Release v0.7.0

What's Changed

Breaking Changes 🛠

#	Title		Author
#103	refactor JSON output structure: introduce pullRequests map data field and use array PR numbers		@haya14busa

Enhancements 🎉

#	Title		Author
#97	feat/cli init command		@haya14busa
#98	feat: add migrate command which migrate github release config to release-drafter config		@haya14busa
#104	feat: introduce pullRequestsByLabel field and example template		@haya14busa

Templates ⛩️

#	Title		Author
#95	template(github-ext.md.jinja): Use markdown links instead of PR URLs		@haya14busa
#102	fix: handle uncategorized PRs properly with github templates		@haya14busa

Bug Fixes 🐛

#	Title		Author
#102	fix: handle uncategorized PRs properly with github templates		@haya14busa
#101	fix(#99): handle existing tag properly		@haya14busa

Documents 🗒️

#	Title		Author
#96	docs: design for 'init' and 'migrate' config subcommands		@haya14busa
#94	Add README.md		@haya14busa

Other Changes

#	Title		Author
#82	[StepSecurity] Apply security best practices		@step-security-bot
#106	post more example release notes to release-pr		@haya14busa

Dependencies

Show all 7 items

#	Title		Author
#87	chore(deps): bump actionutils/trusted-tag-verifier from 0.5.0 to 0.5.1		@dependabot[bot]
#85	chore(deps): bump ossf/scorecard-action from 2.4.0 to 2.4.3		@dependabot[bot]
#84	chore(deps): bump anchore/sbom-action from 0.20.5 to 0.20.6		@dependabot[bot]
#88	chore(deps): bump actions/checkout from 4 to 5		@dependabot[bot]
#86	chore(deps): bump actions/setup-node from 5 to 6		@dependabot[bot]
#91	chore(deps): bump anchore/sbom-action from 0.20.6 to 0.20.7		@dependabot[bot]
#89	chore(deps): bump github/codeql-action from 3.30.8 to 4.30.8		@dependabot[bot]

Contributors

@haya14busa

@dependabot[bot]

@step-security-bot

Full Changelog: v0.6.0...v0.7.0

📋 Release Verification Instructions

Verifying Release Artifacts

Using Cosign

All release artifacts are signed using Sigstore and can be verified using cosign:

# Download the release assets
gh release download v0.7.0 --repo actionutils/gh-release-notes

# Verify the checksum file signature
cosign verify-blob \
  --certificate-identity-regexp '^https://github.com/actionutils/trusted-go-releaser/.github/workflows/trusted-release-workflow.yml@.*$' \
  --certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
  --cert "checksums.txt.pem" \
  --signature "checksums.txt.sig" \
  "checksums.txt"

# Verify checksums of all binaries
sha256sum --ignore-missing -c "checksums.txt"

Using GitHub Attestations

All artifacts have GitHub Attestations that can be verified:

# Verify attestations for the checksum file
gh attestation verify "checksums.txt" --repo actionutils/gh-release-notes --signer-workflow='actionutils/trusted-go-releaser/.github/workflows/trusted-release-workflow.yml'

📦 Installation Scripts

This release includes installation scripts generated by binstaller:

• install.sh - Downloads and installs the binary
• run.sh - Downloads and runs the binary directly

Verifying Installation Scripts

Before using the installation scripts, you can verify their authenticity using cosign (signatures) or GitHub Attestations.

# Download the scripts and their signatures
gh release download v0.7.0 --pattern "*.sh*" --repo actionutils/gh-release-notes

# Verify with cosign (recommended)
cosign verify-blob \
  --certificate-identity-regexp '^https://github.com/actionutils/trusted-go-releaser/.github/workflows/trusted-release-workflow.yml@.*$' \
  --certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
  --cert install.sh.pem \
  --signature install.sh.sig \
  install.sh

cosign verify-blob \
  --certificate-identity-regexp '^https://github.com/actionutils/trusted-go-releaser/.github/workflows/trusted-release-workflow.yml@.*$' \
  --certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
  --cert run.sh.pem \
  --signature run.sh.sig \
  run.sh

# Or verify with GitHub Attestations
# Verify the install script
gh attestation verify install.sh --repo actionutils/gh-release-notes --signer-workflow='actionutils/trusted-go-releaser/.github/workflows/trusted-release-workflow.yml'

# Verify the run script
gh attestation verify run.sh --repo actionutils/gh-release-notes --signer-workflow='actionutils/trusted-go-releaser/.github/workflows/trusted-release-workflow.yml'

Using Installation Scripts

# Install the binary
curl -sSfL https://github.com/actionutils/gh-release-notes/releases/download/v0.7.0/install.sh | sh

# Or run directly without installation
curl -sSfL https://github.com/actionutils/gh-release-notes/releases/download/v0.7.0/run.sh | sh

One-liner Installation with Verification

Using Cosign (recommended)

# Set the desired version and script type
VERSION="v0.7.0"
SCRIPT="install.sh"  # or "run.sh"
DOWNLOAD_URL="https://github.com/actionutils/gh-release-notes/releases/download/${VERSION}"

# Download and verify with cosign, then execute
curl -sL "${DOWNLOAD_URL}/${SCRIPT}" | \
    (tmpfile=$(mktemp); cat > "$tmpfile"; \
     cosign verify-blob \
       --certificate-identity-regexp '^https://github.com/actionutils/trusted-go-releaser/.github/workflows/trusted-release-workflow.yml@.*$' \
       --certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
       --certificate "${DOWNLOAD_URL}/${SCRIPT}.pem" \
       --signature "${DOWNLOAD_URL}/${SCRIPT}.sig" \
       "$tmpfile" && \
     sh "$tmpfile"; rm -f "$tmpfile")

Using GitHub Attestations

# Set the desired version
VERSION="v0.7.0"

# Install with attestation verification
curl -sL "https://github.com/actionutils/gh-release-notes/releases/download/${VERSION}/install.sh" | \
    (tmpfile=$(mktemp); cat > "$tmpfile"; \
     gh attestation verify --repo=actionutils/gh-release-notes --signer-workflow='actionutils/trusted-go-releaser/.github/workflows/trusted-release-workflow.yml' "$tmpfile" && \
     sh "$tmpfile"; rm -f "$tmpfile")