v0.9.7

Fugaro v0.9.7

Install:

• Homebrew: brew install dimipaun/tap/fugaro
• Go: go install github.com/dimipaun/fugaro/cmd/fugaro@v0.9.7
• Or download an archive below and verify it against checksums.txt (see docs/release.md).

Highlights

• The job images publish again: the 0.9.6 release could not publish them, because their vulnerability scan stopped on a Python library bundled inside two copies of pip that nothing in the image uses, and 0.9.7 removes those copies, so the scan passes and the cheaper review stage of 0.9.6 reaches cloud runs once a repository refreshes its images.

For operators

1. Per machine — upgrade the CLI on every machine that runs Fugaro: brew upgrade dimipaun/tap/fugaro.
2. Per repo checkout — run fugaro upgrade: it pins the plugin to this release, updates it in Claude Code and refreshes the repository's job images from this release's base image, which is what carries the cheaper review stage to your runs; it builds images, which costs money (--yes confirms each build). Do not run it against 0.9.6: that release published no job images.
3. Everything else in 0.9.6's notes (fugaro setup and fugaro update replacing fugaro init) applies unchanged; this release changes no cloud resource by itself.

Known limits

• The 0.9.6 job images do not exist. Its tag stays as the CLI-only release it is; its base image was never published, so a repository cannot refresh its images from 0.9.6.
• The scan still lists HIGH findings that do not stop a release: the Go standard library inside the bundled gcloud helper, crush, docker, gh and yq, and one in fugaro itself; they gate nothing today and are tracked for the next release.

Changelog

• images(base): drop the unused pip from the private Pythons (v0.9.6 Trivy CRITICAL) (#858)
• website: the v0.9.6 summary carries no backticks (the changelog test renders plain text) (#857)

Base images

Published by the images workflow for this tag:

• ghcr.io/dimipaun/fugaro-history:0.9.7 and ghcr.io/dimipaun/fugaro-history:0 (the sweeper and history job's image)
• ghcr.io/dimipaun/fugaro-base:0.9.7 and ghcr.io/dimipaun/fugaro-base:0 (one index for linux/amd64 and linux/arm64; per-architecture tags 0.9.7-amd64 and 0.9.7-arm64)

The images workflow then pulls each one with no login and fails if it is not public or lacks linux/amd64 (and, for fugaro-base, linux/arm64); each image's digest is in that run's summary.

The Terraform modules, the schemas and the plugin are versioned by this same tag.