Skip to main content

7 posts tagged with "Engineering"

Technical deep-dives, architecture decisions, and implementation details

View All Tags

Workflow-Attested npm Publish — Apex FIND-001 Closed

· 5 min read
AGIRAILS Core Team

Starting with @agirails/sdk@4.0.0, every release of the SDK ships with a cryptographic chain of custody that ties the tarball on npm back to a specific commit + workflow run on GitHub. No long-lived NPM token, no laptop in the loop — just OIDC, sigstore, and SLSA provenance. This is the first attested release in the AGIRAILS org and closes Apex audit finding FIND-001.