releasekit/docs/releases/v0.7.0.md

# ReleaseKit v0.7.0

## Summary

ReleaseKit improves source-publication integrity, cancellation, credential-safe
diagnostics, partial-result reporting, and temporary-file cleanup. It also bounds
retained Go failure diagnostics and remote attachment comparison work while
preserving the existing public facades and configuration formats.

## Publication and Git operations

- Exact tag pushes disable submodule recursion, correcting inherited
  `push.recurseSubmodules=only` settings that could report success without
  publishing the release tag.
- ReleaseKit-owned Git inspection and preparation use original objects when
  replacement refs exist. Committed module identity, release notes, validation
  inputs, and build source eligibility use that consistent view. Ordinary dirty
  builds remain supported, with their source eligibility reported separately.
- A verified local tag object remains available in `PublicationResult.TagObject`
  when later inspection fails. Errors identify a possibly retained local ref
  when its object ID could not be established. Failed verification stops before
  a push.
- HTTP(S) userinfo is masked in owned Git diagnostics and CLI output, including
  literal apostrophes in credentials and failed CI checkout preparation. Native
  Git authentication, exact endpoint comparisons, and the raw captured
  `PublicationResult.Endpoint` value retain their existing behavior.
- Child environment overlays preserve the working-directory-derived `PWD` on
  POSIX systems. Native Git hooks now receive the expected directory environment
  when ReleaseKit is invoked from another checkout or module subdirectory.

## Cancellation and diagnostic retention

- Buffered subprocess output has bounded I/O teardown after cancellation or
  child exit, including when descendants retain inherited output descriptors.
  Piped Git-reader cancellation closes owned pipes and joins child cleanup.
  Cancellation remains recognizable through `errors.Is`; ordinary execution
  failures preserve their underlying causes.
- A queued blob read rechecks cancellation after acquiring the reader mutex,
  preserving a healthy batch session for later reads.
- Status-only Go commands and dependency preparation retain a 1 MiB diagnostic
  tail. Failed commands identify omitted earlier output. Existing streaming
  output continues to be forwarded in full, and commands requiring returned
  output keep their complete capture.

## Builds and hosted delivery

- Completed build artifacts are reported only after hashing succeeds. A hashing
  failure identifies the affected output and preserves earlier completed
  artifacts and their digests.
- Temporary allocation and cleanup failures retain their paths and underlying
  causes, including candidate builds, native version checks, delivery builds,
  tag-message files, and build receipts.
- A managed-build cleanup failure after confirmed hosted delivery returns an
  error alongside `DeliveryComplete` and the confirmed asset observations. The
  CLI reports completed remote work and the local cleanup failure, returning
  operational status 1.
- Gitea attachment downloads follow at most ten redirects, retaining cycle
  detection and per-origin authorization handling. Limit exhaustion is
  unverifiable content.
- Remote attachment comparison reads at most the locally verified expected size
  plus one byte. Shorter or longer content conflicts; equal-length content still
  requires the expected digest. Read, close, and cancellation errors remain
  inspection failures, with existing attempted-write reconciliation preserved.

Shared Git observations, validation sequencing, artifact declaration matching,
and CLI workflows were consolidated internally. Consumer-facing types continue
to belong to the root `releasekit` and runtime `buildinfo` facades.

## Compatibility and upgrade guidance

The module identifier remains `go.maximumdirect.net/releasekit`, and the Go
consumer minimum remains 1.26.0. Existing v0.6.0 API calls, profile fields, and
build receipt formats remain supported. This minor release changes operational
behavior through the diagnostic and redirect budgets and cleanup-error reporting
described above.

When adopting v0.7.0:

1. Update library and CLI dependencies to v0.7.0 using the existing import paths
   and profiles.
2. Handle a delivery error together with `DeliveryResult.State`. For
   `DeliveryComplete`, address the reported local cleanup path; the confirmed
   hosted delivery is already complete. Continue to resolve partial, conflicting,
   and unknown outcomes through their existing recovery guidance.
3. Retain candidate validation's streamed `Output` when complete test diagnostics
   are needed. Status-only failure text now contains the retained tail and an
   omission notice when applicable.
4. When using Git replacement refs, expect release evidence to be evaluated
   against original committed objects. A build of dirty or replacement-derived
   working content can succeed while remaining ineligible for binary delivery.
5. Inspect the reported local tag ref after a tag-creation or verification
   failure, including when `TagObject` is empty. Continue to treat the raw
   `PublicationResult.Endpoint` as sensitive when handling it in application
   output or logs.

See the [publication guide](https://forge.maximumdirect.net/base-layer/releasekit/src/tag/v0.7.0/docs/consumers/publish.md),
[build guide](https://forge.maximumdirect.net/base-layer/releasekit/src/tag/v0.7.0/docs/consumers/build.md),
[delivery guide](https://forge.maximumdirect.net/base-layer/releasekit/src/tag/v0.7.0/docs/consumers/delivery.md),
[CLI contract](https://forge.maximumdirect.net/base-layer/releasekit/src/tag/v0.7.0/docs/cli.md),
and [Gitea integration guide](https://forge.maximumdirect.net/base-layer/releasekit/src/tag/v0.7.0/docs/integrations/gitea.md)
for current behavior. Source publication and hosted delivery retain their
separate outcomes under the [maintainer procedure](https://forge.maximumdirect.net/base-layer/releasekit/src/tag/v0.7.0/docs/release.md).

[COPYRIGHT](https://forge.maximumdirect.net/base-layer/releasekit/src/tag/v0.7.0/COPYRIGHT) |
[LICENSE](https://forge.maximumdirect.net/base-layer/releasekit/src/tag/v0.7.0/LICENSE) |
[ATTRIBUTION](https://forge.maximumdirect.net/base-layer/releasekit/src/tag/v0.7.0/docs/oss/attribution.md)