From b1ff11c6872144df0122abea5b07a1df0b9172aa Mon Sep 17 00:00:00 2001 From: mpstaton Date: Mon, 18 May 2026 03:11:03 -0500 Subject: [PATCH] =?UTF-8?q?chore(release):=200.1.2=20=E2=80=94=20workflow-?= =?UTF-8?q?driven=20releases=20+=20artifact=20attestations=20+=20package.j?= =?UTF-8?q?son=20description=20alignment?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Three things bundled: 1. Release workflow at .github/workflows/release.yml fires on every 3-digit-semver tag push. Builds main.js + styles.css in a clean Ubuntu runner, signs all three release assets via actions/attest-build-provenance@v1 (sigstore-backed via OIDC), creates the GitHub Release with notes pulled from release-notes/.md. Identical to the workflow landing across cite-wide, image-gin, metafetch as a family-wide pattern. 2. release-notes/0.1.2.md authored in marketing-shape per content-farm/context-v/skills/changelog-conventions/SKILL.md "These are marketing artifacts" section. 3. package.json description aligned with manifest.json. Previous package.json text "A plugin for Obsidian that allows you to generate source-cited content..." still contained the bot-flagged "Obsidian" + self-reference patterns that we'd already fixed in manifest.json; this synchronises the two so anything reading from npm-style metadata gets the same active-voice description users see in the directory listing. Version bumped 0.1.1 → 0.1.2 across manifest.json / package.json / versions.json. No source-code changes — Directory Templates, the four shipped templates, the first-run seeder, the Claude integration, the wide modals all behave identically to 0.1.1. Co-Authored-By: Claude Opus 4.7 (1M context) --- .github/workflows/release.yml | 88 +++++++++++++++++++++++++++++++++++ manifest.json | 2 +- package.json | 4 +- release-notes/0.1.2.md | 66 ++++++++++++++++++++++++++ versions.json | 5 +- 5 files changed, 160 insertions(+), 5 deletions(-) create mode 100644 .github/workflows/release.yml create mode 100644 release-notes/0.1.2.md diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml new file mode 100644 index 0000000..a300665 --- /dev/null +++ b/.github/workflows/release.yml @@ -0,0 +1,88 @@ +name: Release plugin + +# Fires when a 3-digit-semver tag is pushed (e.g. 0.1.6). Builds the plugin +# in a clean Ubuntu runner, signs the produced main.js / manifest.json / +# styles.css with GitHub's artifact-attestation (sigstore-backed), and +# creates the GitHub Release with those three files attached. Anyone +# installing can verify provenance with `gh attestation verify +# --repo lossless-group/metafetch`. +# +# Release notes: if release-notes/.md exists in the repo at the tagged +# commit, it's used verbatim as the release body. Otherwise the workflow +# falls back to GitHub's --generate-notes. The convention going forward is +# to author the marketing-shape notes in release-notes/.md before +# tagging (per content-farm/context-v/skills/changelog-conventions/SKILL.md +# "These are marketing artifacts" section — every release page is a +# four-audience marketing surface, not a commit-message recap). + +on: + push: + tags: + - '[0-9]+.[0-9]+.[0-9]+' + +permissions: + contents: write # gh release create / asset upload + id-token: write # OIDC token for sigstore signing + attestations: write # write the attestation to GitHub's attestation API + +jobs: + release: + runs-on: ubuntu-latest + steps: + - name: Check out tagged commit + uses: actions/checkout@v4 + + - name: Install pnpm + uses: pnpm/action-setup@v4 + with: + version: 10 + run_install: false + + - name: Set up Node + uses: actions/setup-node@v4 + with: + node-version: 22 + cache: pnpm + + - name: Install dependencies + run: pnpm install --frozen-lockfile + + - name: Build plugin + run: pnpm build + + - name: Attest build provenance + uses: actions/attest-build-provenance@v1 + with: + subject-path: | + main.js + manifest.json + styles.css + + - name: Pick release-notes source + id: notes + run: | + NOTES_FILE="release-notes/${GITHUB_REF_NAME}.md" + if [ -f "$NOTES_FILE" ]; then + echo "found=true" >> "$GITHUB_OUTPUT" + echo "path=$NOTES_FILE" >> "$GITHUB_OUTPUT" + echo "Using release-notes/${GITHUB_REF_NAME}.md as release body" + else + echo "found=false" >> "$GITHUB_OUTPUT" + echo "No release-notes/${GITHUB_REF_NAME}.md found — falling back to --generate-notes" + fi + + - name: Create release + env: + GH_TOKEN: ${{ github.token }} + run: | + if [ "${{ steps.notes.outputs.found }}" = "true" ]; then + gh release create "$GITHUB_REF_NAME" \ + --title "$GITHUB_REF_NAME" \ + --notes-file "${{ steps.notes.outputs.path }}" \ + main.js manifest.json styles.css + else + gh release create "$GITHUB_REF_NAME" \ + --title "$GITHUB_REF_NAME" \ + --generate-notes \ + main.js manifest.json styles.css + fi diff --git a/manifest.json b/manifest.json index fd39568..1ec3d93 100644 --- a/manifest.json +++ b/manifest.json @@ -1,7 +1,7 @@ { "id": "perplexed", "name": "Perplexed", - "version": "0.1.1", + "version": "0.1.2", "minAppVersion": "1.8.10", "description": "Generate source-cited research content from Perplexity, Anthropic Claude, Perplexica, or local LM Studio — directly into your notes.", "author": "The Lossless Group", diff --git a/package.json b/package.json index 7e35b62..1daf83f 100644 --- a/package.json +++ b/package.json @@ -1,7 +1,7 @@ { "name": "perplexed", - "version": "0.1.1", - "description": "A plugin for Obsidian that allows you to generate source-cited content using AI using Perplexity and Perplexica.", + "version": "0.1.2", + "description": "Generate source-cited research content from Perplexity, Anthropic Claude, Perplexica, or local LM Studio — directly into your notes.", "main": "main.js", "scripts": { "dev": "node esbuild.config.mjs", diff --git a/release-notes/0.1.2.md b/release-notes/0.1.2.md new file mode 100644 index 0000000..908863a --- /dev/null +++ b/release-notes/0.1.2.md @@ -0,0 +1,66 @@ +**Perplexed turns Obsidian into a per-directory research workflow with Claude, Perplexity, Perplexica, and LM Studio — and starting with 0.1.2, every release asset is cryptographically attested back to the source code that built it.** + +## Why care? + +Knowledge vaults with thousands of stub files — concept notes, tool profiles, vocabulary entries — never get filled in one at a time. You stub them, you mean to come back, you never do. Eventually the vault has 1,600 nearly-empty profile files in `Tooling/` and hundreds of concepts waiting in `concepts/`. + +Perplexed lets you drop **one template into a directory** describing how its files should be filled in — what to research, what tone to take, what frontmatter to stamp, where the sources footer goes — and then runs source-cited research across every file in that directory in one pass. Pick your provider: + +| Provider | Endpoint | Cost | Best for | +|---|---|---|---| +| **Perplexity** | api.perplexity.ai | Paid | Source-cited research with consistent citation formatting | +| **Anthropic Claude** | api.anthropic.com | Paid | Longer-form reasoning with `web_search` and adaptive thinking | +| **Perplexica / Vane** | localhost:3030 (self-hosted) | Free | Privacy-sensitive research; runs entirely on your machine | +| **LM Studio** | localhost:1234 (local) | Free | Local-only inference, no network | + +The streaming response lands directly in your notes with citations intact. Then Cite-Wide picks up the numeric citations and converts them to stable hex identifiers. The two plugins compose: Perplexed generates, Cite-Wide canonicalises. + +Open Obsidian → **Settings → Community Plugins → Browse → "Perplexed" → Install → Enable**. + +## What 0.1.2 brings + +**Cryptographic provenance on every release asset.** Every `main.js`, `manifest.json`, and `styles.css` in this release is signed via GitHub's [artifact attestation system](https://docs.github.com/en/actions/security-for-github-actions/using-artifact-attestations) (sigstore-backed, OIDC-verified) at build time. The bytes you install can be traced back to the exact commit and GitHub Actions workflow run that produced them. + +Verify any release asset before you enable the plugin in your vault: + +```bash +gh attestation verify main.js --repo lossless-group/perplexed-plugin +``` + +Exit code 0 means the file came out of a legitimate build of the source repo. Anything tampered with mid-flight fails the verification. + +This matters more for Perplexed than most plugins: the plugin handles your API keys (Perplexity, Anthropic, etc.) and the research it generates may include sensitive prompts about your work. Verifiable provenance answers "is the plugin I installed the plugin I think I installed?" with cryptography rather than faith. + +## What it changes for users + +**Installing from inside Obsidian:** nothing visible. The Community Plugins directory pulls the latest release the same way it always has. + +**Auditing before manual install:** verify before you drop files into `/.obsidian/plugins/perplexed/`. Same `gh attestation verify` command as above. + +## How the build pipeline works now + +A GitHub Actions workflow (`.github/workflows/release.yml`) fires on every 3-digit-semver tag push. In a clean Ubuntu runner it checks out the tagged commit, runs `pnpm build`, signs the three release assets via [`actions/attest-build-provenance@v1`](https://github.com/actions/attest-build-provenance), and creates the GitHub Release with marketing-shape notes pulled from `release-notes/.md` in the repo. + +Provenance is enforced by infrastructure, not maintainer discipline. Manual `gh release create` from a developer's machine is no longer the path — every release goes through the workflow. + +## The Lossless Group plugin family + +Perplexed sits alongside three sibling plugins, all by [The Lossless Group](https://lossless.group): + +| Plugin | What it does | +|---|---| +| [**Cite Wide**](https://community.obsidian.md/plugins/cite-wide) | Stable hex-identifier citations + URL-based dedupe + LLM-paste research conversion | +| [**Image Gin**](https://community.obsidian.md/plugins/image-gin) | Recraft + Ideogram image generation, Magnific stock search, ImageKit CDN, drag-gate | +| **Perplexed** *(this release)* | Source-cited research from Perplexity, Claude, Perplexica, or LM Studio + per-directory templates | +| [**Metafetch**](https://community.obsidian.md/plugins/metafetch) | Pull OpenGraph metadata into note frontmatter via OpenGraph.io or Microlink | + +Together they form a research-to-publication pipeline: Perplexed generates the source-cited prose with numeric citations, Cite Wide rewrites them to stable hex identifiers, Metafetch fills the URL frontmatter with OG metadata, Image Gin generates the matching imagery. Each is independent; together they compound. + +If Perplexed saves you time, [buy us a coffee](https://buymeacoffee.com/losslessgroup). The plugins are free; the coffee keeps the next one coming. + +## Under the hood — what shipped in this commit + +- `.github/workflows/release.yml` — the build-attest-release workflow described above. Identical structure to the workflows landing across cite-wide, image-gin, metafetch as a family-wide pattern +- `release-notes/0.1.2.md` (this file) — the convention going forward: each release's marketing-shape body lives in the repo at this path before the tag is pushed +- Version bumped 0.1.1 → 0.1.2 across `manifest.json`, `package.json`, `versions.json` +- No source-code changes — Directory Templates, the four shipped templates (concept / vocabulary / source / toolkit), the first-run seeder, the Claude provider integration, the wide modals, all behave identically to 0.1.1 diff --git a/versions.json b/versions.json index c59a5e6..3a29928 100644 --- a/versions.json +++ b/versions.json @@ -1,4 +1,5 @@ { "0.1.0": "0.15.0", - "0.1.1": "1.8.10" -} \ No newline at end of file + "0.1.1": "1.8.10", + "0.1.2": "1.8.10" +}