Skip to content

Release Channel Verification

This page records clean-consumer verification evidence for the public BoardReadyOps consumption channels. The current contract is version-derived and kept synchronized by release:readme; timestamped verification snapshots are immutable evidence and are not rewritten by release bumps.

Current status: The latest public release is boardreadyops@1.33.0 on npm and the v1.33.0 GitHub Release. The exact release tag and floating v1 tag point to the same reviewed release commit. Stable GHCR aliases are expected to resolve to the same multi-architecture image index.

Current Release Contract

Surface Current contract
Public release v1.33.0
npm package boardreadyops@1.33.0 (latest)
Binary assets Linux x64/arm64, macOS x64/arm64, Windows x64, SHA256SUMS, and sbom.cyclonedx.json
Root Action Pin a reviewed release commit SHA for reproducibility; v1 is a moving convenience alias
Container Action Pin the same reviewed release commit SHA; its image aliases are release-managed
Container aliases v1.33.0, v1, and latest
Homebrew formula Repository formula must use the exact release version and SHA256SUMS values; external tap publication is a separate maintainer concern

Run the deterministic repository freshness check on every change:

corepack pnpm run verify:public-surface

For a live public-channel audit after publication, run:

BOARDREADY_VERIFY_PUBLIC_CHANNELS=1 corepack pnpm run verify:release-channels

Verified Public Snapshot — v1.30.1 (2026-08-07)

The following evidence was re-read from the public channels on 2026-08-07. It is intentionally a timestamped snapshot rather than a mutable source of truth.

Field Verified value
Release tag commit 884f5fa31f8fd701693c533747c69eb7d13f5464
Floating v1 tag commit 884f5fa31f8fd701693c533747c69eb7d13f5464
Recommended immutable root/container Action pin 884f5fa31f8fd701693c533747c69eb7d13f5464 (v1.30.1)
npm integrity sha512-e3jI4/cdXC30v8LlKYy0VCCU3Uu0DNLpnvL1k4lIaBfRiYMzbsIGjUviU/jihTQb8KTocEDJJvptwrkrA3UPPA==
npm shasum 2ae9023901c2ca41ad08771e14a4fb361b1db8d1
npm engines ^22.14.0 || ^24.0.0
GitHub Release Published 2026-08-05; non-draft and non-prerelease
Release assets Seven expected assets are present
SHA256SUMS digest sha256:90be0ca72010506a3b895db251130ff0708eed120fb2f6a969a55018ebae1ee8
sbom.cyclonedx.json digest sha256:4850654f935fccfed965ef47f4b0d66433e5be69d5b0f682542d4011bee834ea
Anonymous GHCR index sha256:4df163600bd03126f072a5870db33f72db9991bf932fe275b5858e54f73fc650
GHCR linux/amd64 manifest sha256:7e3bdc889fb0a0e9555b88c0271eabd7eb7a9b28999a9d003dc1f253e5d03242
GHCR linux/arm64 manifest sha256:6f750af4eafb6ec92d50f3990bb1f4d6e96cd33a6c627aa4654e57e649ab8483

v1.30.1 Verification Matrix

Channel Result Evidence
npm metadata Pass Registry version and latest both resolve to 1.30.1; the published engines match the repository contract.
npm clean consumer Pass npm exec --package=boardreadyops@1.30.1 -- boardreadyops --version returned 1.30.1 from a temporary non-repository directory.
GitHub Release Pass v1.30.1 targets the verified release commit and exposes exactly seven expected assets with SHA-256 digests.
Linux x64 binary Pass The downloaded asset matched its SHA256SUMS entry and --version returned 1.30.1.
Action pin Pass The v1.30.1 release commit is Verified and the current action.yml, container Action metadata, and Action input contract have not changed since that release.
GHCR aliases Pass Anonymous docker buildx imagetools inspect resolved v1.30.1, v1, and latest to the same OCI index with linux/amd64 and linux/arm64 manifests.
Homebrew formula Pass for repository formula Version and four macOS/Linux checksums match the v1.30.1 release. External tap publication was not asserted.

v1.30.1 Release Artifact List

Artifact SHA-256
boardreadyops-linux-x64 c1515abbdafab8e46e63feb65e3c9899babf51e256a4e8ed128046539bd1b520
boardreadyops-linux-arm64 a546c1a4339b32f26000c916471fb8f5dfc007c47ff4c88116a28356f213eca8
boardreadyops-macos-x64 411b083dd6c2ab675404cdd8e5f62d1c1371b4b3e5825c8409ed0464514c4034
boardreadyops-macos-arm64 6f9d1d9f3cc04c4380f7ccfb8ccecd58bf9ea8c4b473f2b78b39308ef9c1ba7f
boardreadyops-win-x64.exe 36ec06910e51b4b0557eedb14740b470327523ec3614fd8f55f4a60d9744d61b
SHA256SUMS 90be0ca72010506a3b895db251130ff0708eed120fb2f6a969a55018ebae1ee8
sbom.cyclonedx.json 4850654f935fccfed965ef47f4b0d66433e5be69d5b0f682542d4011bee834ea

Historical Audit Target

Field Value
Audit date 2026-05-28
Public release v1.1.0
Release URL https://github.com/oaslananka/boardreadyops/releases/tag/v1.1.0
Release tag commit 41856e44bb2fc5def47a71072eccdad307301fc4
npm package boardreadyops@1.1.0
npm tarball https://registry.npmjs.org/boardreadyops/-/boardreadyops-1.1.0.tgz
npm integrity sha512-fN0zRcKP1/fqW0/wYknBr+nh5HhZ7udpcfZoSqyNuRvinCdmvbQO9kOz/yG4KrqeHSzXuk0iMT5Fuw/YtchngQ==
npm shasum c358e9cc8dd4cb5d63e466d1602cd901ad62d24b
npm engines for public package ^22.0.0 || ^24.0.0
GHCR image index ghcr.io/oaslananka/boardreadyops-full:v1.1.0@sha256:5258e7de0e25382894c70164e990820f78a7fdfce92453932e2f75d51728934b
Audit hosts Windows 11 with Node.js v24.18.0 and KiCad CLI 10.0.3; Docker Linux probes with node:22-bookworm-slim and node:24-bookworm-slim

Pass/Fail Matrix

Channel Result Evidence Follow-up
npm metadata Pass npm view boardreadyops@1.1.0 reports version 1.1.0, latest dist-tag 1.1.0, engines ^22.0.0 || ^24.0.0, CLI bin dist/cli/index.cjs, and the integrity listed above. None
npm clean install on Windows 11 Pass A temporary prefix install ran boardreadyops --version, boardreadyops doctor --format json, boardreadyops schema config, and boardreadyops check . --fail-on never from a separate consumer directory. JSON, SARIF, Markdown, HTML, and JUnit reports were generated. None
npm clean install on Linux, Node 24 Pass node:24-bookworm-slim installed boardreadyops@1.1.0, reported Node v24.18.0, npm 11.13.0, CLI version 1.1.0, valid doctor JSON check groups, schema entries for html and junit, and all five report outputs. None
npm clean install on Linux, Node 22 Pass node:22-bookworm-slim installed boardreadyops@1.1.0, reported Node v22.22.3, npm 10.9.8, CLI version 1.1.0, valid doctor JSON check groups, and all five report outputs. None
npm tarball contents Pass (historical) npm pack boardreadyops@1.1.0 produced boardreadyops-1.1.0.tgz with dist/, schemas/, docs/, action.yml, and kicad-plugin/metadata.json, plugin Python files, and icon resources. kicad-plugin/ has since been retired (commit 68e21df). None
Public tag archive contents Pass (historical) git ls-tree -r --name-only v1.1.0 -- kicad-plugin lists metadata.json, plugins/__init__.py, plugins/boardreadyops_plugin.py, and resources/icon.png. kicad-plugin/ has since been retired. None
Public package parity with current docs Pass The public package accepts boardreadyops doctor --format json, accepts report.html and report.junit.xml in config, generates JSON, SARIF, Markdown, HTML, and JUnit reports. kicad-plugin/ was included at v1.1.0 and has since been retired from main. None
GitHub Release binary asset list Pass gh release view v1.1.0 lists Linux x64, Linux arm64, macOS x64, macOS arm64, Windows x64, SHA256SUMS, and sbom.cyclonedx.json assets. BOARD-63 for installer OS matrix and Homebrew checksums.
GHCR full container image Partial Manual container-build run 26543611642 published v1.1.0, v1, and latest to the same OCI index digest sha256:5258e7de0e25382894c70164e990820f78a7fdfce92453932e2f75d51728934b; docker buildx imagetools inspect shows linux/amd64 and linux/arm64; a runtime probe returned BoardReadyOps 1.1.0 and KiCad CLI 10.0.3. BOARD-64 for explicit anonymous logout validation and clean container Action workflow evidence.
Homebrew formula Partial Formula/boardreadyops.rb still contains fail-closed checksum placeholders. BOARD-63
KiCad PCM publication Retired The kicad-plugin/ package was present in npm and the tag archive at v1.1.0 but was removed from main in commit 68e21df. The PCM plugin integration test and CLI profile have been retired. KiCad PCM distribution is no longer planned. None

Tested Release Artifact List

Artifact Status
boardreadyops@1.1.0 npm package Present and clean-consumer tested on Windows 11 plus Linux Node 22 and 24
oaslananka/boardreadyops@41856e44bb2fc5def47a71072eccdad307301fc4 root action Present in public tag archive
GitHub Release v1.1.0 assets Seven assets present: five binaries, SHA256SUMS, and sbom.cyclonedx.json
boardreadyops-linux-x64 Present, digest sha256:d0d07dd0d34e1bf2f748449d7603345b9533068cb6730bf5a52cd432f1805e65
boardreadyops-linux-arm64 Present, digest sha256:664c52b4ab8a31e34a21b9e0fb5c5968a5ab0915826ee949286f462d281a09c1
boardreadyops-macos-x64 Present, digest sha256:1bd9e914f848ee0086c5cd3e2823117e28f5b3409a766ed0c6cfa7a736ffb2f0
boardreadyops-macos-arm64 Present, digest sha256:8b28c9d68d02390b8873b788efd0d94cd06c92a9dc956cff596de6b2fdc7ae85
boardreadyops-win-x64.exe Present, digest sha256:e849be5213b1c1973c36d424a487a325b3e69e6744cff43e89c9120f3a6ce7fe
SHA256SUMS Present, digest sha256:71657f4731259c30354f7d22fc841d03a321fc522020776a1c1ed9903a7129e0
sbom.cyclonedx.json Present, digest sha256:c42813ec33eff55f0a267cdb38f8245ea51cd3f256acf53c56ea8e9ac4428eb9
ghcr.io/oaslananka/boardreadyops-full:v1.1.0 Present, OCI index digest sha256:5258e7de0e25382894c70164e990820f78a7fdfce92453932e2f75d51728934b
ghcr.io/oaslananka/boardreadyops-full:v1 Present, same OCI index digest as v1.1.0
ghcr.io/oaslananka/boardreadyops-full:latest Present, same OCI index digest as v1.1.0
Formula/boardreadyops.rb Template only; checksum placeholders remain
kicad-plugin/ public package artifact Retired. Present at v1.1.0; removed from main in commit 68e21df.

Terminal Transcript Summary

$ npm view boardreadyops@1.1.0 version dist-tags engines bin dist.tarball dist.integrity --json
version: 1.1.0
dist-tags.latest: 1.1.0
engines.node: ^22.0.0 || ^24.0.0
bin.boardreadyops: dist/cli/index.cjs
integrity: sha512-fN0zRcKP1/fqW0/wYknBr+nh5HhZ7udpcfZoSqyNuRvinCdmvbQO9kOz/yG4KrqeHSzXuk0iMT5Fuw/YtchngQ==
$ npm pack boardreadyops@1.1.0
filename: boardreadyops-1.1.0.tgz
shasum: c358e9cc8dd4cb5d63e466d1602cd901ad62d24b
total files: 106
included: package/dist/action/index.cjs, package/dist/cli/index.cjs,
package/schemas/config.schema.json, package/docs/release/channel-verification.md,
package/action.yml
$ boardreadyops --version
1.1.0
$ boardreadyops doctor --format json
tool.version: 1.1.0
checks: runtime,kicad,adapters,repository,suppressions,action
$ boardreadyops check . --fail-on never
generated: findings.json, findings.sarif.json, report.md, report.html, report.junit.xml
$ docker buildx imagetools inspect ghcr.io/oaslananka/boardreadyops-full:v1.1.0
Digest: sha256:5258e7de0e25382894c70164e990820f78a7fdfce92453932e2f75d51728934b
Platforms: linux/amd64, linux/arm64
$ docker run --rm --entrypoint boardreadyops ghcr.io/oaslananka/boardreadyops-full:v1.1.0 --version
1.1.0
$ docker run --rm --entrypoint kicad-cli ghcr.io/oaslananka/boardreadyops-full:v1.1.0 version
10.0.3
$ gh run view 26543611642
workflow: container-build
conclusion: success
jobs: smoke (KiCad 9.0, Node 22.22.3), smoke (KiCad 10.0, Node 24.18.0), publish
artifact: boardreadyops-full-cyclonedx

Completion Rule

The current public surface is considered synchronized only when the deterministic verify:public-surface check passes and the live public-channel verifier confirms that npm latest, the GitHub Release/tag, expected release assets and digests, the reviewed immutable Action pin, and GHCR stable aliases agree. Timestamped historical audits and verified snapshots remain unchanged for traceability.