Release v0.44.0
Our own checks were measuring the machine, not the code. The job that feeds our coverage badge failed at random, and the cause was not a slow test: a test that runs in 22 milliseconds was being failed by a 5 second budget, because that budget is wall clock and our test command starts twelve parallel processes on the same cores. Twice, that flake blocked a release. This version fixes it at the root and spends the rest of its time on the same idea aimed at the supply chain: what our CI is allowed to do, what exactly it runs, and code that could never run at all. Nothing about the package's behaviour changes, and the runtime is byte for byte what 0.43.0 shipped.
Highlights
- Nothing you install changes. The runtime is identical to 0.43.0 and every published API behaves the same. This release is about the machinery that checks us.
- The build stopped failing at random. Our test suite could fail a perfectly healthy test just because the machine was busy, and twice that blocked a release.
- Every action our CI runs is pinned to an exact commit. A tag can be moved by whoever owns it; a commit cannot, so nothing can quietly change what builds your package.
- The release job asks for write access only where it needs it, instead of granting it to the whole workflow.
- Real static analysis runs on every change. CodeQL reads the code that parses your catalogs, PO files, XLIFF and HTML, and its findings are public in the repository's Security tab.
For the full details of this release, see the repository changelog.