chore(v0.4.8): refresh toolchain, deps, CI actions, and pin YAML formatting - #5
Merged
Conversation
…atting Maintenance release. No user-facing feature or behavior changes. 🎯 Changes: - go.mod: pin go 1.25.5 + toolchain go1.26.4 (build with patched 1.26.4 stdlib while staying inside Go's supported-major window) - deps: bump x/crypto v0.53.0, x/text v0.38.0, x/sys v0.46.0, regexp2 v1.12.0, go-minisign (latest commit); govulncheck clean - CI/release: pin setup-go to 1.26.4 (was floating '1.26') - release.yml: replace archived Node12 actions/create-release@v1 + actions/upload-release-asset@v1 with softprops/action-gh-release@v2 (Node 24), completing the Node 20->24 transition begun in v0.4.7 - goneat: pin v0.5.13 (Makefile + CI dogfood steps) - add repo-root .yamlfmt + .yamllint so goneat and standalone yamlfmt agree on YAML formatting (ends precommit/CI churn); preserves the --- + blank-line house style - normalize scripts/install-sfetch.sh to 4-space indent (matches the other scripts/*.sh and shfmt -i 4); whitespace-only, behavior verified - re-apply go1.26 gofmt alignment to internal/host/github/client.go - docs: VERSION 0.4.8, README Go badge 1.25+, tools.yaml go min/rec, CHANGELOG + RELEASE_NOTES entries Generated by Claude Opus 4.8 (1M context) (https://anthropic.com) as foxtrot-devlead running Claude Code (https://claude.com/claude-code) under supervision of [@3leapsdave](https://github.com/3leapsdave) Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@3leaps.net> Committer-of-Record: Dave Thompson <dave@3leaps.net> [@3leapsdave]
Completes the v0.4.8 release package per RELEASE_CHECKLIST.md step 1 and the repo-sfetch-ops PR #5 review (release-process blocker). 🎯 Changes: - Add docs/releases/v0.4.8.md, sourced from the RELEASE_NOTES.md v0.4.8 entry. Unblocks `make release-notes` (and the release-upload / release-upload-provenance targets that depend on it), which reads docs/releases/<tag>.md and was failing on the missing file. - Prune CHANGELOG.md and RELEASE_NOTES.md to the latest 10 releases per the in-file maintenance note (older entries live in docs/releases/). - Backfill docs/releases/v0.3.3.md from the entry being pruned — v0.3.3 was the one version lacking an archive, so this preserves the "older entries see docs/releases/" invariant. Verified: RELEASE_TAG=v0.4.8 make release-notes succeeds; goneat assess format,lint clean. Generated by Claude Opus 4.8 (1M context) (https://anthropic.com) as foxtrot-devlead running Claude Code (https://claude.com/claude-code) under supervision of [@3leapsdave](https://github.com/3leapsdave) Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@3leaps.net> Committer-of-Record: Dave Thompson <dave@3leaps.net> [@3leapsdave]
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
v0.4.8 — maintenance release
Refreshes the Go toolchain and dependencies, completes the GitHub Actions Node 20 → 24 migration, bumps goneat, and pins a repo-wide YAML formatting standard. No user-facing feature or behavior changes.
Changed
go.modpinsgo 1.25.5+toolchain go1.26.4; CI/releasesetup-gopins1.26.4(was the floating1.26). Default builds use the patched 1.26.4 stdlib while the module still builds on Go 1.25.x — inside Go's supported-major window. Clears the stdlib advisories source-based vuln scans were flagging.x/cryptov0.47.0→v0.53.0,x/textv0.33.0→v0.38.0,x/sysv0.40.0→v0.46.0,regexp2v1.11.5→v1.12.0,go-minisignrefreshed to latest commit.govulncheck ./...clean.actions/create-release@v1+actions/upload-release-asset@v1replaced withsoftprops/action-gh-release@v2. Completes the transition v0.4.7 began (checkout/setup-gowere already done). Two-job structure and manual-signing flow preserved.Added
.yamlfmt+.yamllintso goneat's bundled yamlfmt and any standalone yamlfmt agree on inline-comment padding and document-start handling, ending intermittentmake precommit/CI churn. Adapted to preserve sfetch's---+ blank-line house style (not collapsed).Fixed
scripts/install-sfetch.shnormalized to 4-space indent — the lone outlier vs the other 7scripts/*.shand.goneat/assess.yaml's shfmt-i 4. Whitespace-only (the large diff);detect_platform+ arg parsing verified unchanged. Required so goneat v0.5.13 CI stays green.gofmtalignment re-applied tointernal/host/github/client.go.Validation
make precommit✅ (gosec 0 issues) · fullmake test✅ (no failures) ·govulncheck ./...→ no vulnerabilities ·go vetclean · all 5 platforms build · install-script smoke test passed.🤖 Generated with Claude Code