Fix release tooling for community-directory scorecard

- Move obsidian to a pinned devDependency (1.12.3); it was a "latest"
  runtime dependency but esbuild externalizes it, so it is types-only.
  A "latest" spec also forced a registry lookup that broke the
  scorecard's build verification in its sandbox.
- Stop uploading versions.json as a release asset; Obsidian only
  downloads main.js/manifest.json/styles.css.
- Attest build provenance for main.js and manifest.json.
- Add CONTRIBUTING.md.
- Bump to 1.0.1.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

.github/workflows/release.yml

@@ -7,6 +7,8 @@ on:
 
 permissions:
   contents: write
+  id-token: write
+  attestations: write
 
 jobs:
   build:
@@ -38,6 +40,13 @@ jobs:
           fi
           echo "Tag and manifest agree on version $TAG_VERSION"
 
+      - name: Attest build provenance
+        uses: actions/attest-build-provenance@v2
+        with:
+          subject-path: |
+            main.js
+            manifest.json
+
       - name: Create Release
         uses: softprops/action-gh-release@v2
         with:
@@ -47,4 +56,3 @@ jobs:
           files: |
             main.js
             manifest.json
-            versions.json

CONTRIBUTING.md

@@ -0,0 +1,35 @@
+# Contributing
+
+Thanks for your interest in improving Canvas Drag Fix.
+
+## Reporting bugs
+
+Open an issue with:
+
+- Your OS, and whether Obsidian runs in a VM, container, or bare metal.
+- The output of the pointer-event snippet in the README's "How to verify the
+  bug applies to you" section.
+- Which Canvas interactions are broken versus working.
+
+## Development
+
+```sh
+npm install
+npm run dev    # rebuilds main.js on change
+```
+
+Load the plugin into a test vault under
+`<vault>/.obsidian/plugins/canvas-drag-fix/`. The Hot Reload community plugin
+picks up rebuilds without restarting Obsidian.
+
+## Before opening a pull request
+
+- Run `npm run lint && npm run build`; both must exit clean.
+- Keep the change focused on the pointer-type workaround — this plugin is
+  deliberately small and single-purpose.
+- Describe the setup you tested on, since the bug is environment-specific.
+
+## License
+
+By contributing you agree your contributions are licensed under 0BSD, the same
+license as the project.

manifest.json

@@ -1,10 +1,10 @@
 {
 	"id": "canvas-drag-fix",
 	"name": "Canvas Drag Fix",
-	"version": "1.0.0",
+	"version": "1.0.1",
 	"minAppVersion": "1.0.0",
 	"description": "Fixes Canvas drag-and-drop on Linux when Chromium misclassifies the mouse as a pen device. Common in VMware/VirtualBox guests, ChromeOS Crostini, and some Wayland setups.",
 	"author": "an2",
 	"authorUrl": "https://github.com/an2io",
 	"isDesktopOnly": true
-}
+}

package-lock.json

@@ -1,16 +1,13 @@
 {
-	"name": "canvas-pointer-fix",
-	"version": "1.0.0",
+	"name": "canvas-drag-fix",
+	"version": "1.0.1",
 	"lockfileVersion": 3,
 	"requires": true,
 	"packages": {
 		"": {
-			"name": "canvas-pointer-fix",
-			"version": "1.0.0",
+			"name": "canvas-drag-fix",
+			"version": "1.0.1",
 			"license": "0BSD",
-			"dependencies": {
-				"obsidian": "latest"
-			},
 			"devDependencies": {
 				"@eslint/js": "9.30.1",
 				"@types/node": "^16.11.6",
@@ -18,6 +15,7 @@
 				"eslint-plugin-obsidianmd": "0.1.9",
 				"globals": "14.0.0",
 				"jiti": "2.6.1",
+				"obsidian": "1.12.3",
 				"tslib": "2.4.0",
 				"typescript": "^5.8.3",
 				"typescript-eslint": "8.35.1"
@@ -27,6 +25,7 @@
 			"version": "6.5.0",
 			"resolved": "https://registry.npmjs.org/@codemirror/state/-/state-6.5.0.tgz",
 			"integrity": "sha512-MwBHVK60IiIHDcoMet78lxt6iw5gJOGSbNbOIVBHWVXIH4/Nq1+GQgLLGgI1KlnN86WDXsPudVaqYHKBIx7Eyw==",
+			"dev": true,
 			"license": "MIT",
 			"peer": true,
 			"dependencies": {
@@ -37,6 +36,7 @@
 			"version": "6.38.6",
 			"resolved": "https://registry.npmjs.org/@codemirror/view/-/view-6.38.6.tgz",
 			"integrity": "sha512-qiS0z1bKs5WOvHIAC0Cybmv4AJSkAXgX5aD6Mqd2epSLlVJsQl8NG23jCVouIgkh4All/mrbdsf2UOLFnJw0tw==",
+			"dev": true,
 			"license": "MIT",
 			"peer": true,
 			"dependencies": {
@@ -713,6 +713,7 @@
 			"version": "1.0.2",
 			"resolved": "https://registry.npmjs.org/@marijn/find-cluster-break/-/find-cluster-break-1.0.2.tgz",
 			"integrity": "sha512-l0h88YhZFyKdXIFNfSWpyjStDjGHwZ/U7iobcK1cQQD8sejsONdQtTVU+1wVN1PBw40PiiHB1vA5S7VTfQiP9g==",
+			"dev": true,
 			"license": "MIT",
 			"peer": true
 		},
@@ -816,6 +817,7 @@
 			"version": "5.60.8",
 			"resolved": "https://registry.npmjs.org/@types/codemirror/-/codemirror-5.60.8.tgz",
 			"integrity": "sha512-VjFgDF/eB+Aklcy15TtOTLQeMjTo07k7KAjql8OK5Dirr7a6sJY4T1uVBDuTVG9VEmn1uUsohOpYnVfgC6/jyw==",
+			"dev": true,
 			"license": "MIT",
 			"dependencies": {
 				"@types/tern": "*"
@@ -836,6 +838,7 @@
 			"version": "1.0.8",
 			"resolved": "https://registry.npmjs.org/@types/estree/-/estree-1.0.8.tgz",
 			"integrity": "sha512-dWHzHa2WqEXI/O1E9OjrocMTKJl2mSrEolh1Iomrv6U+JuNwaHXsXx9bLu5gG7BUWFIN0skIQJQ/L1rIex4X6w==",
+			"dev": true,
 			"license": "MIT"
 		},
 		"node_modules/@types/json-schema": {
@@ -863,6 +866,7 @@
 			"version": "0.23.9",
 			"resolved": "https://registry.npmjs.org/@types/tern/-/tern-0.23.9.tgz",
 			"integrity": "sha512-ypzHFE/wBzh+BlH6rrBgS5I/Z7RD21pGhZ2rltb/+ZrVM1awdZwjx7hE5XfuYgHWk9uvV5HLZN3SloevCAp3Bw==",
+			"dev": true,
 			"license": "MIT",
 			"dependencies": {
 				"@types/estree": "*"
@@ -1513,6 +1517,7 @@
 			"version": "1.0.6",
 			"resolved": "https://registry.npmjs.org/crelt/-/crelt-1.0.6.tgz",
 			"integrity": "sha512-VQ2MBenTq1fWZUH9DJNGti7kKv6EeAuYr3cLwxUWhIu1baTaXh4Ib5W2CqHVqib4/MqbYGJqiL3Zb8GJZr3l4g==",
+			"dev": true,
 			"license": "MIT",
 			"peer": true
 		},
@@ -3730,6 +3735,7 @@
 			"version": "2.29.4",
 			"resolved": "https://registry.npmjs.org/moment/-/moment-2.29.4.tgz",
 			"integrity": "sha512-5LC9SOxjSc2HF6vO2CyuTDNivEdoz2IvyJJGj6X8DJ0eFyfszE0QiEd+iXmBvUP3WHxSjFH/vIsA0EN00cgr8w==",
+			"dev": true,
 			"license": "MIT",
 			"engines": {
 				"node": "*"
@@ -3905,6 +3911,7 @@
 			"version": "1.12.3",
 			"resolved": "https://registry.npmjs.org/obsidian/-/obsidian-1.12.3.tgz",
 			"integrity": "sha512-HxWqe763dOqzXjnNiHmAJTRERN8KILBSqxDSEqbeSr7W8R8Jxezzbca+nz1LiiqXnMpM8lV2jzAezw3CZ4xNUw==",
+			"dev": true,
 			"license": "MIT",
 			"dependencies": {
 				"@types/codemirror": "5.60.8",
@@ -4645,6 +4652,7 @@
 			"version": "4.1.3",
 			"resolved": "https://registry.npmjs.org/style-mod/-/style-mod-4.1.3.tgz",
 			"integrity": "sha512-i/n8VsZydrugj3Iuzll8+x/00GH2vnYsk1eomD8QiRrSAeW6ItbCQDtfXCeJHd0iwiNagqjQkvpvREEPtW3IoQ==",
+			"dev": true,
 			"license": "MIT",
 			"peer": true
 		},
@@ -4968,6 +4976,7 @@
 			"version": "2.2.8",
 			"resolved": "https://registry.npmjs.org/w3c-keyname/-/w3c-keyname-2.2.8.tgz",
 			"integrity": "sha512-dpojBhNsCNN7T82Tm7k26A6G9ML3NkhDsnw9n/eoxSRlVBB4CEtIQ/KTCLI2Fwf3ataSXRhYFkQi3SlnFwPvPQ==",
+			"dev": true,
 			"license": "MIT",
 			"peer": true
 		},

package.json

@@ -1,6 +1,6 @@
 {
 	"name": "canvas-drag-fix",
-	"version": "1.0.0",
+	"version": "1.0.1",
 	"description": "Fixes Canvas drag-and-drop on Linux when Chromium misclassifies the mouse as a pen device.",
 	"main": "main.js",
 	"type": "module",
@@ -27,11 +27,9 @@
 		"eslint-plugin-obsidianmd": "0.1.9",
 		"globals": "14.0.0",
 		"jiti": "2.6.1",
+		"obsidian": "1.12.3",
 		"tslib": "2.4.0",
 		"typescript": "^5.8.3",
 		"typescript-eslint": "8.35.1"
-	},
-	"dependencies": {
-		"obsidian": "latest"
 	}
 }

versions.json

@@ -1,3 +1,4 @@
 {
-	"1.0.0": "1.0.0"
-}
+	"1.0.0": "1.0.0",
+	"1.0.1": "1.0.0"
+}