), and this +project adheres to [Semantic Versioning 2.0.0](https://semver.org/spec/v2.0.0.html). + +This file is generated by [git-cliff](https://github.com/orhun/git-cliff) from Conventional Commits. +Run `pnpm changelog --tag vX.Y.Z` to prepare a release; do not edit it by hand.\n +""" +body = """ +{% if version -%} + ## [{{ version | trim_start_matches(pat="v") }}] - {{ timestamp | date(format="%Y-%m-%d") }} +{% else -%} + ## [Unreleased] +{% endif -%} + +{% for group, commits in commits | group_by(attribute="group") %} + ### {{ group | striptags | trim }}\n + {%- for commit in commits %} + - {% if commit.scope %}**{{ commit.scope }}:** {% endif -%} + {{ commit.message | upper_first | trim }} \ + ([{{ commit.id | truncate(length=7, end="") }}](https://github.com/StringKe/xid/commit/{{ commit.id }}))\ + {% endfor %} +{% endfor %}\n +""" +footer = """ +[Unreleased]: https://github.com/StringKe/xid/commits/main +{% for release in releases -%} + {% if release.version -%} + [{{ release.version | trim_start_matches(pat="v") }}]: \ + https://github.com/StringKe/xid/releases/tag/{{ release.version }} + {% endif -%} +{% endfor %} + +""" +trim = true + +[git] +conventional_commits = true +filter_unconventional = true +require_conventional = true +split_commits = false +protect_breaking_commits = true +filter_commits = false +fail_on_unmatched_commit = true +tag_pattern = '^v[0-9]+\.[0-9]+\.[0-9]+$' +topo_order = true +topo_order_commits = true +sort_commits = "newest" +commit_parsers = [ + { message = '^Merge ', skip = true }, + { message = '^chore\(release\)', skip = true }, + { message = '^revert', group = 'Reverted' }, + { message = '^fix\(security\)', group = 'Security' }, + { message = '^fix\(deps\)', group = 'Security' }, + { message = '^fix\(python\): bump cryptography', group = 'Security' }, + { message = '^feat', group = 'Added' }, + { message = '^fix', group = 'Fixed' }, + { message = '^perf', group = 'Performance' }, + { message = '^refactor', group = 'Changed' }, + { message = '^docs', group = 'Documentation' }, + { message = '^test', group = 'Testing' }, + { message = '^build', group = 'Build' }, + { message = '^ci', group = 'Build' }, + { message = '^chore\(deps\)', group = 'Dependencies' }, + { message = '^chore', group = 'Maintenance' }, + { message = '^style', group = 'Maintenance' }, +] +link_parsers = [ + { pattern = '#(\d+)', href = 'https://github.com/StringKe/xid/pull/$1' }, +] diff --git a/package.json b/package.json index f00777d6..ace207ea 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "xid", - "version": "0.0.0", + "version": "0.0.1", "private": true, "description": "XID is an open-source, edge-native identity platform on Cloudflare Workers: OIDC/OAuth provider, multi-tenant RBAC, enterprise SSO federation (SAML and SCIM) and passkey-first hosted auth UI.", "keywords": [ @@ -37,6 +37,7 @@ }, "type": "module", "scripts": { + "changelog": "git-cliff --output CHANGELOG.md", "dev": "turbo run dev --parallel", "build": "turbo run build", "check": "pnpm run sdk:distribution:contract && turbo run check && turbo run typecheck && pnpm run native:verify && pnpm run i18n:audit && pnpm run protocols:source-map && pnpm run docs:translations && pnpm run test:web-routes && pnpm run test:key-paths && pnpm run test:quality-gate && pnpm run test:release-contracts && pnpm run test:coverage-gate && pnpm run test:worker-coverage-gate",