Release v0.5.0

What's Changed

Breaking Changes 🛠

#	Title		Author
#55	--json data shaping and remove extra fetches		@haya14busa
#69	feat: change --include-new-contributors to --skip-new-contributors		@haya14busa
#70	refactor: improve core library API and move logic from CLI to core		@haya14busa
#71	chore: enable oxlint typescript/no-explicit-any rule and fix all violations		@haya14busa

Enhancements 🎉

#	Title		Author
#53	feat: PR-only GraphQL + include-paths via GraphQL files		@haya14busa
#55	--json data shaping and remove extra fetches		@haya14busa
#57	feat: add sponsor-fetch-mode flag to control sponsor information retrieval		@haya14busa
#58	feat: add experimental HTML sponsor check mode		@haya14busa
#59	feat: auto sponsor-fetch-mode to intelligently select fetching method		@haya14busa
#62	feat: add full changelog link to JSON output		@haya14busa
#67	feat: Support minijinja template		@haya14busa

Bug Fixes 🐛

#	Title		Author
#64	feat: restore version fields in JSON output		@haya14busa
#72	fix: normalize release data consistently for both prevTag and auto-detection paths		@haya14busa
#74	Fix type issues in sponsor-html-checker		@haya14busa

Other Changes

#	Title		Author
#66	fix: resolve typecheck error and add typecheck to CI		@haya14busa
#73	feat: add minijinja release notes templates		@haya14busa

Contributors

@haya14busa

@github-actions

Full Changelog: v0.4.0...v0.5.0

📋 Release Verification Instructions

Verifying Release Artifacts

Using Cosign

All release artifacts are signed using Sigstore and can be verified using cosign:

# Download the release assets
gh release download v0.5.0 --repo actionutils/gh-release-notes

# Verify the checksum file signature
cosign verify-blob \
  --certificate-identity-regexp '^https://github.com/actionutils/trusted-go-releaser/.github/workflows/trusted-release-workflow.yml@.*$' \
  --certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
  --cert "checksums.txt.pem" \
  --signature "checksums.txt.sig" \
  "checksums.txt"

# Verify checksums of all binaries
sha256sum --ignore-missing -c "checksums.txt"

Using GitHub Attestations

All artifacts have GitHub Attestations that can be verified:

# Verify attestations for the checksum file
gh attestation verify "checksums.txt" --repo actionutils/gh-release-notes --signer-workflow='actionutils/trusted-go-releaser/.github/workflows/trusted-release-workflow.yml'

📦 Installation Scripts

This release includes installation scripts generated by binstaller:

• install.sh - Downloads and installs the binary
• run.sh - Downloads and runs the binary directly

Verifying Installation Scripts

Before using the installation scripts, you can verify their authenticity using cosign (signatures) or GitHub Attestations.

# Download the scripts and their signatures
gh release download v0.5.0 --pattern "*.sh*" --repo actionutils/gh-release-notes

# Verify with cosign (recommended)
cosign verify-blob \
  --certificate-identity-regexp '^https://github.com/actionutils/trusted-go-releaser/.github/workflows/trusted-release-workflow.yml@.*$' \
  --certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
  --cert install.sh.pem \
  --signature install.sh.sig \
  install.sh

cosign verify-blob \
  --certificate-identity-regexp '^https://github.com/actionutils/trusted-go-releaser/.github/workflows/trusted-release-workflow.yml@.*$' \
  --certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
  --cert run.sh.pem \
  --signature run.sh.sig \
  run.sh

# Or verify with GitHub Attestations
# Verify the install script
gh attestation verify install.sh --repo actionutils/gh-release-notes --signer-workflow='actionutils/trusted-go-releaser/.github/workflows/trusted-release-workflow.yml'

# Verify the run script
gh attestation verify run.sh --repo actionutils/gh-release-notes --signer-workflow='actionutils/trusted-go-releaser/.github/workflows/trusted-release-workflow.yml'

Using Installation Scripts

# Install the binary
curl -sSfL https://github.com/actionutils/gh-release-notes/releases/download/v0.5.0/install.sh | sh

# Or run directly without installation
curl -sSfL https://github.com/actionutils/gh-release-notes/releases/download/v0.5.0/run.sh | sh

One-liner Installation with Verification

Using Cosign (recommended)

# Set the desired version and script type
VERSION="v0.5.0"
SCRIPT="install.sh"  # or "run.sh"
DOWNLOAD_URL="https://github.com/actionutils/gh-release-notes/releases/download/${VERSION}"

# Download and verify with cosign, then execute
curl -sL "${DOWNLOAD_URL}/${SCRIPT}" | \
    (tmpfile=$(mktemp); cat > "$tmpfile"; \
     cosign verify-blob \
       --certificate-identity-regexp '^https://github.com/actionutils/trusted-go-releaser/.github/workflows/trusted-release-workflow.yml@.*$' \
       --certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
       --certificate "${DOWNLOAD_URL}/${SCRIPT}.pem" \
       --signature "${DOWNLOAD_URL}/${SCRIPT}.sig" \
       "$tmpfile" && \
     sh "$tmpfile"; rm -f "$tmpfile")

Using GitHub Attestations

# Set the desired version
VERSION="v0.5.0"

# Install with attestation verification
curl -sL "https://github.com/actionutils/gh-release-notes/releases/download/${VERSION}/install.sh" | \
    (tmpfile=$(mktemp); cat > "$tmpfile"; \
     gh attestation verify --repo=actionutils/gh-release-notes --signer-workflow='actionutils/trusted-go-releaser/.github/workflows/trusted-release-workflow.yml' "$tmpfile" && \
     sh "$tmpfile"; rm -f "$tmpfile")