chore(release): v0.39.0 - #431

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

v0.39.0 is merged to main and STAGED — needs a maintainer to push the signed tag

#375 hole (2) shipped end-to-end onto main:

• Feature merged: feat(guard): delete the two unloaded shadow safety files; guard their return (#375) #430 → main (01e81a2) — deleted the two unloaded shadow safety files + tools/check_safety_sources.py guard + REQ-GUARD-STATUS-SHADOW-001.
• Release bump merged: chore(release): v0.39.0 #431 → main (113c4be) — Cargo.toml / Cargo.lock (23 crates) / vscode-spar/package.json at 0.39.0, REQ promoted to verified.

What's blocked: pushing the v0.39.0 tag that fires release.yml cannot be done from this automated session. The tag is created and SSH-signed locally (annotated tag on main HEAD 113c4be), but git push origin v0.39.0 returns HTTP 403: refs/tags/v* is protected and only you can push it. Branch pushes from this session work; tag refs are locked, which is the correct posture for a ref that triggers publishing. I did not force, fake, or work around it.

There are now TWO outstanding signed tags to cut (in order)

v0.38.0 from the prior run was never tagged either (same 403). To ship both, please run locally:

git fetch origin main
# v0.38.0 — tag the bump commit where Cargo.toml first read 0.38.0
git tag -s v0.38.0 1f1a19f -m 'v0.38.0'
git tag -v v0.38.0
git push origin v0.38.0 # triggers release.yml for v0.38.0
# v0.39.0 — tag current main HEAD (the #431 merge)
git tag -s v0.39.0 113c4be -m 'v0.39.0'
git tag -v v0.39.0
git push origin v0.39.0 # triggers release.yml for v0.39.0

Both bump commits are independent, valid taggable points: v0.38.0 at 1f1a19f bundles work through that commit; v0.39.0 at 113c4be bundles everything since (incl. #429 interop and #430 safety-sources). Re-cutting on your machine is cleanest — the signatures will be under your key.

Note on release.yml: a failure isolated to the Marketplace/VSCE publish job = expired VSCE_PAT — the binaries still ship; it is not a release failure.

Generated by Claude Code