chore(deps): update jdx/packslip action to v1.4.0

[jdx]

https://entire.io/gh/jdx/usage/trails/54

Updates jdx/packslip to v1.4.0, pinned by SHA.

What changes for this release workflow:

• Linux archives whose executables are fully static no longer get labelled libc: gnu when the file name does not say, so musl hosts such as Alpine can select them.
• goreleaser-style 386, plain arm, and a few other architecture spellings are now recognized, and a Linux/BSD artifact whose architecture cannot be inferred is refused instead of being recorded as fitting every architecture. This release's current asset names all name an architecture, so nothing here should trip it.
• packslip verify now reports the signing repository and owner IDs, which consumers use to follow renamed repositories safely.

AI-assisted — Tool: Claude Code; model: anthropic/claude-opus-5-5; version: unavailable.

🤖 Generated with Claude Code

---

Note

Low Risk
Single dependency pin in the release workflow; no application code or packslip configuration changes beyond the action version.

Overview
Bumps the jdx/packslip step in publish-cli from v1.2.0 to v1.4.0, still pinned by commit SHA. No workflow inputs or artifact patterns change—only the action version used when signing the release inventory after CLI builds land.

Consumers of that packslip indirectly get v1.4.0 behavior: more accurate libc labels for fully static Linux binaries (so musl hosts like Alpine can pick them), stricter architecture inference (unknown arch on Linux/BSD fails instead of matching everything), and packslip verify output that includes signing repository and owner IDs for safer tracking if repos are renamed.

^{Reviewed by Cursor Bugbot for commit 434a203. Bugbot is set up for automated code reviews on this repo. Configure here.}

Summary by CodeRabbit

• Chores
  • Updated the CLI publishing process. The packaged binaries and resources remain unchanged, so this update does not change the CLI features or the contents users receive. No user-facing changes are included in this release.

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Central YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Advanced

Run ID: d08a4f2f-f123-4b08-a77e-d0b8ac3e90f6

📥 Commits

Reviewing files that changed from the base of the PR and between f3698cb and 434a203.

📒 Files selected for processing (1)

• .github/workflows/publish-cli.yml

Included review availability: This review used your included allowance. Your plan provides up to 4 included reviews per hour; 1 remain after this review.

---

📝 Walkthrough

Walkthrough

The CLI publishing workflow updates the packslip action from v1.2.0 to v1.4.0. Its configured artifacts, binary, and resources remain unchanged.

Changes

CLI publishing

Layer / File(s)	Summary
Packslip action version .github/workflows/publish-cli.yml	The workflow now references packslip v1.4.0 instead of v1.2.0. Configured artifacts, binary, and resources are unchanged.

Priority: ⬇️ Low

Estimated code review effort: 1 (Trivial) | ~5 minutes

Change: Other

Merge Risk: ⚪ Minimal · up to 434a2

The Packslip update preserves the workflow’s existing artifact and resource behavior; no material merge risk is evident.

Architecture Summary

Architecture risk: 🔵 Low · up to 434a2

The changed surface does not map to a changed system, dependency edge, entrypoint, or external dependency.

Changed systems: None identified.

Architecture concerns
No architecture-level concerns identified.

Review details

Before / after behavior

• observed — Modified behavior in .github/workflows/publish-cli.yml: The packslip action reference changes from v1.2.0 to v1.4.0.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely identifies the dependency update from jdx/packslip to v1.4.0, which is the main change.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[greptile-apps]

Confidence Score: 5/5

[High risk] Updates a third-party GitHub Actions dependency.

The PR appears safe to merge based on the reviewed workflow change.

Summary

Updates the release workflow’s SHA-pinned jdx/packslip action from v1.2.0 to v1.4.0.

• The workflow’s artifact patterns, action inputs, and release-job ordering remain unchanged.

_{Reviews (1) · Last reviewed commit: "chore(deps): update jdx/packslip action ..."}

[github-actions]

Instruction counts

benchmark	trend	instructions	Δ	wall (min)	Δ
markdown	▁▁▁▁▂█▅▅	285,874,362 → 285,847,287	-0.01%	49.65 → 49.76ms	+0.22%
startup	▁▁▁▅▅▇▁█	1,053,588 → 1,060,411	+0.65%	1.39 → 1.37ms	-1.24%

No instruction-count regression above 1%.

_{Only instruction counts gate. Wall clock is shown for context — on identical hardware it moves 4-20% run to run.}

_{Measured by tak — instruction-counted CLI benchmarks, stored in this repository's git notes.}

Shadow comparison

Parsing mise use -g node@20 against a shadow of mise's committed spec.
Reported, not gated: the shadow grows as the derive learns to express more, so
what to watch is the ratio rather than either column.

framework	stripped binary, bytes
usage	1262000
bpaf	2494656
clap	3100904

framework	instructions, cold parse	vs usage
usage	8530	—
clap	6314978	740x
bpaf	21909298	2568x

                                              min       p01       p10    median
usage-rs: argv -> struct                      798       799       802       827  ns
clap: build tree + parse -> struct        1234648   1240794   1252859   1268152  ns
bpaf: build parser + parse -> struct      3390555   3390555   3432736   3486943  ns

usage: argv -> struct                             774 ns      0.77 µs
clap: build tree + parse -> struct            1254364 ns   1254.36 µs
clap: parse -> struct, tree reused              49954 ns     49.95 µs
clap: build tree only                          747319 ns    747.32 µs

_{434a2032ea04 vs f3698cb31f89 · measured on the runner, not pushed to the history.}