chore(release): bump packslip action to v1.0.0

[jdx]

Summary

• Bumps the pinned jdx/packslip action from v0.3.0 to v1.0.0.
• v1.0.0 declares the manifest format stable, fixes the packslip.dev/releases/v1 predicate URL that previously 404d, and requires every artifact to declare a format (already satisfied here — every artifact is an archive, which infers its format from the file name).

Test plan

• Next tagged release runs the packslip step successfully and uploads packslip.sigstore.json

🤖 Generated with Claude Code

---

Note

Low Risk
Single CI dependency pin in the release attach job; no application or auth logic changes, with existing artifact globs already compatible with v1 format requirements.

Overview
Updates the release workflow’s pinned jdx/packslip step from v0.3.0 to v1.0.1 (commit a6eddff…). Inputs (tag, artifacts, bin) are unchanged; only the action reference in the attach job moves forward.

This picks up the v1 manifest/stable format behavior and predicate URL fixes described for the v1 line, without changing how binaries are built or uploaded—packslip still runs after assets are attached to the tag.

^{Reviewed by Cursor Bugbot for commit 89e884c. Bugbot is set up for automated code reviews on this repo. Configure here.}

AI-assisted — Tool: Claude Code; model: anthropic/claude-sonnet-5; version: unavailable.

Summary by CodeRabbit

• Chores
  • Updated the release asset signing action to a newer version.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Central YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Team

Run ID: 91223c91-69b2-4fcc-ae9c-7bb216bc93c1

📥 Commits

Reviewing files that changed from the base of the PR and between 58cf5a7 and 89e884c.

📒 Files selected for processing (1)

• .github/workflows/release.yml

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

The release workflow updates the jdx/packslip action in the attach job from v0.3.0 to v1.0.1. The commit pin changes. The action inputs and workflow logic remain unchanged.

Changes

Release signing

Layer / File(s)	Summary
Update release asset signing action .github/workflows/release.yml	The attach job now uses jdx/packslip v1.0.1 with its updated commit pin. The existing inputs remain unchanged.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Merge Risk: ⚪ Minimal · up to 89e88

Release asset signing now uses packslip v1.0.1 with unchanged workflow inputs. The supplied compatibility evidence indicates the release artifacts remain supported, with no current merge-blocking risk.

Poem

A rabbit checks the signing line
The newer packslip pin now shines
The inputs stay in place
The workflow keeps its pace
Release assets hop just fine

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly identifies the main change: bumping the jdx/packslip release action. The target version is inaccurate because the workflow changes to v1.0.1, not v1.0.0.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[greptile-apps]

Greptile Summary

Updates the commit-pinned jdx/packslip release action from v0.3.0 to v1.0.1 while preserving its archive selection, binary name, tag, and signing permissions.

• Keeps the action pinned to an immutable commit SHA.
• Leaves the release artifact and attestation flow unchanged.
• No repository-rule violations or actionable regressions were identified.

Confidence Score: 5/5

The PR appears safe to merge because the narrowly scoped action update preserves the established release-attestation contract.

No actionable failures or outstanding repository-rule violations were identified in the updated workflow.

Important Files Changed

Filename	Overview
.github/workflows/release.yml	Updates the packslip action pin to v1.0.1 without changing its inputs, permissions, or position in the release workflow.

_{Reviews (2): Last reviewed commit: "chore(release): bump packslip action to ..." | Re-trigger Greptile}

[github-actions]

Instruction counts

Nothing was compared, and so nothing was gated. No series appears on both sides: either the base has no measurements recorded, or the two were measured on different runner classes, which are deliberately not comparable — counts shift between machine types by more than a real regression does.

New, nothing to compare against: help on jdx-perf-v1-ubuntu24.04-x64-tak-gha20260831.293.1-rust1.98.0-img5263c143, version on jdx-perf-v1-ubuntu24.04-x64-tak-gha20260831.293.1-rust1.98.0-img5263c143

_{Only instruction counts gate. Wall clock is shown for context — on identical hardware it moves 4-20% run to run.}

_{Measured by tak — instruction-counted CLI benchmarks, stored in this repository's git notes.}

_{89e884ccb81a vs 58cf5a7bbb36 · measured on the runner, not pushed to the history.}