From 2cb12f74bbbf464bda10bc6a9e02683eff8221d4 Mon Sep 17 00:00:00 2001 From: Charles Green Date: Sun, 2 Aug 2026 21:56:42 +0900 Subject: [PATCH] Prepare v0.3.0 Comment commands address the adopter's own App. v0.2.0's fixed prefix fixed the multi-tenant bug and gave up GitHub's autocomplete, which only offers accounts with repository access and is the whole reason a handle beats a prefix. Also fixes the release check itself: it matched the Go version pin as a fixed string, so gofmt realigning that constant made it fail on this very release. A check a formatter can invalidate is worse than none. --- .github/workflows/simplycubed.yml | 2 +- CHANGELOG.md | 45 +++++++++++++++++++++++++++ README.md | 6 ++-- cmd/simplycubed/main.go | 2 +- docs/setup.md | 2 +- docs/templates/simplycubed-caller.yml | 6 ++-- scripts/verify-release.sh | 8 +++-- 7 files changed, 60 insertions(+), 11 deletions(-) diff --git a/.github/workflows/simplycubed.yml b/.github/workflows/simplycubed.yml index 90e4458..6647577 100644 --- a/.github/workflows/simplycubed.yml +++ b/.github/workflows/simplycubed.yml @@ -48,7 +48,7 @@ on: type: string version: description: SimplyCubed CLI tag to install. - default: v0.2.0 + default: v0.3.0 required: false type: string secrets: diff --git a/CHANGELOG.md b/CHANGELOG.md index e7c4ba0..f24a9ab 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -3,6 +3,51 @@ All notable changes are recorded here and summarized again in the matching GitHub release notes for each tag. +## v0.3.0 + +**Comment commands address your own App.** v0.2.0 replaced `@simplycubed-code` +with `/simplycubed`, which fixed the multi-tenant bug and gave up the only thing +that makes a handle worth having. GitHub offers accounts **with repository +access** in its autocomplete, so a real mention completes after someone types +`@a` without them knowing the bot's name. A prefix that is not an account cannot +do that, and typing `/` opens GitHub's own menu, which is a fixed set of five +built-ins and matches nothing. + +**Breaking.** `.github/simplycubed.yml` gains a required `appName:`, +`simplycubed init` requires `--app-name`, and the comment prefix changes again. +Re-run `simplycubed init --workflow --app-name ` to regenerate both +files. + +- **`appName:` is the source of truth**, and the parser, help text, + unknown-command reply, and wrong-surface replies all render from it. The agent + can no longer tell anyone to mention a different account. It accepts + `acme-code`, `@acme-code`, or `acme-code[bot]`, because all three are how + people write the same App. +- **The workflow trigger stays a literal**, written by `init` from that same + value. A workflow decides whether to start before any code runs, so matching + loosely there would mint a token, check out, install Go, install the CLI and + start a sandbox — roughly thirty seconds — every time someone mentioned a + colleague, to then do nothing. +- **`preflight` fails when the two disagree.** The handle necessarily lives in + two files and the App can push only one of them, since it holds no `workflows` + permission by design. Drift is silent in the worst way: comments stop working + with no error anywhere. The check names both values and says to re-run `init`. +- **`--app-name` is required at first install**, with an error that explains the + name is yours rather than merely demanding a flag. Re-running `init` without + it keeps whatever the config already says, so upgrading cannot silently change + the handle a team already types. +- The install commands in the README and `docs/setup.md` show `` + with a link to Releases, and `scripts/verify-release.sh` now also pins the + README's "Current release" banner. v0.2.0 shipped with that banner still + announcing v0.1.9, because it was prose rather than a checked pin. +- **`scripts/verify-release.sh` no longer breaks on formatting.** It matched the + Go version pin as a fixed string, so gofmt realigning that constant made the + check fail on the very release it was meant to guard. It now matches with a + regex that tolerates the alignment. +- The README leads with what the product is. It opened with a dry run, ten lines + before the overview, and carried three consecutive install sections that all + pointed at `docs/setup.md`. + ## v0.2.0 **This release makes the product installable by someone who is not us.** Every diff --git a/README.md b/README.md index d219c71..9eda1a9 100644 --- a/README.md +++ b/README.md @@ -4,7 +4,7 @@ SimplyCubed Code is an autonomous coding agent you install into your own GitHub. Your team files an issue, the agent prepares a pull request in your repository, and one of your reviewers decides whether it ships. -> Beta. Current release: `v0.2.0`. Product overview: [simplycubed.com/code](https://simplycubed.com/code?utm_source=github&utm_medium=readme&utm_campaign=code). See [Status](#status). +> Beta. Current release: `v0.3.0`. Product overview: [simplycubed.com/code](https://simplycubed.com/code?utm_source=github&utm_medium=readme&utm_campaign=code). See [Status](#status). ## Product overview @@ -36,7 +36,7 @@ go install github.com/simplycubed/code/cmd/simplycubed@ simplycubed version ``` -With `v0.2.0`, that prints `0.2.0`. Pre-1.0 releases follow semver with the +With `v0.3.0`, that prints `0.3.0`. Pre-1.0 releases follow semver with the usual caveat: minor versions may still change behavior. Pin the tag you have validated rather than floating on `@latest`. @@ -227,7 +227,7 @@ The GitHub App identity is your own App's `[bot]` account. That bot is the singl ## Status -Beta, and honest about it. Two loops run end to end via the CLI on the Codex-on-Azure engine: issue to pull request, and fix-on-request (a human requests changes, the fixer addresses them and pushes back). `v0.2.0` is the latest release and you should still expect rough edges. +Beta, and honest about it. Two loops run end to end via the CLI on the Codex-on-Azure engine: issue to pull request, and fix-on-request (a human requests changes, the fixer addresses them and pushes back). `v0.3.0` is the latest release and you should still expect rough edges. Roadmap, roughly in order: diff --git a/cmd/simplycubed/main.go b/cmd/simplycubed/main.go index 3c6fecd..1c23a78 100644 --- a/cmd/simplycubed/main.go +++ b/cmd/simplycubed/main.go @@ -150,7 +150,7 @@ gate: ` const ( - latestKnownWorkflowTag = "v0.2.0" + latestKnownWorkflowTag = "v0.3.0" callerWorkflowTagToken = "__SIMPLYCUBED_TAG__" callerWorkflowAppNameToken = "__SIMPLYCUBED_APP_NAME__" ) diff --git a/docs/setup.md b/docs/setup.md index 9ab94fc..37631d8 100644 --- a/docs/setup.md +++ b/docs/setup.md @@ -30,7 +30,7 @@ go install github.com/simplycubed/code/cmd/simplycubed@ simplycubed version ``` -With `v0.2.0`, `simplycubed version` prints `0.2.0`. +With `v0.3.0`, `simplycubed version` prints `0.3.0`. 2. In the target repository, generate the setup files and labels: diff --git a/docs/templates/simplycubed-caller.yml b/docs/templates/simplycubed-caller.yml index 45b97d8..6e29e18 100644 --- a/docs/templates/simplycubed-caller.yml +++ b/docs/templates/simplycubed-caller.yml @@ -11,7 +11,7 @@ on: jobs: run: if: ${{ github.event_name == 'issues' && github.event.label.name == 'sc:go' }} - uses: simplycubed/code/.github/workflows/simplycubed.yml@v0.2.0 + uses: simplycubed/code/.github/workflows/simplycubed.yml@v0.3.0 with: ref: ${{ github.event.issue.number }} github-app-client-id: ${{ vars.SIMPLYCUBED_GH_APP_CLIENT_ID }} @@ -27,7 +27,7 @@ jobs: if: >- github.event_name == 'pull_request_review' && contains(fromJSON('["OWNER","MEMBER","COLLABORATOR"]'), github.event.review.author_association) - uses: simplycubed/code/.github/workflows/simplycubed.yml@v0.2.0 + uses: simplycubed/code/.github/workflows/simplycubed.yml@v0.3.0 with: ref: ${{ github.event.pull_request.number }} github-app-client-id: ${{ vars.SIMPLYCUBED_GH_APP_CLIENT_ID }} @@ -50,7 +50,7 @@ jobs: github.event.comment.user.type != 'Bot' && startsWith(github.event.comment.body, '@your-app-name') && contains(fromJSON('["OWNER","MEMBER","COLLABORATOR"]'), github.event.comment.author_association) - uses: simplycubed/code/.github/workflows/simplycubed.yml@v0.2.0 + uses: simplycubed/code/.github/workflows/simplycubed.yml@v0.3.0 with: ref: ${{ github.event.issue.number }} github-app-client-id: ${{ vars.SIMPLYCUBED_GH_APP_CLIENT_ID }} diff --git a/scripts/verify-release.sh b/scripts/verify-release.sh index 2d3065d..ebe8c3e 100755 --- a/scripts/verify-release.sh +++ b/scripts/verify-release.sh @@ -30,14 +30,18 @@ fi # with a link to Releases, so they are not pinned here. fail=0 for pin in \ - "cmd/simplycubed/main.go:latestKnownWorkflowTag = \"${version}\"" \ + "cmd/simplycubed/main.go:latestKnownWorkflowTag[[:space:]]*= \"${version}\"" \ "docs/templates/simplycubed-caller.yml:simplycubed.yml@${version}" \ ".github/workflows/simplycubed.yml:default: ${version}" \ "README.md:Current release: \`${version}\`" do file="${pin%%:*}" needle="${pin#*:}" - if ! grep -qF "${needle}" "${file}"; then + # Extended regex, not a fixed string: the Go pin is a constant whose alignment + # gofmt controls, so adding another constant to the same block silently broke + # an exact match. A release check that a formatter can invalidate is worse + # than none, because it fails on the one change it was meant to guard. + if ! grep -qE "${needle}" "${file}"; then echo "${file} does not pin ${version} (expected to find: ${needle})" >&2 fail=1 fi