Release 0.8.5: migrate to ATRAPS LLC, ship the licence, update dependencies

.github/workflows/ci.yml

@@ -2,9 +2,9 @@ name: CI
 
 on:
   push:
-    branches: [ master ]
+    branches: [ main ]
   pull_request:
-    branches: [ master ]
+    branches: [ main ]
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
@@ -130,13 +130,13 @@ jobs:
     - name: Run tests (no default features)
       run: cargo test -p dotscope --no-default-features --release --verbose
 
-  # Fuzzing on pushes to master or PRs targeting master
+  # Fuzzing on pushes to main or PRs targeting main
   fuzzing:
     name: Quick Fuzzing
     runs-on: ubuntu-latest
     if: |
-      (github.event_name == 'push' && github.ref == 'refs/heads/master') ||
-      (github.event_name == 'pull_request' && github.event.pull_request.base.ref == 'master') ||
+      (github.event_name == 'push' && github.ref == 'refs/heads/main') ||
+      (github.event_name == 'pull_request' && github.event.pull_request.base.ref == 'main') ||
       contains(github.event.head_commit.message, '[fuzz]')
 
     steps:
@@ -170,13 +170,13 @@ jobs:
           exit 1
         fi
 
-  # Security audit on pushes to master or PRs targeting master
+  # Security audit on pushes to main or PRs targeting main
   security:
     name: Security Audit
     runs-on: ubuntu-latest
     if: |
-      (github.event_name == 'push' && github.ref == 'refs/heads/master') ||
-      (github.event_name == 'pull_request' && github.event.pull_request.base.ref == 'master')
+      (github.event_name == 'push' && github.ref == 'refs/heads/main') ||
+      (github.event_name == 'pull_request' && github.event.pull_request.base.ref == 'main')
 
     steps:
     - name: Checkout code

.github/workflows/release.yml

@@ -157,11 +157,25 @@ jobs:
     runs-on: ubuntu-latest
     needs: [version, test]
 
+    permissions:
+      contents: read
+      id-token: write        # required to mint the crates.io OIDC token
+
     steps:
     - name: Checkout code
       uses: actions/checkout@v7
       with:
         ref: ${{ github.event.release.tag_name }}
+        fetch-depth: 0       # merge-base needs real history
+
+    # A GitHub release can be cut from any commit, including one that never
+    # landed on main. Publishing is restricted to release tags that are
+    # actually contained in main.
+    - name: Refuse releases not contained in main
+      run: |
+        git fetch --no-tags origin +refs/heads/main:refs/remotes/origin/main
+        git merge-base --is-ancestor "$(git rev-parse HEAD)" refs/remotes/origin/main \
+          || { echo "::error::release commit is not contained in main"; exit 1; }
 
     - name: Install Rust toolchain
       uses: dtolnay/rust-toolchain@stable
@@ -172,10 +186,14 @@ jobs:
     - name: Verify package can be published
       run: cargo publish -p dotscope --dry-run
 
+    - name: Authenticate to crates.io
+      uses: rust-lang/crates-io-auth-action@v1
+      id: auth
+
     - name: Publish to crates.io
       run: cargo publish -p dotscope
       env:
-        CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}
+        CARGO_REGISTRY_TOKEN: ${{ steps.auth.outputs.token }}
 
   # Verify documentation builds correctly
   verify-docs:

CHANGELOG.md

@@ -5,6 +5,41 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.8.5] - 2026-08-09
+
+### Fixed
+
+- **No licence text was shipped with the crate.** `LICENSE` and `NOTICE` live at the
+  workspace root, but the package root is `dotscope/`, and cargo only packages files
+  under the package directory — so every published version declared
+  `license = "Apache-2.0"` while shipping neither the licence nor the NOTICE.
+  Both files now exist inside the package and are included in the published crate.
+- `LICENSE` was a symlink to `LICENSE-APACHE`. Symlinks do not survive packaging
+  cleanly; `LICENSE` is now a regular file and the duplicate `LICENSE-APACHE` is gone,
+  with the README badge and the crate-level doc badge repointed at it.
+
+### Dependencies
+
+- Upgraded `analyssa` 0.4.1 → 0.5.0, which fixes SSA rebuild and phi-transform
+  correctness: on a 125 MB reference binary the upstream pass rollbacks went from
+  6,094 to 0 and verifier-reported undefined uses from ~28,960 to 0. No API changes
+  were needed here.
+- Upgraded `comfy-table` 7.2.2 → 8.0.0. The preset-string API was removed in v8;
+  `Table::load_preset(presets::NOTHING)` becomes `Table::load_style(presets::NOTHING)`,
+  where presets are now `TableStyle` constants. Rendering is unchanged.
+- Refreshed all remaining dependencies (`cargo update`), including `aes`, `clap`,
+  `thiserror`, and `smallvec`.
+
+### Changed
+
+- Recorded ATRAPS LLC as copyright holder in `LICENSE` and `NOTICE`.
+- Dropped the deprecated `authors` field from both workspace members and repointed
+  `repository` / `homepage` at the organisation.
+- Default branch renamed from `master` to `main`; CI triggers and the fuzzing and
+  security-audit job conditions were updated to match.
+- Publishing now uses crates.io trusted publishing instead of a stored registry token,
+  and refuses to publish a release whose commit is not contained in `main`.
+
 ## [0.8.4] - 2026-07-26
 
 ### Added