ReleaseKit v0.7.0

Summary

ReleaseKit improves source-publication integrity, cancellation, credential-safe diagnostics, partial-result reporting, and temporary-file cleanup. It also bounds retained Go failure diagnostics and remote attachment comparison work while preserving the existing public facades and configuration formats.

Publication and Git operations

Exact tag pushes disable submodule recursion, correcting inherited push.recurseSubmodules=only settings that could report success without publishing the release tag.
ReleaseKit-owned Git inspection and preparation use original objects when replacement refs exist. Committed module identity, release notes, validation inputs, and build source eligibility use that consistent view. Ordinary dirty builds remain supported, with their source eligibility reported separately.
A verified local tag object remains available in PublicationResult.TagObject when later inspection fails. Errors identify a possibly retained local ref when its object ID could not be established. Failed verification stops before a push.
HTTP(S) userinfo is masked in owned Git diagnostics and CLI output, including literal apostrophes in credentials and failed CI checkout preparation. Native Git authentication, exact endpoint comparisons, and the raw captured PublicationResult.Endpoint value retain their existing behavior.
Child environment overlays preserve the working-directory-derived PWD on POSIX systems. Native Git hooks now receive the expected directory environment when ReleaseKit is invoked from another checkout or module subdirectory.

Cancellation and diagnostic retention

Buffered subprocess output has bounded I/O teardown after cancellation or child exit, including when descendants retain inherited output descriptors. Piped Git-reader cancellation closes owned pipes and joins child cleanup. Cancellation remains recognizable through errors.Is; ordinary execution failures preserve their underlying causes.
A queued blob read rechecks cancellation after acquiring the reader mutex, preserving a healthy batch session for later reads.
Status-only Go commands and dependency preparation retain a 1 MiB diagnostic tail. Failed commands identify omitted earlier output. Existing streaming output continues to be forwarded in full, and commands requiring returned output keep their complete capture.

Builds and hosted delivery

Completed build artifacts are reported only after hashing succeeds. A hashing failure identifies the affected output and preserves earlier completed artifacts and their digests.
Temporary allocation and cleanup failures retain their paths and underlying causes, including candidate builds, native version checks, delivery builds, tag-message files, and build receipts.
A managed-build cleanup failure after confirmed hosted delivery returns an error alongside DeliveryComplete and the confirmed asset observations. The CLI reports completed remote work and the local cleanup failure, returning operational status 1.
Gitea attachment downloads follow at most ten redirects, retaining cycle detection and per-origin authorization handling. Limit exhaustion is unverifiable content.
Remote attachment comparison reads at most the locally verified expected size plus one byte. Shorter or longer content conflicts; equal-length content still requires the expected digest. Read, close, and cancellation errors remain inspection failures, with existing attempted-write reconciliation preserved.

Shared Git observations, validation sequencing, artifact declaration matching, and CLI workflows were consolidated internally. Consumer-facing types continue to belong to the root releasekit and runtime buildinfo facades.

Compatibility and upgrade guidance

The module identifier remains go.maximumdirect.net/releasekit, and the Go consumer minimum remains 1.26.0. Existing v0.6.0 API calls, profile fields, and build receipt formats remain supported. This minor release changes operational behavior through the diagnostic and redirect budgets and cleanup-error reporting described above.

When adopting v0.7.0:

Update library and CLI dependencies to v0.7.0 using the existing import paths and profiles.
Handle a delivery error together with DeliveryResult.State. For DeliveryComplete, address the reported local cleanup path; the confirmed hosted delivery is already complete. Continue to resolve partial, conflicting, and unknown outcomes through their existing recovery guidance.
Retain candidate validation's streamed Output when complete test diagnostics are needed. Status-only failure text now contains the retained tail and an omission notice when applicable.
When using Git replacement refs, expect release evidence to be evaluated against original committed objects. A build of dirty or replacement-derived working content can succeed while remaining ineligible for binary delivery.
Inspect the reported local tag ref after a tag-creation or verification failure, including when TagObject is empty. Continue to treat the raw PublicationResult.Endpoint as sensitive when handling it in application output or logs.

See the publication guide, build guide, delivery guide, CLI contract, and Gitea integration guide for current behavior. Source publication and hosted delivery retain their separate outcomes under the maintainer procedure.

6.2 KiB Raw Blame History