chore: release v0.3.0

.github/dependabot.yml

@@ -0,0 +1,11 @@
+version: 2
+
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: weekly
+    groups:
+      github-actions:
+        patterns:
+          - "*"

.github/workflows/lint-actions.yml

@@ -0,0 +1,46 @@
+name: Lint Actions
+
+on:
+  workflow_dispatch:
+  push:
+    paths:
+      - ".github/workflows/**"
+  pull_request:
+    paths:
+      - ".github/workflows/**"
+
+concurrency:
+  group: lint-actions-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+env:
+  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
+
+jobs:
+  actionlint:
+    name: Lint GitHub Actions workflows
+    runs-on: ubuntu-latest
+    env:
+      ACTIONLINT_VERSION: "1.7.8"
+
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: Install actionlint
+        shell: bash
+        run: |
+          set -euo pipefail
+          archive="actionlint_${ACTIONLINT_VERSION}_linux_amd64.tar.gz"
+          base_url="https://github.com/rhysd/actionlint/releases/download/v${ACTIONLINT_VERSION}"
+          curl -fsSLO "${base_url}/${archive}"
+          curl -fsSLO "${base_url}/actionlint_${ACTIONLINT_VERSION}_checksums.txt"
+          grep " ${archive}$" "actionlint_${ACTIONLINT_VERSION}_checksums.txt" | sha256sum --check
+          tar -xzf "${archive}" actionlint
+          sudo install actionlint /usr/local/bin/actionlint
+
+      - name: Lint workflows
+        run: actionlint

.github/workflows/lint-docs.yml

@@ -0,0 +1,43 @@
+name: Lint Docs
+
+on:
+  workflow_dispatch:
+  push:
+    paths:
+      - "**/*.md"
+      - ".markdownlint.json"
+      - ".github/workflows/lint-docs.yml"
+  pull_request:
+    paths:
+      - "**/*.md"
+      - ".markdownlint.json"
+      - ".github/workflows/lint-docs.yml"
+
+concurrency:
+  group: lint-docs-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+env:
+  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
+
+jobs:
+  markdownlint:
+    name: Lint Markdown
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: Lint Markdown
+        uses: DavidAnson/markdownlint-cli2-action@6bf21b07787794f89a243495939cd651942aeabe # v24.1.0
+        with:
+          # Changelogs are generated by git-cliff; LICENSE.md preserves canonical licence text.
+          globs: |
+            **/*.md
+            #CHANGELOG.md
+            #CHANGELOG_RELEASE.md
+            #LICENSE.md

.github/workflows/release.yml

@@ -12,18 +12,29 @@ permissions:
 jobs:
   release:
     runs-on: ubuntu-latest
-
+    env:
+      FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
     steps:
-      - name: Check out repo
-        uses: actions/checkout@v4
+      - name: Check out repo
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
-          fetch-tags: true
+          fetch-tags: true
+
+      - name: Install test and packaging dependencies
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y make shellcheck unzip zip
+
+      - name: Run tests and ShellCheck
+        run: |
+          make test
+          shellcheck chdtool.sh scripts/*.sh tests/*.sh tests/bin/*
 
       # Generate release notes for this tag (used as Release body)
       - name: Generate release notes with git-cliff
         id: cliff_notes
-        uses: orhun/git-cliff-action@v4
+        uses: orhun/git-cliff-action@f50e11560dce63f7c33227798f90b924471a88b5 # v4
         with:
           config: cliff.toml
           # notes only for the pushed tag, without the big header
@@ -32,23 +43,21 @@ jobs:
           OUTPUT: CHANGELOG_RELEASE.md
           GITHUB_REPO: ${{ github.repository }}
 
-      - name: Prepare artifacts
-        run: |
-          set -euo pipefail
-          chmod +x chdtool.sh || true
-          cp chdtool.sh chdtool
-          mkdir -p dist
-          tar -czf "dist/chdtool-${GITHUB_REF_NAME}.tar.gz" chdtool README.md LICENSE CHANGELOG.md || true
-          zip -j "dist/chdtool-${GITHUB_REF_NAME}.zip" chdtool README.md LICENSE CHANGELOG.md || true
+      - name: Prepare artifacts
+        run: |
+          set -euo pipefail
+          release_version="${GITHUB_REF_NAME#v}"
+          DIST_DIR="${RUNNER_TEMP}/chdtool-dist" \
+            SOURCE_DATE_EPOCH="$(git log -1 --format=%ct)" \
+            bash scripts/package-release.sh "$release_version"
 
       - name: Create GitHub Release and upload assets
-        uses: softprops/action-gh-release@v2
+        uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v3.0.2
         with:
           tag_name: ${{ github.ref_name }}
           body_path: ${{ steps.cliff_notes.outputs.changelog }}   # file generated above
-          files: |
-            dist/*
-            chdtool.sh
+          files: |
+            ${{ runner.temp }}/chdtool-dist/*
           draft: false
           prerelease: ${{ contains(github.ref_name, '-') }}
         env:
@@ -57,7 +66,7 @@ jobs:
       # Regenerate the full CHANGELOG.md for main and open a PR
       - name: Regenerate full CHANGELOG.md
         id: cliff_full
-        uses: orhun/git-cliff-action@v4
+        uses: orhun/git-cliff-action@f50e11560dce63f7c33227798f90b924471a88b5 # v4
         with:
           config: cliff.toml
           args: -vv
@@ -66,7 +75,7 @@ jobs:
           GITHUB_REPO: ${{ github.repository }}
 
       - name: Open PR to update CHANGELOG.md on main
-        uses: peter-evans/create-pull-request@v6
+        uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
         with:
           commit-message: "chore(changelog): update for ${{ github.ref_name }}"
           branch: chore/update-changelog-${{ github.ref_name }}

.github/workflows/shellcheck.yml

@@ -1,11 +1,37 @@
-name: ShellCheck
-on: [push, pull_request]
-jobs:
-  shellcheck:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Install ShellCheck
-        run: sudo apt-get update && sudo apt-get install -y shellcheck
-      - name: Run ShellCheck
-        run: shellcheck chdtool.sh
+name: ShellCheck
+
+on:
+  workflow_dispatch:
+  push:
+    paths:
+      - "chdtool.sh"
+      - "tests/**/*.sh"
+      - "tests/bin/*"
+      - "scripts/**/*.sh"
+      - ".github/workflows/shellcheck.yml"
+  pull_request:
+    paths:
+      - "chdtool.sh"
+      - "tests/**/*.sh"
+      - "tests/bin/*"
+      - "scripts/**/*.sh"
+      - ".github/workflows/shellcheck.yml"
+
+concurrency:
+  group: shellcheck-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  shellcheck:
+    runs-on: ubuntu-latest
+    env:
+      FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Install ShellCheck
+        run: sudo apt-get update && sudo apt-get install -y shellcheck
+      - name: Run ShellCheck
+        run: shellcheck chdtool.sh scripts/*.sh tests/*.sh tests/bin/*

.github/workflows/tests.yml

@@ -1,31 +1,48 @@
-name: tests
+name: Tests
+
 on:
+  workflow_dispatch:
   push:
+    paths:
+      - "chdtool.sh"
+      - "Makefile"
+      - "tests/**"
+      - "scripts/**"
+      - ".github/workflows/tests.yml"
   pull_request:
+    paths:
+      - "chdtool.sh"
+      - "Makefile"
+      - "tests/**"
+      - "scripts/**"
+      - ".github/workflows/tests.yml"
+
+concurrency:
+  group: tests-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
 
 jobs:
   tests:
     runs-on: ubuntu-latest
+    env:
+      FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Install test deps
         run: |
           sudo apt-get update
           sudo apt-get install -y unzip zip make
 
-      - name: Debug workspace
-        run: |
-          pwd
-          ls -la
-          sed -n '1,120p' Makefile
-
       - name: Run tests
         run: make test
 
       - name: Upload logs from tests (always)
         if: ${{ always() }}
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: logs-from-tests
           path: logs/

.gitignore

@@ -12,11 +12,13 @@ Thumbs.db
 logs/
 *.log
 
-# Archives or temp outputs (just in case)
-*.zip
-*.7z
-*.rar
-*.tmp
+# Archives or temp outputs (just in case)
+*.zip
+*.7z
+*.rar
+*.tmp
+/chdtool
+/dist/
 
 # Python virtual envs (if any tooling is added later)
 .venv/

.markdownlint.json

@@ -0,0 +1,4 @@
+{
+  "default": true,
+  "MD013": false
+}

CONTRIBUTING.md

@@ -1,25 +1,28 @@
 # Contributing
 
-Thanks for your interest in contributing to **chdscript**! 🎉
+Thanks for your interest in contributing to **chdtool**! 🎉
 
 ## How to Contribute
 
-1. **Fork the repo** and create your feature branch:  
-   ```bash
-   git checkout -b feature/my-new-feature
+1. **Fork the repo** and create your feature branch:
+
+   ```bash
+   git checkout -b feature/my-new-feature
+   ```
+
+2. **Commit your changes** with clear messages:
+
+   ```bash
+   git commit -m "Add support for XYZ"
+   ```
+
+3. **Push to the branch**:
+
+   ```bash
+   git push origin feature/my-new-feature
    ```
 
-2. **Commit your changes** with clear messages:  
-   ```bash
-   git commit -m "Add support for XYZ"
-   ```
-
-3. **Push to the branch**:  
-   ```bash
-   git push origin feature/my-new-feature
-   ```
-
-4. **Open a Pull Request** against `main`.
+4. **Open a Pull Request** against `develop`.
 
 ## Coding Guidelines
 
@@ -37,11 +40,16 @@ Thanks for your interest in contributing to **chdscript**! 🎉
 
 ## Versioning
 
-We use [Semantic Versioning](https://semver.org/) (semver).  
-Bump version numbers when you:
-- `MAJOR`: Break backward compatibility
+We use [Semantic Versioning](https://semver.org/) (semver).
+
+Bump version numbers when you:
+
+- `MAJOR`: Break backward compatibility
 - `MINOR`: Add new functionality in a backward-compatible manner
-- `PATCH`: Fix bugs or make small improvements
+- `PATCH`: Fix bugs or make small improvements
+
+Maintainers should follow the complete [release procedure](RELEASING.md) when
+preparing, tagging, publishing, and verifying a release.
 
 ---