[Task] Release ADAMANT IPFS Node v0.1.0 from master #37

Summary

Release ADAMANT IPFS Node v0.1.0 from master: merge dev into master, re-cut the v0.1.0 tag and GitHub Release from master, confirm the container publication, and announce the first public release.

v0.1.0 is already tagged and published, but from dev. This task moves the released commit onto master, so that master is the branch a release is cut from, and re-runs the release pipeline against it.

Current state

• master holds only the initial commit 64c9672, with LICENSE and a two-line README.md; the whole product lives on dev
• The v0.1.0 tag points at 262464c on dev, published on 2026-09-12 with targetCommitish: dev, not a prerelease and not immutable
• dev is now 25 commits ahead of that tag, through 1946724 (merge of Fix: Tor cross-onion CORS when Origin is null #48). The release therefore includes everything merged after the original tag:
  • Fix: Recover stale libp2p sessions between configured peers #40 Fix: Recover stale libp2p sessions between configured peers — periodic libp2p ping liveness checks, session reset on ping failure, reactive recovery after stale replication stream errors and retrieval timeouts (closes [Bug] Stale libp2p session breaks cross-node retrieval (408 timeout) #39)
  • Feat: Reliable mesh replication and repair-cycle grace for health monitors #42 Feat: Reliable mesh replication and repair-cycle grace for health monitors — optional health.repairBacklogGraceCycles, consecutiveUnsuccessfulCycles tracking on health endpoints, ping stream-limit and coalescing fixes, reactive session recovery without a ping veto, one retry of placement on a fresh connection, and framed replication-wire error attribution (closes [Composite] Reliable mesh replication and repair-cycle grace for health monitors #41)
  • Fix: Allow desktop CORS and name upload failures #45 Fix: Allow desktop CORS and name upload failures — opt-in exact app://. desktop origin, stable machine-readable code on upload/rate-limit/admission/quorum/timeout failures, and unified trustProxy guidance for proxied deployments (closes [Composite] Close 0.1.0 adoption gaps: desktop CORS, proxy docs, upload diagnostics #44)
  • Feat: Support Tor and opaque browser CORS origins #47 Feat: Support Tor and opaque browser CORS origins — http(s)://*.onion wildcard for v3 hidden-service shapes and opt-in literal null origin for Tor Browser cross-.onion requests (closes [Enhancement] Support http://*.onion in cors.allowedOrigins #46)
  • Fix: Tor cross-onion CORS when Origin is null #48 Fix: Tor cross-onion CORS when Origin is null — with the null opt-in, answer Access-Control-Allow-Origin: * instead of reflecting null, no Referer rewrite, and Vary: Origin before the CORS middleware (related to [Enhancement] Support http://*.onion in cors.allowedOrigins #46; operationally validated on production nodes before merge)
  • Release-preparation work already described in Chore: Merge dev into master for the v0.1.0 release #38: f5cc5b9 (publication gate moved from dev to master), 5c17db0 (TS target warning fix, byte-identical dist), f4d17e0 (container smoke-test shutdown-log race fix), plus docs/community updates through Chore: Drop the unreachable docs release trigger and keep the image title #36
• package.json is at 0.1.0, which publish-docker.yml compares against the release tag before building
• ghcr.io/adamant-im/ipfs-node carries 0.1.0 and latest from the dev-based release. That build predates the label fix in 3e4f827, so its org.opencontainers.image.title is the bare repository name rather than ADAMANT IPFS Node
• Publication is now gated on master: publish-docker.yml refuses a tag that is not an ancestor of master, so the existing v0.1.0 tag on dev can no longer publish and must be moved
• CI, Security Audit, Docs, and Container all pass on dev, including on PR Chore: Merge dev into master for the v0.1.0 release #38

Publications

• Prepare release notes
• Merge dev into master — merged 2026-09-30 as 5f72ede
• Re-cut the v0.1.0 tag and GitHub Release from master — tag v0.1.0 is now 5f72ede with targetCommitish: master
• Container published to GHCR — Publish container run 36708863398 succeeded from the master-cut tag
• Documentation site serves the released content — last Docs deploy from dev (Fix: Tor cross-onion CORS when Origin is null #48, 2026-09-28, success); live configuration page contains repairBacklogGraceCycles, *.onion, and app://. markers, so it serves the released content (dev content is fully contained in the master merge)
• Prepare news article
• Prepare screenshots/video
• GitHub Forum — discussion #80 in Ecosystem & Integrations
• News blog
• X post — short and full texts prepared, not posted

Additional actions

• Verify that the released tag includes every change merged into dev (through Fix: Tor cross-onion CORS when Origin is null #48) — tag equals origin/master HEAD, dev content is fully contained in the merge
• Verify that the tag matches the package.json version 0.1.0
• Verify that CI and Security Audit pass on master — CI and Container pass; Security Audit fails (see note below)
• Verify that Publish container succeeded and that the runtime smoke test passed on linux/amd64 and linux/arm64 — covered by the publish workflow's own verify jobs
• Verify that ghcr.io/adamant-im/ipfs-node:0.1.0 and :latest resolve, run unprivileged, and carry the ADAMANT OCI labels, the SBOM, and the provenance attestation — both tags point at the new index sha256:a9c76a… (created 2026-09-30T11:34Z); publish verify jobs re-pulled 0.1.0 per architecture and ran the full smoke test (unprivileged user, ready state, upload/download round-trip, config override, identity persistence, graceful SIGTERM, no secret in layers); the index also carries the two attestation manifests from sbom: true / provenance: mode=max, and the OCI label set is pinned in publish-docker.yml. Direct local label inspection was not possible (no Docker daemon; registry blob reads denied), so label values rest on the green build, not on a local byte check
• Verify that the documentation is updated — live site carries the release content (see Publications above)
• Verify that the API schema is updated — live openapi.yaml contains the release fields (repairBacklogGraceCycles, upload_concurrency codes)
• Verify the README and documentation quick starts against the published image — covered per architecture by the publish workflow's smoke test; not re-run locally (no Docker daemon on this machine)
• Verify the repository presentation: description, topics, website, and the release marked as latest — description, homepage https://ipfs-node.docs.adamant.im, and 16 topics set; releases/latest returns v0.1.0 from master

Known blocker: Security Audit fails on master after the merge

The master push of #38 is green in CI and Container, but Security Audit / npm Dependency Audit fails on Run production dependency policy with blocking high-severity advisories in undici (e.g. GHSA-3wwx-pv8p-q78v, plus related cache/cookie/TLS entries), reachable transitively via @libp2p/http → @helia/libp2p, with no fix available. The same content passed the audit on dev on 2026-09-28, so this is a newly published advisory batch, not a regression from the merge. Dependency remediation is out of scope for the release cut and is left as follow-up work.

Notes

The publication gate now points at master

.github/workflows/publish-docker.yml used to require the release tag to be an ancestor of dev, which meant a merge commit on master could not be tagged and published. It now requires the tag to be an ancestor of master, so:

• Chore: Merge dev into master for the v0.1.0 release #38 can be merged with any method, including the GitHub merge button
• a tag left on dev or on a feature branch is refused before anything is built, which is the point: a release comes from master only
• the existing v0.1.0 tag, which sits on dev at 262464c, would now be refused if its release were re-published as is. It has to be moved to the master commit

The Container workflow also runs on master now, so the image publication will build is smoke-tested on both architectures before the tag exists. The branch model is written down in AGENTS.md and on the contributing page.

Re-publishing over the existing tag

The release is not immutable, so v0.1.0 can be deleted and re-created. Re-publishing triggers publish-docker.yml again and overwrites 0.1.0 and latest in GHCR. Re-using the same version number is defensible here because the rebuild fixes the OCI labels on the published image and picks up the mesh-reliability and CORS changes (#40, #42, #45, #47, #48), all of which passed CI, Container smoke tests on both architectures, Docs, and Security Audit on dev and on #38. If the version number must stay pinned to exactly one artifact, bump to 0.1.1 in the same change instead.

Out of scope

• npm publication: package.json keeps private: true, so this release distributes a container image and a source checkout, not an npm package
• App Store, Google Play, and YouTube steps from the organization release template do not apply to a server-side product
• The documentation site deploys from dev only and deliberately has no release trigger (Chore: Drop the unreachable docs release trigger and keep the image title #36), so merging into master does not redeploy it
• ci: add DockSec container scan with SARIF upload #43 (DockSec container scan with SARIF upload) is still open and is not part of this release