Release v0.2.0

What's Changed

Enhancements 🎉

• feat: Improve CLI with yargs for better flag parsing and documentation by @haya14busa in #29
• feat: Use GitHub-style change template format by @haya14busa in #27
• refactor: Replace $FULL_CHANGELOG_LINK with URL only by @haya14busa in #26
• feat: Add support for GitHub's official release.yml format by @haya14busa in #25
• Add full changelog link support with $FULL_CHANGELOG placeholder by @haya14busa in #24

Bug Fixes 🐛

• fix binstaller asset template by @haya14busa in #17

Other Changes

• feat: Add default category template for GitHub-style formatting by @haya14busa in #31
• use dev dependencies for yargs by @haya14busa in #30
• fix: Fix release workflow dependencies and add preview flag by @haya14busa in #28
• set GITHUB_TOKEN for bun run dev by @haya14busa in #22
• use gh release notes by @haya14busa in #21
• feat: integrate gh-release-notes into release workflow by @haya14busa in #20
• skip dry run npm publish when next_tag is empty by @haya14busa in #18

Full Changelog: v0.1.3...v0.2.0

📋 Release Verification Instructions

Verifying Release Artifacts

Using Cosign

All release artifacts are signed using Sigstore and can be verified using cosign:

# Download the release assets
gh release download v0.2.0 --repo actionutils/gh-release-notes

# Verify the checksum file signature
cosign verify-blob \
  --certificate-identity-regexp '^https://github.com/actionutils/trusted-go-releaser/.github/workflows/trusted-release-workflow.yml@.*$' \
  --certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
  --cert "checksums.txt.pem" \
  --signature "checksums.txt.sig" \
  "checksums.txt"

# Verify checksums of all binaries
sha256sum --ignore-missing -c "checksums.txt"

Using GitHub Attestations

All artifacts have GitHub Attestations that can be verified:

# Verify attestations for the checksum file
gh attestation verify "checksums.txt" --repo actionutils/gh-release-notes --signer-workflow='actionutils/trusted-go-releaser/.github/workflows/trusted-release-workflow.yml'

📦 Installation Scripts

This release includes installation scripts generated by binstaller:

• install.sh - Downloads and installs the binary
• run.sh - Downloads and runs the binary directly

Verifying Installation Scripts

Before using the installation scripts, you can verify their authenticity using cosign (signatures) or GitHub Attestations.

# Download the scripts and their signatures
gh release download v0.2.0 --pattern "*.sh*" --repo actionutils/gh-release-notes

# Verify with cosign (recommended)
cosign verify-blob \
  --certificate-identity-regexp '^https://github.com/actionutils/trusted-go-releaser/.github/workflows/trusted-release-workflow.yml@.*$' \
  --certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
  --cert install.sh.pem \
  --signature install.sh.sig \
  install.sh

cosign verify-blob \
  --certificate-identity-regexp '^https://github.com/actionutils/trusted-go-releaser/.github/workflows/trusted-release-workflow.yml@.*$' \
  --certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
  --cert run.sh.pem \
  --signature run.sh.sig \
  run.sh

# Or verify with GitHub Attestations
# Verify the install script
gh attestation verify install.sh --repo actionutils/gh-release-notes --signer-workflow='actionutils/trusted-go-releaser/.github/workflows/trusted-release-workflow.yml'

# Verify the run script
gh attestation verify run.sh --repo actionutils/gh-release-notes --signer-workflow='actionutils/trusted-go-releaser/.github/workflows/trusted-release-workflow.yml'

Using Installation Scripts

# Install the binary
curl -sSfL https://github.com/actionutils/gh-release-notes/releases/download/v0.2.0/install.sh | sh

# Or run directly without installation
curl -sSfL https://github.com/actionutils/gh-release-notes/releases/download/v0.2.0/run.sh | sh

One-liner Installation with Verification

Using Cosign (recommended)

# Set the desired version and script type
VERSION="v0.2.0"
SCRIPT="install.sh"  # or "run.sh"
DOWNLOAD_URL="https://github.com/actionutils/gh-release-notes/releases/download/${VERSION}"

# Download and verify with cosign, then execute
curl -sL "${DOWNLOAD_URL}/${SCRIPT}" | \
    (tmpfile=$(mktemp); cat > "$tmpfile"; \
     cosign verify-blob \
       --certificate-identity-regexp '^https://github.com/actionutils/trusted-go-releaser/.github/workflows/trusted-release-workflow.yml@.*$' \
       --certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
       --certificate "${DOWNLOAD_URL}/${SCRIPT}.pem" \
       --signature "${DOWNLOAD_URL}/${SCRIPT}.sig" \
       "$tmpfile" && \
     sh "$tmpfile"; rm -f "$tmpfile")

Using GitHub Attestations

# Set the desired version
VERSION="v0.2.0"

# Install with attestation verification
curl -sL "https://github.com/actionutils/gh-release-notes/releases/download/${VERSION}/install.sh" | \
    (tmpfile=$(mktemp); cat > "$tmpfile"; \
     gh attestation verify --repo=actionutils/gh-release-notes --signer-workflow='actionutils/trusted-go-releaser/.github/workflows/trusted-release-workflow.yml' "$tmpfile" && \
     sh "$tmpfile"; rm -f "$tmpfile")