Finalize v0.3.0 release state

.github/workflows/release.yml

@@ -3,8 +3,6 @@ name: Release SkillConform
 on:
   push:
     tags: ["v*"]
-  issues:
-    types: [opened]
   workflow_dispatch:
     inputs:
       version:
@@ -22,9 +20,6 @@ concurrency:
 
 jobs:
   publish:
-    if: >-
-      github.event_name != 'issues' ||
-      (github.actor == 'GenRamzi' && github.event.issue.title == 'release: skillconform 0.3.0')
     name: Publish version and create release
     runs-on: ubuntu-latest
     steps:
@@ -66,12 +61,7 @@ jobs:
           NODE
 
           package_version="$(node -p "require('./package.json').version")"
-          if [[ "${GITHUB_EVENT_NAME:-}" == "issues" ]]; then
-            if [[ "${GITHUB_ACTOR:-}" != "GenRamzi" || "${package_version}" != "0.3.0" ]]; then
-              echo "Issue-triggered release is restricted to GenRamzi and package version 0.3.0" >&2
-              exit 1
-            fi
-          elif [[ "${GITHUB_REF_TYPE:-}" == "tag" ]]; then
+          if [[ "${GITHUB_REF_TYPE:-}" == "tag" ]]; then
             expected="v${package_version}"
             if [[ "$GITHUB_REF_NAME" != "$expected" ]]; then
               echo "Tag/version mismatch: tag=$GITHUB_REF_NAME package=$package_version" >&2

README.md

@@ -18,7 +18,7 @@ Agent Skills are portable folders built around `SKILL.md`. The reference validat
   <img src="docs/demo.svg" width="900" alt="SkillConform scanning seven Agent Skills and returning a clean pass">
 </p>
 
-> Status: `v0.3.0` development line on `main`. The CLI, library API, and GitHub Action are ready for early adopters; published registry releases may lag `main`. Static compatibility and security results are evidence for review, not runtime certification.
+> Status: `v0.3.0` is the latest public release on npm and GitHub. The CLI, library API, and GitHub Action are ready for early adopters. Static compatibility and security results are evidence for review, not runtime certification.
 
 ## Quick start
 
@@ -151,7 +151,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v7
-      - uses: GenRamzi/skillconform@v0.1.1
+      - uses: GenRamzi/skillconform@v0.3.0
         with:
           path: skills
           mode: audit

docs/codex-for-oss-application.md

@@ -13,8 +13,8 @@ Why this repository instead of the maintainer's other projects: SkillConform has
 ## Current evidence
 
 - Apache-2.0 public repository.
-- Public GitHub releases exist, including `v0.1.1`.
-- `main` is the `0.3.0` development line.
+- Public GitHub releases exist, including stable `v0.3.0` published on 2026-09-23.
+- `skillconform@0.3.0` is published publicly on npm through GitHub OIDC trusted publishing with provenance.
 - CI covers Node 20, 22, and 24 plus a SARIF smoke test.
 - The project exposes a CLI, TypeScript API, GitHub Action, capability inventory, compatibility matrix, deterministic security rules, and regression policies.
 - Issue templates explicitly invite compatibility evidence and deterministic regression cases.
@@ -24,7 +24,7 @@ Why this repository instead of the maintainer's other projects: SkillConform has
 
 ## Draft: why is this repository eligible? (<=500 characters)
 
-SkillConform is an Apache-2.0 CLI, library and GitHub Action for deterministic conformance, security review, capability inventory and cross-agent compatibility checks for Agent Skills. It has public releases, active issue triage, CI across Node 20/22/24, SARIF output, and profiles for Claude, OpenAI and Gemini. I am the primary maintainer. Adoption is early; I am applying on ecosystem relevance and active maintenance, not inflated metrics.
+SkillConform is an Apache-2.0 CLI, library and GitHub Action for deterministic conformance, security review, capability inventory and cross-agent compatibility checks for Agent Skills. v0.3.0 is published on npm with GitHub provenance, with CI on Node 20/22/24, SARIF output, and profiles for Claude, OpenAI and Gemini. I am the primary maintainer; adoption is early and I am not inflating usage metrics.
 
 ## Draft: how would API credits be used? (<=500 characters)
 

docs/launch-kit.md

@@ -65,11 +65,11 @@ The project is early, so reports from real repositories are more useful than sta
 
 ## LinkedIn draft
 
-I have released **SkillConform v0.1.1**, an open-source quality and security tool for portable Agent Skills.
+I have released **SkillConform v0.3.0**, an open-source quality, conformance, capability, compatibility, and security tool for portable Agent Skills.
 
 Agent Skills are easy to share, but a `SKILL.md` folder can also contain broken references, credentials, risky shell instructions, excessive permissions, and policy regressions. SkillConform adds deterministic checks, stable rule IDs, regression expectations, GitHub Actions integration, and SARIF output without requiring an API key or executing the inspected scripts.
 
-The first release is available as an npm CLI and GitHub Action. I am inviting maintainers to test it against real skill repositories and report false positives, missing rules, and integration gaps.
+The release is available as an npm CLI and GitHub Action. I am inviting maintainers to test it against real skill repositories and report false positives, missing rules, compatibility gaps, and integration needs.
 
 ## X / Bluesky thread
 

docs/releasing.md

@@ -30,4 +30,4 @@ The workflow re-runs type checks, tests, self-tests, a warning-level audit of th
 
 ## Why the workflow changed
 
-The September 23, 2026 `0.3.0` release attempts passed all repository validation and failed only at token-authenticated `npm publish`. Trusted publishing removes the long-lived token dependency and binds publishing to this repository and workflow.
+The September 23, 2026 `0.3.0` release attempts initially passed all repository validation and failed only at token-authenticated `npm publish`. After the npm trusted publisher was configured, `v0.3.0` published successfully through GitHub OIDC with provenance and a matching GitHub Release. The permanent workflow now keeps only tag and explicit manual-dispatch release paths.