v0.0.3

What's Changed

Other Changes

• ci(release): switch to goreleaser (scorecard Packaging → detected) by @aksOps in #43
• fix(security): filepath.IsLocal sanitisers for CodeQL path/command-injection by @aksOps in #44
• chore: add .bestpractices.json for OpenSSF badge automation by @aksOps in #45
• chore: governance/community files + finish BestPractices passing tier by @aksOps in #46
• ci: drop push:main trigger from ci and fuzz (saves ~2min/merge) by @aksOps in #47
• chore: add CHANGELOG.md + fill missing BestPractices criteria by @aksOps in #48
• ci: drop macOS from test matrix (fix TestScale_1000Notes flake) by @aksOps in #49
• ci(release): drop goreleaser (Pro-only prebuilt) — inline cosign + gh release by @aksOps in #50

Full Changelog: v0.0.2...v0.0.3

Verify

All artifacts are signed with cosign keyless via Sigstore.

cosign verify-blob \
  --certificate-identity-regexp 'https://github.com/RandomCodeSpace/docsiq/\.github/workflows/release\.yml.*' \
  --certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
  --certificate docsiq-v0.0.3-linux-amd64.pem \
  --signature docsiq-v0.0.3-linux-amd64.sig \
  docsiq-v0.0.3-linux-amd64