From 9c73aa29176a4c27206007b0ac585863ad6daf3e Mon Sep 17 00:00:00 2001 From: Isaac Elbaz Date: Sat, 5 Sep 2026 10:57:46 -0400 Subject: [PATCH] Prepare cipherscope 0.3.0 release --- .github/workflows/release.yml | 1 + Cargo.lock | 2 +- Cargo.toml | 2 +- docs/releases/v0.3.0.md | 56 +++++++++++++++++++++++++++++++++++ docs/releasing.md | 23 ++++++++++++++ 5 files changed, 82 insertions(+), 2 deletions(-) create mode 100644 docs/releases/v0.3.0.md create mode 100644 docs/releasing.md diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index c4c2c91..a2e06aa 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -84,6 +84,7 @@ jobs: - name: GitHub Release uses: softprops/action-gh-release@efb35369e0ad2afab669f228072c1b0d510eae64 # v3.0.3 with: + body_path: docs/releases/${{ github.ref_name }}.md files: | dist/**/*.tar.gz dist/**/*.zip diff --git a/Cargo.lock b/Cargo.lock index cd2a205..973a13e 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -191,7 +191,7 @@ dependencies = [ [[package]] name = "cipherscope" -version = "0.2.5" +version = "0.3.0" dependencies = [ "ahash", "anyhow", diff --git a/Cargo.toml b/Cargo.toml index 0f20c59..b5f8415 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -1,6 +1,6 @@ [package] name = "cipherscope" -version = "0.2.5" +version = "0.3.0" edition = "2024" rust-version = "1.88" description = "A high-performance, language-aware tool for scanning source code to detect cryptographic libraries and algorithms usage." diff --git a/docs/releases/v0.3.0.md b/docs/releases/v0.3.0.md new file mode 100644 index 0000000..87b8bf4 --- /dev/null +++ b/docs/releases/v0.3.0.md @@ -0,0 +1,56 @@ +CipherScope 0.3.0 adds JavaScript and TypeScript scanning and improves detection, +scan safety, configuration validation, and release verification. + +### Compatibility and upgrading + +- Building from source requires **Rust 1.88 or newer**. +- Library users should update their dependency requirement to `cipherscope = "0.3"`. + Public pattern/parser types have changed, including the new `Language::JavaScript`, + `Language::TypeScript`, and `Language::Tsx` variants. Update exhaustive matches + and code that constructs public pattern types directly. +- Invalid custom pattern files now fail with diagnostics. Check unknown fields, + misspelled language names, unsupported schema versions, duplicate library names, + and empty names/language lists. +- Incomplete scans now exit unsuccessfully. Stdout may contain partial findings; + check the exit status before treating an inventory as complete. +- `--output` stages results and replaces the destination only after a successful + scan. Existing source files, explicit inputs, custom pattern files, and symlink + destinations are protected. The destination directory must be writable. On + Windows, close handles to an existing destination before scanning. +- Use `--gitignore=false` to disable ignore handling. `--threads 0` is rejected. + +### Added and improved + +- JavaScript and TypeScript grammars and patterns for Node.js crypto, Web Crypto, + and CryptoJS, with dedicated TSX parsing and case-aware source discovery. +- A shared `scan_with_patterns` library API for caller-supplied patterns. +- Bounded discovery/result queues, precompiled include and constant patterns, + cached line offsets, and reduced duplicate scanning work. +- Owned, bounded source reads instead of file-backed memory maps; file-size limits + are also enforced while reading. +- Conservative import hints preserve imports that occur after comments or inside + indented code. AST comment masking prevents commented-out APIs from becoming + algorithm findings while preserving evidence byte offsets. +- Independent language feature checks and C-only header/fixture support. +- Expanded regression tests and benchmarks, platform CI for Linux/macOS/Windows, + Rust 1.88 checks, pinned GitHub Actions, and recurring dependency audits. +- Patched `anyhow` and `crossbeam-epoch` dependencies; removed `memmap2`. + +### Install + +```sh +cargo install cipherscope --version 0.3.0 --locked +``` + +Prebuilt binaries are attached for Linux x86_64, Windows x86_64, macOS Intel, +and macOS Apple silicon. Each archive contains the `cipherscope` executable. + +### Known limitations + +Constant resolution is not scope-aware, finding deduplication is coarse, and +ordinary strings/docstrings may still match fallback patterns. Kotlin and Erlang +catalog entries do not yet have parsers. See the +[engineering review](https://github.com/script3r/cipherscope/blob/v0.3.0/docs/code-review-2026-09-05.md) +for details and follow-up findings. + +[All changes since v0.2.5](https://github.com/script3r/cipherscope/compare/v0.2.5...v0.3.0) diff --git a/docs/releasing.md b/docs/releasing.md new file mode 100644 index 0000000..3fc3b5e --- /dev/null +++ b/docs/releasing.md @@ -0,0 +1,23 @@ +# Releasing CipherScope + +1. Choose an unused version after checking crates.io and GitHub releases. Account + for public API and CLI compatibility changes; for this pre-1.0 crate, use a new + minor version for incompatible changes. +2. Update the package version in `Cargo.toml` and refresh the local package entry + in `Cargo.lock` with `cargo check`. Add release notes at + `docs/releases/v.md`, including upgrade requirements. +3. Run formatting, warnings-denied Clippy for all targets under both all and + minimal features, all-feature/minimal tests, the dependency audit, and + actionlint. Commit the release preparation, verify it with + `cargo publish --locked --dry-run`, and get the commit onto main with green CI. +4. Create an annotated `v` tag on that main commit and push the tag. + `.github/workflows/release.yml` builds four binary archives, publishes the crate + using the repository's `CARGO_REGISTRY_TOKEN` secret, then creates a GitHub + release using the committed release notes. +5. Monitor the Release workflow. Verify the crates.io version, all four GitHub + assets, and the reported version of a downloaded binary. Do not move a tag or + republish an already published crate version to recover from a failed release. + +Crates.io publication and the GitHub release are separate workflow steps. If +publication succeeds but a later step fails, preserve the published version and +complete only the remaining GitHub release/asset work.