[shadetheory]

Posts each published release to /dev/null, signed with a signing-only key, and checks the package before it does.

Richer release post. .github/scripts/devnull-post.py builds the post at release time from the GitHub API with the workflow's read-only token:

• <repo> <tag>: <one-line pitch>
• Patch notes: release body bullets, or the merged PRs and direct commits since the previous release (dependency bumps dropped)
• Tests: check results for the release commit, plus Pest/PHPUnit totals and coverage when the job log has them
• Acceptance criteria from issues the merged PRs closed, with their checked state
• Review findings, one line per review, by reviewer handle
• Commits pushed to a PR after its first review
• Local pipeline: quality-runners commit statuses and Werkflow check runs on the release commit and the merged PRs
• composer require line and the release link

Sections with no data are left out. Plain text, no em dashes, hashtags or @-mentions, capped at 4000 characters, lowest-priority sections trimmed first. The release body goes in through env vars, never interpolated into shell.

Checks.

• lean-package.yml runs lean-package-validator v6.3.2 (validate --validate-git-archive, keeping README and LICENSE) on pull requests and before the post. .gitattributes now matches what it expects, and git archive still ships composer.json and every src/ file.
• release-checks.yml runs before the post: version-aligner check (git tag vs latest CHANGELOG.md entry vs application version; skipped when the repo has no CHANGELOG.md) and composer-peel status (read-only; peel is never run). Both are installed in CI only, not added to composer.json.

Job permissions are read-only. The posting job only gets the SSH key.

[lexi-chief-of-staff]

Using @production on an external composite action pins to a mutable ref. Pin to a commit SHA (or at minimum a tagged release) for supply-chain safety, especially when the action receives an SSH key.

[lexi-chief-of-staff]

Blocking: none.

• The workflow itself is minimal and correctly scoped (empty permissions, release trigger only).
• External action reference at an unpinned mutable tag is the only substantive concern; address that before shipping if the key grant is sensitive.
• PR body claims a .gitattributes change that is absent from the diff—either remove the claim or add the file.
• No other correctness, security, or integration issues visible in the provided diff.

[shadetheory]

Quality Gate: error

All quality checks passed.

Quality Check Results

All tools passed without violations.

[lexi-chief-of-staff]

Downloading phar via curl with no checksum or signature verification is a supply-chain risk. Pin to a known-good hash or use a verified source.

[lexi-chief-of-staff]

UPGRADING.md is no longer export-ignored (was present before). If the intent is a lean Composer dist, restore the ignore or confirm it should ship.

[lexi-chief-of-staff]

Blocking: supply-chain exposure in lean-package workflow and export-ignore regression.

• .github/workflows/lean-package.yml:22 downloads lean-package-validator.phar over plain curl with zero integrity check. Add --checksum or switch to a verified release mechanism.
• .gitattributes dropped UPGRADING.md from export-ignore (line 13 in diff). Restore the rule unless the file is intentionally shipped in the Composer artifact.
• The devnull-post.py script is large and new; consider splitting the GraphQL/REST helpers into a small library or adding unit tests before it becomes the only release artifact generator.
• No linked issues or prior discussion of the /dev/null posting policy; confirm this is the intended destination for release announcements.

[shadetheory]

Quality Gate: error

All quality checks passed.

Quality Check Results

All tools passed without violations.

[shadetheory]

Quality Gate: error

All quality checks passed.

Quality Check Results

All tools passed without violations.

[lexi-chief-of-staff]

.claude/ already covers agents/ and CLAUDE.md; the two extra lines are redundant and will be ignored by git.

[lexi-chief-of-staff]

Using function attribute main.dropped for state across trim iterations is fragile; a local dict would be clearer and avoid mutating the function object.

[lexi-chief-of-staff]

Blocking: none. Two minor observations called out inline.

• .gitattributes now has duplicate .claude/ rules.
• devnull-post.py mutates the function object to carry dropped-count state; a plain dict would be simpler.

The rest of the change (release-to-/dev/null flow, lean-package validator, version-aligner checks) is self-contained and matches the stated intent. Ready to land.

[lexi-chief-of-staff]

release-checks.sh uses jq (lines 23, 29, 35) but the workflow only installs composer tools. Add jq to setup-php tools or apt-get.

[lexi-chief-of-staff]

Ship it.

• release-checks.yml missing jq (commented inline)
• lean-package.yml hardcodes LPV v6.3.2; consider pinning in a reusable way
• devnull-post.py correctly avoids shell interpolation and trims sections under 4000 chars
• release-checks.sh properly skips CHANGELOG-less repos and treats missing app version as non-blocking for libraries
• .gitattributes change aligns with lean-package-validator expectations

No blocking correctness or safety issues.

[shadetheory]

Quality Gate: error

All quality checks passed.

Quality Check Results

All tools passed without violations.

[lexi-chief-of-staff]

Ship it.

• Matches the stated intent exactly: lean-package validation, release-time checks (version-aligner + composer-peel), and the 4000-char plain-text post builder all land where described.
• .gitattributes delta is the validator's expected output; archive still includes composer.json + src/.
• devnull-post.py correctly avoids interpolation, drops noise sections, and trims lowest-priority content first.
• Workflows use read-only tokens and the SSH key only on the final post step; no prod surface changes.

No blocking correctness or safety issues remain.

[shadetheory]

Quality Gate: success

All quality checks passed.

Quality Check Results

All tools passed without violations.

[lexi-chief-of-staff]

curl of lean-package-validator.phar has no integrity check (no sha256, gpg, or --checksum). With risk:high and external binary execution in CI, add verification before php $RUNNER_TEMP/lpv.phar.

[lexi-chief-of-staff]

RELEASE_TAG pulled from github.event.release.tag_name inside a reusable workflow_call. Confirm the release event context is propagated from the caller (devnull.yml); otherwise falls back to empty and version-aligner skips the tag match.

[lexi-chief-of-staff]

Blocking: none. Two concrete issues called out inline.

• External binary fetch in lean-package.yml lacks integrity verification.
• RELEASE_TAG context propagation in the reusable release-checks workflow needs explicit confirmation.

Everything else (devnull-post.py structure, release-checks.sh logic, .gitattributes export rules, permission scoping) is sound and matches the stated intent. Ready to merge once the two points are addressed or acknowledged.

[shadetheory]

Quality Gate: success

All quality checks passed.

Quality Check Results

All tools passed without violations.

[shadetheory]

Quality Gate: success

All quality checks passed.

Quality Check Results

All tools passed without violations.

[lexi-chief-of-staff]

Downloading phar without checksum or signature verification. LPV_VERSION is pinned but the binary itself is not validated before execution. Add sha256sum check or switch to a verified installation method.

[lexi-chief-of-staff]

Blocking: insecure phar download in lean-package.yml.

• .github/workflows/lean-package.yml:22 downloads lean-package-validator.phar over curl with no checksum verification before php execution. Pinning the version string is insufficient; add sha256 validation or use a trusted source.
• No other correctness or safety issues found in the release posting pipeline or checks. The devnull-post.py logic, release-checks, and gitattributes updates are sound.

Fix the download step then re-request review.