release: v0.4.0 — Apache-2.0, core@v0.8.0, and a pre-commit rev that resolves

.github/workflows/reviewer.yml

@@ -35,7 +35,7 @@ jobs:
           python-version: "3.12"
       - name: Install signetry-reviewer
         # Not published to PyPI; install from source at a pinned git tag.
-        run: pip install "signetry-reviewer @ git+https://github.com/Signetry/reviewer@v0.2.0"
+        run: pip install "signetry-reviewer @ git+https://github.com/Signetry/reviewer@v0.3.0"
       - name: Compute the PR diff
         env:
           BASE_SHA: ${{ github.event.pull_request.base.sha }}

.pre-commit-hooks.yaml

@@ -2,11 +2,11 @@
 #
 #   repos:
 #     - repo: https://github.com/Signetry/precommit
-#       rev: v0.3.0
+#       rev: v0.4.0
 #       hooks:
 #         - id: signetry-guard
 #
-# Requires: pip install "signetry-core @ git+https://github.com/Signetry/core@v0.7.0"
+# Requires: pip install "signetry-core @ git+https://github.com/Signetry/core@v0.8.0"
 - id: signetry-guard
   name: Signetry guard (contract scope check)
   description: Block staged changes that fall outside .signetry/admission.yaml scope.

CHANGELOG.md

@@ -2,7 +2,20 @@
 
 Follows [Keep a Changelog](https://keepachangelog.com/) / [SemVer](https://semver.org/).
 
-## [Unreleased]
+## [0.4.0] — 2026-09-01
+
+> First release **tagged in this repository**. The `0.3.0` entry below describes a
+> release cut in the pre-move repo, whose tag did not survive the org move — see the
+> `Fixed` note.
+
+### Fixed — the documented pre-commit install could not resolve
+
+- `README.md` and `.pre-commit-hooks.yaml` both told users `rev: v0.3.0`, and
+  `pre-commit` resolves `rev` as a git ref **in this repository**, which has no tags
+  at all: the tag from the `0.3.0` release lived in the pre-move repo and did not
+  come across. So the primary documented install path failed outright with a
+  revision error — not a fallback, not a warning. Both now say `v0.4.0`, the tag this
+  release actually creates.
 
 ### Changed
 

CONTRIBUTING.md

@@ -46,7 +46,7 @@ The guard itself is a POSIX shell wrapper — there is no build step and no Pyth
 package in this repo. It shells out to the `signetry` CLI, so install the engine first:
 
 ```bash
-pip install "signetry-core @ git+https://github.com/Signetry/core@v0.7.0"
+pip install "signetry-core @ git+https://github.com/Signetry/core@v0.8.0"
 ```
 
 Then exercise the guard end-to-end against a throwaway repo with a sample

README.md

@@ -11,7 +11,7 @@ a deterministic pre-action check that blocks changes falling outside your repo's
 
 Part of the [Signetry platform](https://github.com/Signetry/signetry).
 
-> Prerequisite: `pip install "signetry-core @ git+https://github.com/Signetry/core@v0.7.0"` and a `.signetry/admission.yaml` in
+> Prerequisite: `pip install "signetry-core @ git+https://github.com/Signetry/core@v0.8.0"` and a `.signetry/admission.yaml` in
 > your repo (a conservative default applies without one).
 
 ## pre-commit
@@ -21,7 +21,7 @@ Add to your `.pre-commit-config.yaml`:
 ```yaml
 repos:
   - repo: https://github.com/Signetry/precommit
-    rev: v0.3.0
+    rev: v0.4.0
     hooks:
       - id: signetry-guard
 ```

demos/try-guard.sh

@@ -6,7 +6,7 @@
 # .signetry/admission.yaml, showing forbidden paths/commands blocked and an in-scope
 # path allowed. Deterministic (signetry-core), never the model.
 #
-# Requirements: bash, git, and `pip install "signetry-core @ git+https://github.com/Signetry/core@v0.7.0"`.
+# Requirements: bash, git, and `pip install "signetry-core @ git+https://github.com/Signetry/core@v0.8.0"`.
 #
 # Usage:  bash demos/try-guard.sh
 set -euo pipefail

universal/signetry-guard.sh

@@ -6,7 +6,7 @@
 # or manually. It checks proposed file paths and/or a command against the repo's
 # .signetry/admission.yaml and exits non-zero (blocking) on a violation.
 #
-# Requires:  pip install "signetry-core @ git+https://github.com/Signetry/core@v0.7.0"
+# Requires:  pip install "signetry-core @ git+https://github.com/Signetry/core@v0.8.0"
 #
 # Usage:
 #   signetry-guard.sh --path src/app.py
@@ -17,7 +17,7 @@
 set -euo pipefail
 
 if ! command -v signetry >/dev/null 2>&1; then
-  echo "signetry-guard: signetry-core not installed. Run: pip install 'signetry-core @ git+https://github.com/Signetry/core@v0.7.0'" >&2
+  echo "signetry-guard: signetry-core not installed. Run: pip install 'signetry-core @ git+https://github.com/Signetry/core@v0.8.0'" >&2
   # Fail open by default so this never blocks a commit unexpectedly; set
   # SIGNETRY_GUARD_STRICT=1 to fail closed when signetry is missing.
   [ "${SIGNETRY_GUARD_STRICT:-0}" = "1" ] && exit 1 || exit 0