Daniel Anderson 45c51c8e48 Bump to 1.0.18: drop release attestations, make asset bytes version-unique ... Three releases (1.0.13, 1.0.16, 1.0.17) failed Obsidian's review with "attestation exists but signature is invalid or does not match this repository" despite trying attest-build-provenance v1, v2, and actions/attest v4. Decoding the actual published bundles via the attestations API shows they are well-formed sigstore v0.3 bundles whose Fulcio certificates correctly identify this repo and workflow — the verification failure is on the checker's side and not fixable from here. Since a present-but-unverifiable attestation is a review Error while a missing one is only a Recommendation, the attest step is removed (comment in the workflow explains why, so it doesn't get re-added blindly). Attestations are permanent and keyed by file digest, and source didn't change across 1.0.13-1.0.17, so the old broken attestations still cover the current main.js/styles.css bytes. To escape them: - esbuild now emits a version-stamped banner comment in main.js (also makes installed copies identifiable) - styles.css header comment gains the repo URL Verified via the API that the new digests have zero attestations.		2026-07-17 11:52:46 +10:00
..
release.yml	Bump to 1.0.18: drop release attestations, make asset bytes version-unique	2026-07-17 11:52:46 +10:00