v0.16.0

What's new in v0.16.0

v0.16.0 makes the GitHub Action publishable on the Marketplace by renaming it to rtunk check and adding a CI check that fails before release if the metadata is unpublishable, and hardens the cache against symlink chain escapes. It also runs CodeQL on every change, adds Go fuzz tests, and makes the action always pass --format github.

▸ Changes

• ✔ ❲ci❳: Make action.yml publishable on the Marketplace and check it before a release (#42 by @xunleii)
• ¶ ❲docs❳: State the testing policy and show the OpenSSF Best Practices badge (#41 by @xunleii)
• ✦ ❲ci❳: Run CodeQL on pull requests and add Go fuzz tests for the Scorecard alerts (#40 by @xunleii)
• ⛨ ❲cache❳: Write archive entries through an os.Root to stop symlink chain escapes (#38 by @xunleii)
• ✔ ❲cli❳: Mask the run duration in the fmt flag alias test (#39 by @xunleii)
• ⇧ ❲ci❳: Always pass --format github in the action and make the parallel test deterministic (#37 by @xunleii)
• ¶ ❲docs❳: Rework the agent skills and add issue, release and review skills (#36 by @xunleii)
• ↻ ❲ci❳: Namespace mise tasks and skip Go jobs on unrelated changes (#33 by @xunleii)
• ✔ ❲ci❳: Match the exact archive name when verifying checksums in the action (#35 by @xunleii)
• ✦ ❲ci❳: Add PR Agent workflow for AI pull request description and review (#34 by @xunleii)
• ✔ ❲ci❳: Skip footer-leading-blank on GitHub squash-merge commits (#32 by @xunleii)

◈ Contributors

Thanks to all the contributors to this release:

• @xunleii (#42, #41, #40, #38, #39, #37, #36, #33, #35, #34, #32)

Full Changelog: v0.15.0...v0.16.0

---

^{Summary written by deepseek/deepseek-v4-flash via OpenRouter}