chore: harden release CI and backfill v0.4.0 CHANGELOG

.github/workflows/release.yml

@@ -49,7 +49,7 @@ jobs:
             runner: macos-latest
             archive: tar.gz
           - target: x86_64-pc-windows-msvc
-            runner: windows-latest
+            runner: windows-2025
             archive: zip
     steps:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.2
@@ -155,7 +155,7 @@ jobs:
           cat SHA256SUMS
 
       - name: Attest build provenance
-        uses: actions/attest-build-provenance@e8998f949152b193b063cb0ec769d69d929409be  # v2.4.0
+        uses: actions/attest-build-provenance@a2bbfa25375fe432b6a289bc6b6cd05ecd0c4c32  # v4.1.0
         with:
           subject-path: |
             artefacts/afm-*.tar.gz

CHANGELOG.md

@@ -11,6 +11,18 @@ adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 ### Added
 
+- **Playground polish (round 2):** light/dark colour-scheme toggle
+  (#57); unified layout skeleton (breakpoint + footer), scaled tokens,
+  and a right-anchored vertical preview (#58, #59); selection-wrap
+  commands that wrap the selection in aozora notation (#60); a notation
+  reference modal (#61); and a source-coordinate WASM API exposing lexer
+  offsets to the editor (#62).
+- **Build provenance attestation** on release artefacts via
+  `actions/attest-build-provenance`: every archive is verifiable with
+  `gh attestation verify <archive> --repo P4suta/afm`, no certificates.
+  (#64, #66)
+- **aozora pin advanced to the tagged v0.4.0 release** (`df0f64b`) — afm
+  v0.4.0 builds against the provenance-attested aozora v0.4.0.
 - **Browser playground at `/afm/playground/`** — Solid + Vite frontend
   over `crates/afm-wasm`, deployed to
   <https://p4suta.github.io/afm/playground/>. CodeMirror 6 editor with
@@ -97,6 +109,8 @@ adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 ### Fixed
 
+- **Prevented a deep-nesting stack overflow** and hardened the public
+  API surface + CI for release (#65).
 - Repaired 4 broken intra-doc links in `afm-markdown` that turned
   `cargo doc --workspace` into a hard failure under the
   `broken_intra_doc_links = "deny"` workspace lint, blocking the

docker-compose.yml

@@ -31,6 +31,11 @@ x-common-env: &common-env
   CARGO_INCREMENTAL: "0"
   SCCACHE_CACHE_SIZE: "10G"
   RUST_BACKTRACE: "1"
+  # Ride out transient static.crates.io outages — a brief "Could not connect
+  # to server" blip failed a cargo step in the sibling aozora repo; cargo's
+  # default retry is 3. Bump it so a short network hiccup isn't a CI failure.
+  # Applies to every service that inherits x-common-env.
+  CARGO_NET_RETRY: "10"
   # Use mold as the default linker for faster host-triple builds. The
   # Dockerfile installs mold + clang and writes /root/.cargo/config.toml
   # with the same intent, but CARGO_HOME=/cargo/home above means cargo