chore(release): 1.2.2

[galangel]

Does releasing 1.2.2 help?

Partly — worth being precise about what it does and doesn't fix.

It does not repair 1.2.1. Stripping the Co-authored-by trailers rewrote main, so the provenance attestation published for 1.2.1 names commit 005f7cac, which no longer exists in history. A published version can't be re-signed. That attestation is permanently broken.

It does restore a verifiable latest. Once 1.2.2 is out, the version people actually install has a provenance chain that resolves against real history. The broken one stops being the default.

It also exercises three things that have never run. Worth having a low-stakes release do it rather than a release you care about:

• the new registry-based publish gate
• the bumped actions, including action-gh-release@v3
• auto-publish on push to main, with no dispatch

This isn't an empty version bump

No source changes since 1.2.1 — nothing under src/ moved, and files is just ["dist"]. But dependabot bumped vite ^7.3.1 → ^8.2.1 in #22, and vite is what builds dist. Diffing the published 1.2.1 tarball against a fresh build:

file	1.2.1	new	delta
dist/index.mjs	101,064	94,573	−6,491
dist/index.cjs	66,917	68,068	+1,151
dist/styles.css	35,889	35,889	0
type declarations	—	—	identical

Only the two bundles and their sourcemaps differ. So consumers do get a genuinely rebuilt artifact, not just a new version number.

Worth a look before merging: index.mjs dropping 6.5 kB while index.cjs grows 1.2 kB is a bigger swing than a patch release usually implies. It's vite 8 changing its output, not a source change — but if you'd rather sanity-check the ESM bundle in a consumer before this goes out, that's a reasonable call.

Verification

Full CI step list locally, against vite 8.2.1:

Step	Result
npm ci	pass
typecheck	pass
lint	pass — 0 errors
format:check	pass
test:coverage	pass — 354 tests, 19 files
build	pass
build:storybook	pass

What happens on merge

Unlike every recent release, no dispatch needed. The push to main runs the gate, which asks the registry, gets a 404 for 1.2.2, and publishes. Expect a deployment to the NPM environment and a v1.2.2 release.

If the publish fails for any reason, the new gate means the next push retries it — no stranded version, no burnt number. That's the property the old git-diff gate lacked.