From 667ba6f0bebe0b702ee9d3f0e6956f63235da808 Mon Sep 17 00:00:00 2001
From: Jay Zeng <jayzeng@users.noreply.github.com>
Date: Mon, 10 Aug 2026 23:14:09 -0700
Subject: [PATCH] chore: release 0.4.2

Signed-off-by: Jay Zeng <jayzeng@users.noreply.github.com>
---
 .github/workflows/publish-npm.yml |  5 +++--
 CHANGELOG.md                      |  9 +++++++++
 package-lock.json                 |  4 ++--
 package.json                      |  2 +-
 test/unit.test.ts                 | 13 +++++++++++++
 5 files changed, 28 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/publish-npm.yml b/.github/workflows/publish-npm.yml
index 8719f51..d42d105 100644
--- a/.github/workflows/publish-npm.yml
+++ b/.github/workflows/publish-npm.yml
@@ -8,6 +8,7 @@ on:
 
 permissions:
   contents: read
+  id-token: write
 
 jobs:
   publish:
@@ -18,7 +19,7 @@ jobs:
       - uses: actions/checkout@v4
       - uses: actions/setup-node@v4
         with:
-          node-version: 20
+          node-version: "22.19.0"
           cache: npm
           registry-url: "https://registry.npmjs.org"
       - uses: oven-sh/setup-bun@v2
@@ -45,4 +46,4 @@ jobs:
       - run: npm run lint
       - run: npm run build
       - run: npm test
-      - run: npm publish
+      - run: npm publish --provenance
diff --git a/CHANGELOG.md b/CHANGELOG.md
index ef03320..376bb64 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -6,6 +6,8 @@ follows [Semantic Versioning](https://semver.org/).
 
 ## [Unreleased]
 
+## [0.4.2] — 2026-08-10
+
 ### Added
 
 - `PI_MEMORY_EXIT_SUMMARY=0` (aliases: `off`/`false`/`no`) disables the exit
@@ -31,6 +33,13 @@ follows [Semantic Versioning](https://semver.org/).
 
 ### Changed
 
+- npm releases now run on the package's supported Node.js 22.19 runtime and
+  publish provenance attestations after lint, build, and unit-test gates pass.
+
+## [0.4.1] — 2026-08-08
+
+### Changed
+
 - Reduced pull-request CI duplication and setup overhead by consolidating the
   fast verification jobs, canceling superseded runs, moving API-backed e2e to
   an explicit workflow, and caching the path-filtered Windows qmd smoke test.
diff --git a/package-lock.json b/package-lock.json
index 54b37dd..deef482 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,12 +1,12 @@
 {
 	"name": "pi-memory",
-	"version": "0.4.0",
+	"version": "0.4.2",
 	"lockfileVersion": 3,
 	"requires": true,
 	"packages": {
 		"": {
 			"name": "pi-memory",
-			"version": "0.4.0",
+			"version": "0.4.2",
 			"hasInstallScript": true,
 			"license": "MIT",
 			"devDependencies": {
diff --git a/package.json b/package.json
index 0fe8c47..0fb4d81 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
 	"name": "pi-memory",
-	"version": "0.4.0",
+	"version": "0.4.2",
 	"description": "Pi coding agent extension for memory with qmd-powered semantic search across daily logs, long-term memory, and scratchpad",
 	"main": "index.ts",
 	"type": "module",
diff --git a/test/unit.test.ts b/test/unit.test.ts
index f66f08b..79865a1 100644
--- a/test/unit.test.ts
+++ b/test/unit.test.ts
@@ -156,6 +156,7 @@ describe("runtime package scope", () => {
 describe("GitHub Actions workflows", () => {
 	const ciWorkflow = fs.readFileSync(new URL("../.github/workflows/ci.yml", import.meta.url), "utf-8");
 	const e2eWorkflow = fs.readFileSync(new URL("../.github/workflows/e2e.yml", import.meta.url), "utf-8");
+	const publishWorkflow = fs.readFileSync(new URL("../.github/workflows/publish-npm.yml", import.meta.url), "utf-8");
 	const qmdWorkflow = fs.readFileSync(new URL("../.github/workflows/windows-qmd-smoke.yml", import.meta.url), "utf-8");
 
 	test("runs feature-branch CI once and cancels superseded runs", () => {
@@ -188,6 +189,18 @@ describe("GitHub Actions workflows", () => {
 		expect(e2eWorkflow).not.toContain("pull_request:");
 		expect(e2eWorkflow).toContain("run: npm run test:e2e");
 	});
+
+	test("publishes matching release tags on the supported Node runtime with provenance", () => {
+		expect(publishWorkflow).toContain('tags:\n      - "v*"');
+		expect(publishWorkflow).toContain(`NODE_AUTH_TOKEN: \${{ secrets.NPM_TOKEN }}`);
+		expect(publishWorkflow).toContain('node-version: "22.19.0"');
+		expect(publishWorkflow).toContain("id-token: write");
+		expect(publishWorkflow).toContain(`tag="\${GITHUB_REF_NAME#v}"`);
+		expect(publishWorkflow).toContain("npm run lint");
+		expect(publishWorkflow).toContain("npm run build");
+		expect(publishWorkflow).toContain("npm test");
+		expect(publishWorkflow).toContain("npm publish --provenance");
+	});
 });
 
 // We need to import the default export to register tools