Repository navigation
Launch v0.3.0: crates.io, brew, demo, Show HN (2026-10-24 plan) #211
Description
Tracking issue for the launch plan written 2026-10-24: docs/reviews/2026-10-24-launch-plan.md (on the owner's checkout; not yet committed).
Goal. Turn the most mature UnityInFlow tool (84 patterns, 482 tests green, 5 releases, 0 stars, 19 downloads of v0.2.0) into something a stranger can install in one line and judge in 30 seconds — then put it in front of people once. Packaging and words only; no new detection work in this release.
Definition of done
-
cargo install injection-scannerworks on a clean machine (crates.io name confirmed free today: API returns 404) -
brew install unityinflow/tap/injection-scannerworks (macOS arm64 + x86_64, Linux) -
cargo binstall injection-scannerresolves the existing raw release assets - README top ≤ 20 lines: one-liners, 84 patterns / 105-of-115 / 2-of-12 held-out, demo, "what it is not"
- 20-30 s demo GIF embedded,
.tapecommitted - v0.3.0 released, SHA256SUMS + attestation verified,
spec-ci-pluginpin decision recorded - Show HN posted; r/ClaudeAI posted
- 2 directory PRs opened (awesome-claude-code Security, awesome-ai-security)
- CI and Code scanning badges on the README, both green
- Day-7 retro comment here
Steps
| Phase | Issue | Effort |
|---|---|---|
1a Cargo.toml: metadata, exclude, binstall |
#203 (umbrella #41) | 1.5 h |
| 1b release.yml: crates.io publish job (trusted publishing) | #204 | 1.5 h |
1c Homebrew formula in UnityInFlow/homebrew-tap |
#10 | 1 h |
2 README top rewrite + stale rev: v0.0.3 |
#205 | 2 h |
| 3 Demo recording (VHS) | #206 | 1.5 h |
| 4 v0.3.0 release checklist | #207 | 1.5 h |
| 5a Show HN + r/ClaudeAI drafts | #208 | 2 h |
| 5b Directory submissions | #209 | 1 h |
| 6 First-week response plan | #210 | 1 h/day × 7 |
Decisions the owner must make before step 4 (details in the plan document)
- Crate name: keep
injection-scanner(recommended; free, matches binary and clap name). - Crate contents: keep
tests/+ corpus (1.0 MB) in the crate, exclude.planning/(212 tracked files) and the reference docs (recommended), or publish source-only. - Publish CI: GitHub-hosted + crates.io trusted publishing (recommended; the only option a public repo in this org allows, and it keeps the "no org secrets" rule).
- Milestone: rename the existing v0.3.0 milestone (36 detection-gap issues, no plan) to
v0.4.0 — detection gapsand ship this as v0.3.0 (recommended), or ship as v0.2.1. - Lift the 2026-10-23 maintenance-only freeze for packaging only and say so in
.planning/STATE.md,ROADMAP.md,CLAUDE.md.
Explicitly not in this launch: Windows binary (#9), classifier (#111), runtime mode (#11), GitHub Action and library split (#41), scan profiles (#68).
Activity
hermanngeorge15 commentedon Oct 25, 2026
2026-10-25 status. Phases 1a, 1b, 2, 3 and the 5a/5b drafts are in draft PR #212 (branch
launch/v0.3.0-packaging). Topics set, milestone 5 renamed tov0.4.0: detection gaps, freeze lifted for packaging in CLAUDE.md, STATE.md and ROADMAP.md. Homebrew formula tested at 0.2.0 on tap branchinjection-scanner-formula(#10).Blocker for every workflow run: the org Actions allowlist contains only
actions/checkout@*anddtolnay/rust-toolchain@*. CI (actions/cache) and release.yml (taiki-e/install-action, upload-artifact, download-artifact, attest-build-provenance, softprops/action-gh-release, github/codeql-action, rust-lang/crates-io-auth-action) fail at startup until those patterns are added.Owner steps, in order: extend the allowlist,
cargo publish --lockedat 0.2.0 from the branch, configure trusted publishing, merge #212, bump to 0.3.0 and tag (#207), bump and merge the tap formula, then post fromdocs/launch/2026-10-launch-posts.md(#208, #209).hermanngeorge15 commentedon Oct 25, 2026
Correction to the comment above: CI on
launch/v0.3.0-packagingis green (run 40183577009); the effective allowlist already holdsactions/cache,taiki-e/install-actionandcodeql-action/upload-sarif. What is still missing, for release.yml only, isactions/upload-artifact@*,actions/download-artifact@*,actions/attest-build-provenance@*,softprops/action-gh-release@*andrust-lang/crates-io-auth-action@*. A repo-level change is refused by the API (set at the organization level), so this is an owner step in the org settings before tagging v0.3.0. Nothing was changed in the policy.