chore(ci): bump packslip to v1.1.1

[jdx]

Update the release workflow to use packslip v1.1.1 at its immutable commit SHA. This release pins the nested provenance action, so repositories enforcing full-length action SHAs can load the composite action.

Validation: git diff --check

AI-assisted — Tool: Codex; model: openai/gpt-5; version: unavailable.

---

Note

Low Risk
Single CI dependency pin in the packslip release job; no application or runtime behavior changes.

Overview
Updates the publish-cli workflow’s packslip step from v1.0.2 to v1.1.1, pinning the composite action at commit a0d434ad57571c62dbd0ab5095b4eff607a71fd3.

The bump is intended so packslip’s nested provenance action is pinned at a full SHA, which keeps the release job working under policies that require immutable action references. Artifacts, bin, and resources inputs are unchanged.

^{Reviewed by Cursor Bugbot for commit 5cbc9fe. Bugbot is set up for automated code reviews on this repo. Configure here.}

Summary by CodeRabbit

• Chores
  • Updated the package publishing workflow to use a newer version of its packaging tool.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Central YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Team

Run ID: 3c994878-7999-4d76-a58e-4acbab0b2fcc

📥 Commits

Reviewing files that changed from the base of the PR and between 88de67f and 5cbc9fe.

📒 Files selected for processing (1)

• .github/workflows/publish-cli.yml

Included review availability: Your plan provides up to 4 included reviews per hour; 1 remains after this review.

---

📝 Walkthrough

Walkthrough

The publish workflow updates the pinned jdx/packslip action from v1.0.2 to v1.1.1. No other workflow logic changes.

Changes

Publish workflow

Layer / File(s)	Summary
Update Packslip action pin .github/workflows/publish-cli.yml	The packslip job now pins jdx/packslip to the v1.1.1 commit.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Merge Risk: ⚪ Minimal · up to 5cbc9

The publish workflow now uses Packslip v1.1.1 at an immutable commit SHA, preserving compatibility with full-SHA action policies. The change is ready to merge.

Poem

A rabbit checks the workflow pin
Packslip hops to version one point one
The publish path stays still
One commit marks the hill
Clean builds begin to run

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the CI change: updating the pinned packslip action to v1.1.1.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Instruction counts

benchmark	trend	instructions	Δ	wall (min)	Δ
markdown	▁▁▁██████	386,473,819 → 386,477,757	+0.00%	64.39 → 64.63ms	+0.37%
startup	▁▁▁▇▇▇▇▃█	952,527 → 959,539	+0.74%	1.17 → 1.18ms	+1.37%

No instruction-count regression above 1%.

_{Only instruction counts gate. Wall clock is shown for context — on identical hardware it moves 4-20% run to run.}

_{Measured by tak — instruction-counted CLI benchmarks, stored in this repository's git notes.}

Shadow comparison

Parsing mise use -g node@20 against a shadow of mise's committed spec.
Reported, not gated: the shadow grows as the derive learns to express more, so
what to watch is the ratio rather than either column.

framework	stripped binary, bytes
usage	1344744
bpaf	2493216
clap	3101656

framework	instructions, cold parse	vs usage
usage	8374	—
clap	6314655	754x
bpaf	21909025	2616x

                                              min       p01       p10    median
usage-rs: argv -> struct                     1186      1199      1228      1233  ns
clap: build tree + parse -> struct        1793854   1797646   1805935   1816266  ns
bpaf: build parser + parse -> struct      5576293   5576293   5593484   5640066  ns

usage: argv -> struct                            1191 ns      1.19 µs
clap: build tree + parse -> struct            1815466 ns   1815.47 µs
clap: parse -> struct, tree reused              72063 ns     72.06 µs
clap: build tree only                         1051941 ns   1051.94 µs

_{5cbc9fe629f4 vs 88de67f7b02f · measured on the runner, not pushed to the history.}