ci: replace upstream release pipeline with npm Trusted Publishing

Recovered from the 2026-06-27 snapshot import by classifying the base..snapshot delta at line granularity. Upstream base: d054b884 (2026-04-10).

.github/workflows/deploy-docs.yml

@@ -1,48 +0,0 @@
-name: Deploy Docs to GitHub Pages
-
-on:
-  push:
-    branches: [main]
-    paths:
-      - 'hindsight-docs/**'
-      - '.github/workflows/deploy-docs.yml'
-  workflow_dispatch:
-
-permissions:
-  contents: read
-  pages: write
-  id-token: write
-
-concurrency:
-  group: pages
-  cancel-in-progress: false
-
-jobs:
-  build:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v6
-      - uses: actions/setup-node@v6
-        with:
-          node-version: 20
-          cache: npm
-          cache-dependency-path: package-lock.json
-      - uses: astral-sh/setup-uv@v7
-      - run: npm ci --workspace=hindsight-docs
-      - run: uv run generate-llms-full
-      - run: npm run build --workspace=hindsight-docs
-        env:
-          UMAMI_URL: https://analytics.hindsight.vectorize.io
-          UMAMI_WEBSITE_ID: ${{ secrets.UMAMI_WEBSITE_ID }}
-      - uses: actions/upload-pages-artifact@v4
-        with:
-          path: hindsight-docs/build
-  deploy:
-    environment:
-      name: github-pages
-      url: ${{ steps.deployment.outputs.page_url }}
-    runs-on: ubuntu-latest
-    needs: build
-    steps:
-      - uses: actions/deploy-pages@v5
-        id: deployment

.github/workflows/publish.yml

@@ -0,0 +1,43 @@
+name: Publish to npm
+
+# Publishes rcll-mcp to npm via OIDC Trusted Publishing.
+# No NPM_TOKEN needed — npm verifies this workflow's identity through the
+# Trusted Publisher trust configured on npmjs.com (holetron-lab/rcll).
+# NOTE: that trust entry is per package AND per repo. It has to be re-created on
+# npmjs.com for rcll-mcp + holetron-lab/rcll before the first release fires,
+# otherwise the publish step fails with an OIDC mismatch.
+# Fires when a GitHub Release is published; the release tag is the source of truth
+# for the version already set in mcp-server/package.json.
+
+on:
+  release:
+    types: [published]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  id-token: write        # required for OIDC provenance + Trusted Publishing
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: mcp-server
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '20'
+          registry-url: 'https://registry.npmjs.org'
+
+      # Trusted Publishing + provenance require npm >= 11.5.1
+      - name: Upgrade npm
+        run: npm install -g npm@latest
+
+      - name: Install dependencies
+        run: npm ci || npm install
+
+      - name: Publish
+        run: npm publish --provenance --access public

.github/workflows/release-integration.yml

@@ -1,111 +0,0 @@
-name: Release Integration
-
-on:
-  push:
-    tags:
-      - 'integrations/**'
-
-jobs:
-  publish:
-    runs-on: ubuntu-latest
-    permissions:
-      id-token: write  # for PyPI trusted publishing
-
-    steps:
-    - uses: actions/checkout@v6
-
-    - name: Extract integration info
-      id: info
-      run: |
-        # refs/tags/integrations/litellm/v0.1.0 → integration=litellm, version=0.1.0
-        TAG="${GITHUB_REF#refs/tags/}"
-        INTEGRATION=$(echo "$TAG" | cut -d'/' -f2)
-        VERSION=$(echo "$TAG" | cut -d'/' -f3 | sed 's/^v//')
-        echo "integration=$INTEGRATION" >> $GITHUB_OUTPUT
-        echo "version=$VERSION" >> $GITHUB_OUTPUT
-        echo "tag=$TAG" >> $GITHUB_OUTPUT
-        echo "Integration: $INTEGRATION, Version: $VERSION"
-
-    - name: Detect integration type
-      id: type
-      run: |
-        if [ -f "hindsight-integrations/${{ steps.info.outputs.integration }}/pyproject.toml" ]; then
-          echo "type=python" >> $GITHUB_OUTPUT
-        elif [ -f "hindsight-integrations/${{ steps.info.outputs.integration }}/package.json" ]; then
-          echo "type=typescript" >> $GITHUB_OUTPUT
-        else
-          echo "type=plugin" >> $GITHUB_OUTPUT
-        fi
-
-    # ── Python integrations (litellm, pydantic-ai, crewai) ──────────────────
-
-    - name: Install uv
-      if: steps.type.outputs.type == 'python'
-      uses: astral-sh/setup-uv@v7
-      with:
-        enable-cache: true
-
-    - name: Set up Python
-      if: steps.type.outputs.type == 'python'
-      uses: actions/setup-python@v6
-      with:
-        python-version-file: ".python-version"
-
-    - name: Build Python package
-      if: steps.type.outputs.type == 'python'
-      working-directory: ./hindsight-integrations/${{ steps.info.outputs.integration }}
-      run: uv build --out-dir dist
-
-    - name: Publish Python package to PyPI
-      if: steps.type.outputs.type == 'python'
-      uses: pypa/gh-action-pypi-publish@release/v1
-      with:
-        packages-dir: ./hindsight-integrations/${{ steps.info.outputs.integration }}/dist
-        skip-existing: true
-
-    # ── TypeScript integrations (ai-sdk, chat, openclaw) ────────────────────
-
-    # ── Plugin integrations (claude-code) — no package to publish ───────────
-
-    - name: Plugin release
-      if: steps.type.outputs.type == 'plugin'
-      run: |
-        echo "Plugin integration ${{ steps.info.outputs.integration }} v${{ steps.info.outputs.version }} — no package to publish."
-        echo "Users install via: claude plugin marketplace add vectorize-io/hindsight --sparse hindsight-integrations"
-
-    # ── TypeScript integrations (ai-sdk, chat, openclaw) ────────────────────
-
-    - name: Set up Node.js
-      if: steps.type.outputs.type == 'typescript'
-      uses: actions/setup-node@v6
-      with:
-        node-version: '22'
-        registry-url: 'https://registry.npmjs.org'
-
-    - name: Install dependencies
-      if: steps.type.outputs.type == 'typescript'
-      working-directory: ./hindsight-integrations/${{ steps.info.outputs.integration }}
-      run: npm ci
-
-    - name: Build TypeScript package
-      if: steps.type.outputs.type == 'typescript'
-      working-directory: ./hindsight-integrations/${{ steps.info.outputs.integration }}
-      run: npm run build
-
-    - name: Publish TypeScript package to npm
-      if: steps.type.outputs.type == 'typescript'
-      working-directory: ./hindsight-integrations/${{ steps.info.outputs.integration }}
-      run: |
-        set +e
-        OUTPUT=$(npm publish --access public 2>&1)
-        EXIT_CODE=$?
-        echo "$OUTPUT"
-        if [ $EXIT_CODE -ne 0 ]; then
-          if echo "$OUTPUT" | grep -q "cannot publish over"; then
-            echo "Package version already published, skipping..."
-            exit 0
-          fi
-          exit $EXIT_CODE
-        fi
-      env:
-        NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}

.github/workflows/release.yml

@@ -1,550 +0,0 @@
-name: Release
-
-on:
-  push:
-    tags:
-      - 'v*'
-
-jobs:
-  release-python-packages:
-    runs-on: ubuntu-latest
-    environment: pypi
-    permissions:
-      id-token: write
-
-    steps:
-    - uses: actions/checkout@v6
-
-    - name: Install uv
-      uses: astral-sh/setup-uv@v7
-      with:
-        enable-cache: true
-
-    - name: Set up Python
-      uses: actions/setup-python@v6
-      with:
-        python-version-file: ".python-version"
-
-    # Build all packages
-    - name: Build hindsight-client
-      working-directory: ./hindsight-clients/python
-      run: uv build --out-dir dist
-
-    - name: Build hindsight-api-slim
-      working-directory: ./hindsight-api-slim
-      run: uv build --out-dir dist
-
-    - name: Build hindsight-api
-      working-directory: ./hindsight-api
-      run: uv build --out-dir dist
-
-    - name: Build hindsight-all
-      working-directory: ./hindsight-all
-      run: uv build --out-dir dist
-
-    - name: Build hindsight-all-slim
-      working-directory: ./hindsight-all-slim
-      run: uv build --out-dir dist
-
-    - name: Build hindsight-embed
-      working-directory: ./hindsight-embed
-      run: uv build --out-dir dist
-
-    # Publish in order (client and api-slim first, then api/all wrappers which depend on them)
-    - name: Publish hindsight-client to PyPI
-      uses: pypa/gh-action-pypi-publish@release/v1
-      with:
-        packages-dir: ./hindsight-clients/python/dist
-        skip-existing: true
-
-    - name: Publish hindsight-api-slim to PyPI
-      uses: pypa/gh-action-pypi-publish@release/v1
-      with:
-        packages-dir: ./hindsight-api-slim/dist
-        skip-existing: true
-
-    - name: Publish hindsight-api to PyPI
-      uses: pypa/gh-action-pypi-publish@release/v1
-      with:
-        packages-dir: ./hindsight-api/dist
-        skip-existing: true
-
-    - name: Publish hindsight-all to PyPI
-      uses: pypa/gh-action-pypi-publish@release/v1
-      with:
-        packages-dir: ./hindsight-all/dist
-        skip-existing: true
-
-    - name: Publish hindsight-all-slim to PyPI
-      uses: pypa/gh-action-pypi-publish@release/v1
-      with:
-        packages-dir: ./hindsight-all-slim/dist
-        skip-existing: true
-
-    - name: Publish hindsight-embed to PyPI
-      uses: pypa/gh-action-pypi-publish@release/v1
-      with:
-        packages-dir: ./hindsight-embed/dist
-        skip-existing: true
-
-    # Upload artifacts for GitHub release
-    - name: Upload artifacts
-      uses: actions/upload-artifact@v7
-      with:
-        name: python-packages
-        path: |
-          hindsight-clients/python/dist/*
-          hindsight-api-slim/dist/*
-          hindsight-api/dist/*
-          hindsight-all/dist/*
-          hindsight-all-slim/dist/*
-          hindsight-embed/dist/*
-        retention-days: 1
-
-  release-typescript-client:
-    runs-on: ubuntu-latest
-    environment: npm
-
-    steps:
-    - uses: actions/checkout@v6
-
-    - name: Set up Node.js
-      uses: actions/setup-node@v6
-      with:
-        node-version: '20'
-        registry-url: 'https://registry.npmjs.org'
-        cache: 'npm'
-        cache-dependency-path: package-lock.json
-
-    - name: Install dependencies
-      run: npm ci --workspace=hindsight-clients/typescript
-
-    - name: Build
-      run: npm run build --workspace=hindsight-clients/typescript
-
-    - name: Publish to npm
-      working-directory: ./hindsight-clients/typescript
-      run: |
-        set +e
-        OUTPUT=$(npm publish --access public 2>&1)
-        EXIT_CODE=$?
-        echo "$OUTPUT"
-        if [ $EXIT_CODE -ne 0 ]; then
-          if echo "$OUTPUT" | grep -q "cannot publish over"; then
-            echo "Package version already published, skipping..."
-            exit 0
-          fi
-          exit $EXIT_CODE
-        fi
-      env:
-        NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
-
-    - name: Pack for GitHub release
-      working-directory: ./hindsight-clients/typescript
-      run: npm pack
-
-    - name: Upload artifacts
-      uses: actions/upload-artifact@v7
-      with:
-        name: typescript-client
-        path: hindsight-clients/typescript/*.tgz
-        retention-days: 1
-
-  release-hindsight-all-npm:
-    runs-on: ubuntu-latest
-    environment: npm
-
-    steps:
-    - uses: actions/checkout@v6
-
-    - name: Set up Node.js
-      uses: actions/setup-node@v6
-      with:
-        node-version: '22'
-        registry-url: 'https://registry.npmjs.org'
-        cache: 'npm'
-        cache-dependency-path: package-lock.json
-
-    - name: Install dependencies
-      run: npm ci --workspace=hindsight-all-npm
-
-    - name: Build
-      run: npm run build --workspace=hindsight-all-npm
-
-    - name: Publish to npm
-      working-directory: ./hindsight-all-npm
-      run: |
-        set +e
-        OUTPUT=$(npm publish --access public 2>&1)
-        EXIT_CODE=$?
-        echo "$OUTPUT"
-        if [ $EXIT_CODE -ne 0 ]; then
-          if echo "$OUTPUT" | grep -q "cannot publish over"; then
-            echo "Package version already published, skipping..."
-            exit 0
-          fi
-          exit $EXIT_CODE
-        fi
-      env:
-        NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
-
-    - name: Pack for GitHub release
-      working-directory: ./hindsight-all-npm
-      run: npm pack
-
-    - name: Upload artifacts
-      uses: actions/upload-artifact@v7
-      with:
-        name: hindsight-all-npm
-        path: hindsight-all-npm/*.tgz
-        retention-days: 1
-
-  release-control-plane:
-    runs-on: ubuntu-latest
-    environment: npm
-
-    steps:
-    - uses: actions/checkout@v6
-
-    - name: Set up Node.js
-      uses: actions/setup-node@v6
-      with:
-        node-version: '20'
-        registry-url: 'https://registry.npmjs.org'
-        cache: 'npm'
-        cache-dependency-path: package-lock.json
-
-    - name: Install dependencies
-      run: npm ci
-
-    - name: Build TypeScript client (dependency)
-      run: npm run build --workspace=hindsight-clients/typescript
-
-    - name: Fix platform-specific native modules
-      run: |
-        # npm ci installs from lockfile which may have wrong platform binaries
-        # Delete hoisted native modules and reinstall for current platform
-        rm -rf node_modules/lightningcss node_modules/@tailwindcss
-        npm install lightningcss @tailwindcss/postcss @tailwindcss/node
-
-    - name: Build
-      run: npm run build --workspace=hindsight-control-plane
-
-    - name: Verify standalone build
-      run: test -f hindsight-control-plane/standalone/server.js || (echo 'standalone/server.js missing - build failed' && exit 1)
-
-    - name: Publish to npm
-      working-directory: ./hindsight-control-plane
-      run: |
-        set +e
-        OUTPUT=$(npm publish --access public --ignore-scripts 2>&1)
-        EXIT_CODE=$?
-        echo "$OUTPUT"
-        if [ $EXIT_CODE -ne 0 ]; then
-          if echo "$OUTPUT" | grep -q "cannot publish over"; then
-            echo "Package version already published, skipping..."
-            exit 0
-          fi
-          exit $EXIT_CODE
-        fi
-      env:
-        NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
-
-    - name: Pack for GitHub release
-      working-directory: ./hindsight-control-plane
-      run: npm pack
-
-    - name: Upload artifacts
-      uses: actions/upload-artifact@v7
-      with:
-        name: control-plane
-        path: hindsight-control-plane/*.tgz
-        retention-days: 1
-
-  release-rust-cli:
-    runs-on: ${{ matrix.os }}
-    strategy:
-      matrix:
-        include:
-          - os: ubuntu-latest
-            target: x86_64-unknown-linux-gnu
-            artifact_name: hindsight
-            asset_name: hindsight-linux-amd64
-          - os: macos-latest
-            target: x86_64-apple-darwin
-            artifact_name: hindsight
-            asset_name: hindsight-darwin-amd64
-          - os: macos-latest
-            target: aarch64-apple-darwin
-            artifact_name: hindsight
-            asset_name: hindsight-darwin-arm64
-          - os: ubuntu-24.04-arm
-            target: aarch64-unknown-linux-gnu
-            artifact_name: hindsight
-            asset_name: hindsight-linux-arm64
-
-    steps:
-    - uses: actions/checkout@v6
-
-    - name: Install Rust
-      uses: dtolnay/rust-toolchain@stable
-      with:
-        targets: ${{ matrix.target }}
-
-    - name: Build
-      working-directory: hindsight-cli
-      run: cargo build --release --target ${{ matrix.target }}
-
-    - name: Prepare artifact
-      run: |
-        mkdir -p artifacts
-        cp hindsight-cli/target/${{ matrix.target }}/release/${{ matrix.artifact_name }} artifacts/${{ matrix.asset_name }}
-        chmod +x artifacts/${{ matrix.asset_name }}
-
-    - name: Upload artifacts
-      uses: actions/upload-artifact@v7
-      with:
-        name: rust-cli-${{ matrix.asset_name }}
-        path: artifacts/${{ matrix.asset_name }}
-        retention-days: 1
-
-  release-docker-images:
-    name: Release Docker (${{ matrix.image_name }}${{ matrix.tag_suffix }})
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      packages: write
-    strategy:
-      matrix:
-        include:
-          - target: api-only
-            image_name: hindsight-api
-            tag_suffix: ""
-            build_args: ""
-          - target: api-only
-            image_name: hindsight-api
-            tag_suffix: "-slim"
-            build_args: |
-              INCLUDE_LOCAL_MODELS=false
-              PRELOAD_ML_MODELS=false
-          - target: cp-only
-            image_name: hindsight-control-plane
-            tag_suffix: ""
-            build_args: ""
-          - target: standalone
-            image_name: hindsight
-            tag_suffix: ""
-            build_args: ""
-          - target: standalone
-            image_name: hindsight
-            tag_suffix: "-slim"
-            build_args: |
-              INCLUDE_LOCAL_MODELS=false
-              PRELOAD_ML_MODELS=false
-
-    steps:
-    - uses: actions/checkout@v6
-
-    - name: Free Disk Space
-      uses: jlumbroso/free-disk-space@main
-      with:
-        tool-cache: true
-        android: true
-        dotnet: true
-        haskell: true
-        large-packages: true
-        docker-images: true
-        swap-storage: true
-
-    - name: Set up QEMU
-      uses: docker/setup-qemu-action@v4
-
-    - name: Set up Docker Buildx
-      uses: docker/setup-buildx-action@v4
-
-    - name: Log in to GitHub Container Registry
-      uses: docker/login-action@v4
-      with:
-        registry: ghcr.io
-        username: ${{ github.actor }}
-        password: ${{ secrets.GITHUB_TOKEN }}
-
-    - name: Extract version from tag
-      id: get_version
-      run: echo "VERSION=${GITHUB_REF#refs/tags/v}" >> $GITHUB_OUTPUT
-
-    - name: Extract metadata for release tags
-      id: meta
-      uses: docker/metadata-action@v6
-      with:
-        images: ghcr.io/${{ github.repository_owner }}/${{ matrix.image_name }}
-        flavor: |
-          latest=auto
-          suffix=${{ matrix.tag_suffix }}
-        tags: |
-          type=semver,pattern={{version}},value=${{ steps.get_version.outputs.VERSION }}
-          type=semver,pattern={{major}}.{{minor}},value=${{ steps.get_version.outputs.VERSION }}
-          type=semver,pattern={{major}},value=${{ steps.get_version.outputs.VERSION }}
-          type=raw,value=latest
-
-    # TODO: Re-enable smoke test when disk space issue is resolved
-    # # Step 1: Build for local testing (single platform, no push)
-    # # This creates an identical image to what will be released, just for one platform
-    # - name: Build image for testing
-    #   uses: docker/build-push-action@v7
-    #   with:
-    #     context: .
-    #     file: docker/standalone/Dockerfile
-    #     target: ${{ matrix.target }}
-    #     push: false
-    #     load: true
-    #     tags: ${{ matrix.image_name }}:test
-    #     cache-from: type=gha
-    #     cache-to: type=gha,mode=max
-
-    # # Step 2: Test the image before pushing anything
-    # - name: Smoke test - verify container starts
-    #   env:
-    #     GROQ_API_KEY: ${{ secrets.GROQ_API_KEY }}
-    #   run: ./docker/test-image.sh "${{ matrix.image_name }}:test" "${{ matrix.target }}"
-
-    # Build multi-platform and push to release tags
-    - name: Build and push release images
-      uses: docker/build-push-action@v7
-      with:
-        context: .
-        file: docker/standalone/Dockerfile
-        target: ${{ matrix.target }}
-        build-args: ${{ matrix.build_args }}
-        push: true
-        platforms: linux/amd64,linux/arm64
-        tags: ${{ steps.meta.outputs.tags }}
-        labels: ${{ steps.meta.outputs.labels }}
-
-  release-helm-chart:
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      packages: write
-
-    steps:
-    - uses: actions/checkout@v6
-
-    - name: Install Helm
-      uses: azure/setup-helm@v5
-      with:
-        version: 'latest'
-
-    - name: Log in to GHCR
-      run: echo "${{ secrets.GITHUB_TOKEN }}" | helm registry login ghcr.io -u ${{ github.actor }} --password-stdin
-
-    - name: Lint Helm chart
-      run: helm lint helm/hindsight
-
-    - name: Package Helm chart
-      run: helm package helm/hindsight --destination ./helm-packages
-
-    - name: Push to GHCR OCI
-      run: helm push helm-packages/*.tgz oci://ghcr.io/${{ github.repository_owner }}/charts
-
-    - name: Upload artifacts
-      uses: actions/upload-artifact@v7
-      with:
-        name: helm-chart
-        path: helm-packages/*.tgz
-        retention-days: 1
-
-  create-github-release:
-    runs-on: ubuntu-latest
-    needs: [release-python-packages, release-typescript-client, release-hindsight-all-npm, release-control-plane, release-rust-cli, release-docker-images, release-helm-chart]
-    permissions:
-      contents: write
-
-    steps:
-    - uses: actions/checkout@v6
-
-    - name: Extract version from tag
-      id: get_version
-      run: echo "VERSION=${GITHUB_REF#refs/tags/v}" >> $GITHUB_OUTPUT
-
-    - name: Download Python packages
-      uses: actions/download-artifact@v8
-      with:
-        name: python-packages
-        path: ./artifacts/python-packages
-
-    - name: Download TypeScript client
-      uses: actions/download-artifact@v8
-      with:
-        name: typescript-client
-        path: ./artifacts/typescript-client
-
-    - name: Download Control Plane
-      uses: actions/download-artifact@v8
-      with:
-        name: control-plane
-        path: ./artifacts/control-plane
-
-    - name: Download hindsight-embed npm wrapper
-      uses: actions/download-artifact@v8
-      with:
-        name: hindsight-all-npm
-        path: ./artifacts/hindsight-all-npm
-
-    - name: Download Rust CLI (Linux)
-      uses: actions/download-artifact@v8
-      with:
-        name: rust-cli-hindsight-linux-amd64
-        path: ./artifacts/rust-cli-linux
-
-    - name: Download Rust CLI (macOS Intel)
-      uses: actions/download-artifact@v8
-      with:
-        name: rust-cli-hindsight-darwin-amd64
-        path: ./artifacts/rust-cli-darwin-amd64
-
-    - name: Download Rust CLI (macOS ARM)
-      uses: actions/download-artifact@v8
-      with:
-        name: rust-cli-hindsight-darwin-arm64
-        path: ./artifacts/rust-cli-darwin-arm64
-
-    - name: Download Helm chart
-      uses: actions/download-artifact@v8
-      with:
-        name: helm-chart
-        path: ./artifacts/helm-chart
-
-    - name: Prepare release assets
-      run: |
-        mkdir -p release-assets
-        # Python packages
-        cp artifacts/python-packages/hindsight-clients/python/dist/* release-assets/ || true
-        cp artifacts/python-packages/hindsight-api-slim/dist/* release-assets/ || true
-        cp artifacts/python-packages/hindsight-api/dist/* release-assets/ || true
-        cp artifacts/python-packages/hindsight-all/dist/* release-assets/ || true
-        cp artifacts/python-packages/hindsight-all-slim/dist/* release-assets/ || true
-        cp artifacts/python-packages/hindsight-embed/dist/* release-assets/ || true
-        # TypeScript client
-        cp artifacts/typescript-client/*.tgz release-assets/ || true
-        # hindsight-embed npm wrapper
-        cp artifacts/hindsight-all-npm/*.tgz release-assets/ || true
-        # Control Plane
-        cp artifacts/control-plane/*.tgz release-assets/ || true
-        # Rust CLI binaries
-        cp artifacts/rust-cli-linux/hindsight-linux-amd64 release-assets/ || true
-        cp artifacts/rust-cli-darwin-amd64/hindsight-darwin-amd64 release-assets/ || true
-        cp artifacts/rust-cli-darwin-arm64/hindsight-darwin-arm64 release-assets/ || true
-        # Helm chart
-        cp artifacts/helm-chart/*.tgz release-assets/ || true
-        ls -la release-assets/
-
-    - name: Create GitHub Release
-      uses: softprops/action-gh-release@v2
-      with:
-        files: release-assets/*
-        generate_release_notes: true
-        draft: false
-        prerelease: false
-      env:
-        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.gitignore

@@ -15,8 +15,13 @@ node_modules/
 
 # Environment variables and local config
 .env
+*.env
 docker-compose.yml
 docker-compose.override.yml
+ecosystem.config.*
+
+# Python virtualenvs
+venv/
 
 # IDE
 .idea/
@@ -57,4 +62,11 @@ TASK.md
 # Changelog is now tracked in hindsight-docs/src/pages/changelog.md
 # CHANGELOG.md
 
-blog-post*
+blog-post*.github/workflows/
+
+# Session keys
+.sesskey
+*/.sesskey
+
+# Additional virtualenvs
+**/venv/