Release v0.1.2

Changelog

• 5804c51 Merge pull request #13 from actionutils/release-pr-from-v0.1.1
• ea03392 chore: Bump version to v0.1.2
• aa52253 chore(release): prepare release PR
• 58f7594 Merge pull request #12 from actionutils/fix-publish-2
• d54f90a use setup-node
• f7f7a00 fix npm trusted publishing (again)

📋 Release Verification Instructions

Verifying Release Artifacts

Using Cosign

All release artifacts are signed using Sigstore and can be verified using cosign:

# Download the release assets
gh release download v0.1.2 --repo actionutils/gh-release-notes

# Verify the checksum file signature
cosign verify-blob \
  --certificate-identity-regexp '^https://github.com/actionutils/trusted-go-releaser/.github/workflows/trusted-release-workflow.yml@.*$' \
  --certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
  --cert "checksums.txt.pem" \
  --signature "checksums.txt.sig" \
  "checksums.txt"

# Verify checksums of all binaries
sha256sum --ignore-missing -c "checksums.txt"

Using GitHub Attestations

All artifacts have GitHub Attestations that can be verified:

# Verify attestations for the checksum file
gh attestation verify "checksums.txt" --repo actionutils/gh-release-notes --signer-workflow='actionutils/trusted-go-releaser/.github/workflows/trusted-release-workflow.yml'

📦 Installation Scripts

This release includes installation scripts generated by binstaller:

• install.sh - Downloads and installs the binary
• run.sh - Downloads and runs the binary directly

Verifying Installation Scripts

Before using the installation scripts, you can verify their authenticity using cosign (signatures) or GitHub Attestations.

# Download the scripts and their signatures
gh release download v0.1.2 --pattern "*.sh*" --repo actionutils/gh-release-notes

# Verify with cosign (recommended)
cosign verify-blob \
  --certificate-identity-regexp '^https://github.com/actionutils/trusted-go-releaser/.github/workflows/trusted-release-workflow.yml@.*$' \
  --certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
  --cert install.sh.pem \
  --signature install.sh.sig \
  install.sh

cosign verify-blob \
  --certificate-identity-regexp '^https://github.com/actionutils/trusted-go-releaser/.github/workflows/trusted-release-workflow.yml@.*$' \
  --certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
  --cert run.sh.pem \
  --signature run.sh.sig \
  run.sh

# Or verify with GitHub Attestations
# Verify the install script
gh attestation verify install.sh --repo actionutils/gh-release-notes --signer-workflow='actionutils/trusted-go-releaser/.github/workflows/trusted-release-workflow.yml'

# Verify the run script
gh attestation verify run.sh --repo actionutils/gh-release-notes --signer-workflow='actionutils/trusted-go-releaser/.github/workflows/trusted-release-workflow.yml'

Using Installation Scripts

# Install the binary
curl -sSfL https://github.com/actionutils/gh-release-notes/releases/download/v0.1.2/install.sh | sh

# Or run directly without installation
curl -sSfL https://github.com/actionutils/gh-release-notes/releases/download/v0.1.2/run.sh | sh

One-liner Installation with Verification

Using Cosign (recommended)

# Set the desired version and script type
VERSION="v0.1.2"
SCRIPT="install.sh"  # or "run.sh"
DOWNLOAD_URL="https://github.com/actionutils/gh-release-notes/releases/download/${VERSION}"

# Download and verify with cosign, then execute
curl -sL "${DOWNLOAD_URL}/${SCRIPT}" | \
    (tmpfile=$(mktemp); cat > "$tmpfile"; \
     cosign verify-blob \
       --certificate-identity-regexp '^https://github.com/actionutils/trusted-go-releaser/.github/workflows/trusted-release-workflow.yml@.*$' \
       --certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
       --certificate "${DOWNLOAD_URL}/${SCRIPT}.pem" \
       --signature "${DOWNLOAD_URL}/${SCRIPT}.sig" \
       "$tmpfile" && \
     sh "$tmpfile"; rm -f "$tmpfile")

Using GitHub Attestations

# Set the desired version
VERSION="v0.1.2"

# Install with attestation verification
curl -sL "https://github.com/actionutils/gh-release-notes/releases/download/${VERSION}/install.sh" | \
    (tmpfile=$(mktemp); cat > "$tmpfile"; \
     gh attestation verify --repo=actionutils/gh-release-notes --signer-workflow='actionutils/trusted-go-releaser/.github/workflows/trusted-release-workflow.yml' "$tmpfile" && \
     sh "$tmpfile"; rm -f "$tmpfile")