Skip to content

0.1.19

Choose a tag to compare

View all tags
@dgprivate dgprivate released this 21 Aug 14:46
· 16 commits to main since this release
v0.1.19
995bb82

Everything in this release is about being able to check what the project claims, rather than take it on trust.

services:
  kronoterm2mqtt:
    image: hausbit/kronoterm2mqtt:0.1.19

Tests and correctness

  • 200 tests, coverage 83% → 96%, and the build now fails below 95%
  • Writing them turned up three real defects, all fixed: the loop mode callback compared an enum member against a string so expedited heating never switched itself off after five hours; an unknown MQTT payload escaped the callback that was written to catch it; and ranges() was annotated as returning a list while being a generator
  • Two pieces of dead code removed: a get_definitions() copied onto a class that lacks the field it reads, and the tomli fallback that cannot run on Python 3.12

Documentation

  • REFERENCE.md — every command, setting, Modbus register source, MQTT topic and health response
  • CONTRIBUTING.md — what a change has to pass before it can be merged
  • SECURITY.md and CODE_OF_CONDUCT.md — how to report something, privately
  • README now leads with the published image and says where to send a bug report

Supply chain

  • security/README.md maps the CIS Docker Benchmark controls to the command that verifies each one, and states what is deliberately not claimed: FIPS, STIG, or any patching service level
  • OpenVEX statements record findings that cannot be fixed and do not apply here, in a form grype --vex and trivy --vex read
  • Renovate keeps the base image digest, syft, uv, the actions and uv.lock moving; the image is rebuilt weekly
  • Every GitHub Action is pinned by commit SHA, uv is copied from a digest-pinned image instead of installed with pip, CodeQL runs on every push, and OpenSSF Scorecard grades the result
  • This release carries its SBOM as an asset, with a Sigstore bundle beside it:
cosign verify-blob --bundle kronoterm2mqtt-v0.1.19.sbom.cdx.json.sigstore.json \
  --certificate-identity-regexp '^https://github.com/.+/.github/workflows/publish-image.yml@.+' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  kronoterm2mqtt-v0.1.19.sbom.cdx.json

No change to how the service behaves: same Modbus handling, same MQTT entities, same health endpoint as 0.1.18.

Assets 4
Loading