chore(main): release 1.7.0

[source-release-bot]

🤖 I have created a release beep boop

1.7.0 (2026-10-01)

Features

• accounts: add sign-ins and grant products from the section's corner (#611) (5155a90)
• accounts: add the Service Account type (#563) (274a80c)
• accounts: confirm disabling and deleting a service account, delete by typing its id (#609) (bd15356)
• accounts: end API keys in a CRC-32 checksum (#596) (cdada60)
• accounts: example usage in each sign-in row's menu, not at creation (#608) (ccd3cb5)
• accounts: explain the Ref field and link GitHub's subject examples (#612) (99ed3fa)
• accounts: highlight example usage, with its copy button in the block (#610) (8320443)
• accounts: issue an API key when creating a service account (#607) (cd2339d)
• accounts: issue, revoke and expire opaque API keys for service accounts (#570) (2bc0480)
• accounts: manage service accounts from account settings (#567) (e164f24)
• accounts: one "Signs in with" section for workflows and API keys (#606) (2c6d8fc)
• accounts: resolve accounts by (issuer, subject) (#565) (6ed15cf)
• accounts: revoke leaked API keys via self-revoke and GitHub secret scanning (#581) (2413d96)
• accounts: trust subjects per account, the way a role's trust policy does (#566) (113ecae)
• memberships: show and grant service accounts on the membership pages (#564) (78d110b)

Bug Fixes

• accounts: drop the hash-storage note from the issued-key dialog (#587) (71b6628)
• accounts: show the API key count on every service account row (#605) (faa821d)
• admin: search users as you type and list every match (#568) (73e3be9)
• auth: keep the session across a server action redirect (#604) (2572d85)
• authz: allow org owners to create products without CREATE_REPOSITORIES flag (#508) (b77a514)
• authz: limit the self-authorization shortcut to individual accounts (#562) (4482c04)
• data-connections: let a connection row wrap instead of collapsing on mobile (#532) (03b8747)
• keep unlisted products out of search engines and profile listings (#574) (37323b7)
• make organization contact email editable (#293) (a14311e)
• products: truncate a product's DOI instead of overflowing the row (#533) (4f1fab8)
• profiles: keep deactivated products listed for their owners (#579) (1f06414)
• profiles: truncate long website links instead of wrapping them (#531) (5df79d5)
• render inline markdown in product list descriptions (#603) (7e9a94a)
• seo: disallow crawling on non-production deployments (#585) (5e05878)

---

This PR was generated with Release Please. See documentation.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
source-coop-ui	Ready	Preview	Oct 1, 2026 6:42am UTC
source-cooperative	Ready	Preview	Oct 1, 2026 6:42am UTC

[alukach]

Before merging: edit the changelog. The bug fixes below already shipped in v1.6.1. That release was cut from release/1.6.x, which starts at 4482c04 (the last commit before the service-account features, #563–#567) plus a cherry-pick of #574. Release Please doesn't know about it, because v1.6.1 isn't in main's history, so this PR still counts from v1.6.0 and lists those fixes again.

We deliberately didn't merge release/1.6.x into main. Its commits are newer than the features, so Release Please would stop at the v1.6.1 commit and never read the features, and they'd be missing from 1.7.0.

Release Please rewrites this PR every time something is pushed to main, so make these edits just before merging, on this PR's branch (release-please--branches--main--components--source-cooperative):

1. In CHANGELOG.md, remove these fix lines from the 1.7.0 section (drop the ### Bug Fixes heading too if nothing is left under it). Any fix that landed on main after v1.6.1 stays.
   • authz: allow org owners to create products without CREATE_REPOSITORIES flag (fix(authz): allow org owners to create products without CREATE_REPOSITORIES flag #508)
   • authz: limit the self-authorization shortcut to individual accounts (fix(authz): limit the self-authorization shortcut to individual accounts #562)
   • data-connections: let a connection row wrap instead of collapsing on mobile (fix(data-connections): let a connection row wrap instead of collapsing on mobile #532)
   • keep unlisted products out of search engines and profile listings (fix: keep unlisted products out of search engines and profile listings #574)
   • make organization contact email editable (fix: make organization contact email editable #293)
   • products: truncate a product's DOI instead of overflowing the row (fix(products): truncate a product's DOI instead of overflowing the row #533)
   • profiles: truncate long website links instead of wrapping them (fix(profiles): truncate long website links instead of wrapping them #531)
2. In CHANGELOG.md, add the 1.6.1 section between 1.7.0 and 1.6.0. main's changelog doesn't have it yet. Here it is exactly as it shipped:

## [1.6.1](https://github.com/source-cooperative/source.coop/compare/v1.6.0...v1.6.1) (2026-09-24)


### Bug Fixes

* **authz:** allow org owners to create products without CREATE_REPOSITORIES flag ([#508](https://github.com/source-cooperative/source.coop/issues/508)) ([b77a514](https://github.com/source-cooperative/source.coop/commit/b77a514b1a68cc4c642e33b50d84379b16c88014))
* **authz:** limit the self-authorization shortcut to individual accounts ([#562](https://github.com/source-cooperative/source.coop/issues/562)) ([4482c04](https://github.com/source-cooperative/source.coop/commit/4482c04bdf5c0579807f3e38dcf2afabadeec7ea))
* **data-connections:** let a connection row wrap instead of collapsing on mobile ([#532](https://github.com/source-cooperative/source.coop/issues/532)) ([03b8747](https://github.com/source-cooperative/source.coop/commit/03b8747e21ba64fa60e12c5a5c77ca5e37f2dd1d))
* keep unlisted products out of search engines and profile listings ([#574](https://github.com/source-cooperative/source.coop/issues/574)) ([ab5bd08](https://github.com/source-cooperative/source.coop/commit/ab5bd08de4edbbe201d02696e97a5c380921f9b5))
* make organization contact email editable ([#293](https://github.com/source-cooperative/source.coop/issues/293)) ([a14311e](https://github.com/source-cooperative/source.coop/commit/a14311eab6f8e2e9e953bbfb712f4b246bec74d3))
* **products:** truncate a product's DOI instead of overflowing the row ([#533](https://github.com/source-cooperative/source.coop/issues/533)) ([4f1fab8](https://github.com/source-cooperative/source.coop/commit/4f1fab87630eba0c673fc0fa0853d7e4fcc0b028))
* **profiles:** truncate long website links instead of wrapping them ([#531](https://github.com/source-cooperative/source.coop/issues/531)) ([5df79d5](https://github.com/source-cooperative/source.coop/commit/5df79d54e9bfff7411d9c42e22542b515e86db07))

3. Make the same edit to this PR's description. Release Please takes the GitHub release notes for v1.7.0 from the description, not from CHANGELOG.md, so remove the same seven fix lines there too.

package.json doesn't need to change: 1.7.0 is the right version whether you count from 1.6.0 or from 1.6.1.