From 79d460e64e20ea709ec5ef2de21248798dd219d3 Mon Sep 17 00:00:00 2001 From: Imani Manyara Date: Sat, 14 Nov 2026 04:51:33 -0500 Subject: [PATCH] Restart the release history at v0.1.0 v1.0.0 and v1.0.1 are withdrawn in a planned history reset; the CHANGELOG folds both into one [0.1.0] entry and the README names v0.1.0 as the first tag. --- CHANGELOG.md | 26 +++++++++++--------------- go-release/README.md | 5 +++-- 2 files changed, 14 insertions(+), 17 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 94f193f..789a386 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -5,24 +5,20 @@ and callers pin `go-release.yml@ # vX.Y.Z`. ## [Unreleased] -## [1.0.1] - 2026-11-14 +## [0.1.0] - 2026-11-14 -### Fixed - -- `go-release.yml` sets `GOPRIVATE` and `GONOSUMDB` to every Simtabi-owned org, not only the - caller's, so a release fetches our own modules from git and never through proxy.golang.org. - `sangehq/authama`'s release pulled `github.com/simtabi/go-notifykit/src` through the public proxy - (finding R-INC-13). `go-release/tests/` pins the list. - -## [1.0.0] - 2026-11-13 - -First tagged release of the shared workflows. +First tagged release of the shared workflows. It replaces `v1.0.0` and `v1.0.1`, withdrawn on +2026-11-14 in a planned history reset; a caller pinned to either moves to this version. - `.github/workflows/go-release.yml`: the reusable Go release pipeline every Go project's `release.yml` calls. It publishes on the repository's GitHub release only, on a pushed `vX.Y.Z` tag - or on request. + or on request. Inputs: `tag`, `goreleaser-config`, `go-version-file`, `module-alias-prefix`, + `changelog`, `post-release`, `runs-on`, `environment`, `node-version` (default: latest), and the + optional `SIGNPATH_API_TOKEN` secret. +- The release job sets `GOPRIVATE` and `GONOSUMDB` to every Simtabi-owned org, so a release fetches + our own modules from git and never through proxy.golang.org (finding R-INC-13 from the + `sangehq/authama` review). `go-release/tests/` pins the list. - `templates/go/release.yml`: the caller to copy. -[Unreleased]: https://github.com/simtabi/.github/compare/v1.0.1...HEAD -[1.0.1]: https://github.com/simtabi/.github/compare/v1.0.0...v1.0.1 -[1.0.0]: https://github.com/simtabi/.github/releases/tag/v1.0.0 +[Unreleased]: https://github.com/simtabi/.github/compare/v0.1.0...HEAD +[0.1.0]: https://github.com/simtabi/.github/releases/tag/v0.1.0 diff --git a/go-release/README.md b/go-release/README.md index a944160..7a294cd 100644 --- a/go-release/README.md +++ b/go-release/README.md @@ -17,8 +17,9 @@ Push a version tag only for final code: tags are final, and a pushed tag publish ## Versions -This repository tags each change to the shared workflow as a release (`v1.0.0` on 2026-11-13 is the -first), and tags are final: a fix gets the next version. A caller pins +This repository tags each change to the shared workflow as a release (`v0.1.0` on 2026-11-14 is the +first; an earlier `v1.0.0` and `v1.0.1` were withdrawn in a planned history reset), and tags are +final: a fix gets the next version. A caller pins the tag's commit with a `# vX.Y.Z` comment, which is the form Dependabot's github-actions updater recognises: it opens a pull request moving the commit and the comment together when a new tag appears. A pin to a bare commit, or a comment that names a pull request, is never updated by Dependabot.