Release github.com/faustbrian/go-webhook v1.0.0 · faustbrian/go-webhook

1.0.0 - 2026-08-25

Regenerate the exported API baseline with the repository's Go 1.26
toolchain so the stable Envelope.Data contract is represented accurately.

Exclude intentional nested modules from root local-proxy archives so local,
bootstrap, CI, and public module checksums describe the same source
boundary.
Track the pinned documentation-tool lockfile so clean CI checkouts install
the exact validated cspell dependency.
Reconcile standalone dependency checksums against deterministic current
module archives so CI, local verification, and release consumers resolve
identical content.
Harden standalone documentation validation with deterministic spelling and
link checks, package-specific documentation gates, and repository-local
contributor guidance.

Replace obsolete standalone-repository links and workflow claims with
monorepo-canonical targets and current release guidance.
Keep the initial v1.0.0 scope under Unreleased until a tag is published.
Link the package README to the repository-wide Golib documentation portal.

Added a pinned module export baseline so incompatible public API changes
fail the canonical repository gate.

Publish the module from its standalone github.com/faustbrian/go-webhook identity while preserving its documented API and behavior.
Refresh local v0.0.0 owned-module checksums after dependency manifests and
release notes were normalized; runtime behavior and public APIs are
unchanged.
Align the transitive golang.org/x/text dependency with v0.41.0 after the
owned module graph removed GO-2026-5970.
Rename the unpublished adapter packages to target-oriented idempotency,
slog, outbox, queue, and otel paths with unambiguous webhook*
package identifiers.
Declare the unresolved-decision inventory explicitly so repository
specification governance fails closed on any future open interpretation.
Link the specification source matrix directly to the canonical decision
register.
Require owned sibling modules at local v0.0.0; clean external consumers
pin each module to an exact main pseudo-version.
Upgrade gRPC to 1.82.1 to remove the GO-2026-6061 vulnerabilities and
align the isolated module graph.
Refresh owned-module checksums against the final consolidated archives.
Normalized standalone module metadata against the canonical owned dependency
graph, including complete checksums for clean consumer resolution.
Refreshed the canonical logging checksum after its API compatibility tooling
was standardized.

Added an auditable specification decision register, integrity-pinned
normative source manifest, and executable conformance gate for signature,
HTTP, replay, envelope, delivery, retry, and SSRF policies.
Versioned HMAC-SHA-256 and HMAC-SHA-512 signing and verification.
Signed, bounded nonces with injectable generation and a crypto/rand default.
Exact-byte HTTP verification, bounded bodies and headers, rotation windows,
safe typed failures, middleware, atomic replay protection, and a
idempotency adapter.
Deterministic envelopes, bounded delivery and retries, Retry-After,
dead-letter and replay hooks, fan-out, SSRF and DNS-rebinding protection,
and queue and outbox adapters.
Secret-safe observations, independent Python vectors, fuzzers, allocation
benchmarks, complete production coverage, and release gates.
Compiled log diagnostics, telemetry HTTP propagation, deterministic
consumer fixtures, and an executable queued-delivery example.
Pinned GitHub Actions workflow linting in local and CI release gates.
Enforced a pure-Go dependency graph in the standalone safety gate.

Reject malformed and nonnumeric endpoint ports before DNS resolution or
dialing.
Isolate each verification candidate's timestamp and nonce so an invalid
rotation signature cannot alter a later valid candidate.
Reject duplicate signing key IDs and independently validate delivery,
wire, replay, queue, outbox, logging, and telemetry boundaries.
Check response-body and telemetry-runtime cleanup failures in adapter and
SSRF tests instead of silently discarding them.
Express the accepted HTTPS or explicitly enabled HTTP schemes directly,
preserving the default-deny SSRF policy without negation ambiguity.
Saturate numeric Retry-After values at the exact configured maximum,
including subsecond limits, and reject body limits whose sentinel byte would
overflow an int64 bound.
Compare caller timestamps at the signature protocol's Unix-second precision.
Select rotation keys at the signed timestamp, reject negative timestamps,
and reject inverted key validity windows.
Keep replay identity stable across overlapping secret rotation keys.
Cover bounded Content-Type and Idempotency-Key values in v1 signatures.
Preserve and authenticate duplicate query-value order while sorting keys.
Preserve and authenticate the exact case-sensitive HTTP method.
Clamp delivery latency observations when an injected clock moves backward.

The first release will freeze the v1 canonicalization and wire contracts.

Source commit: 7d0aee723d9257a613edec23b130106fed677fac
Exact-head CI: https://github.com/faustbrian/go-webhook/actions/runs/32917638213
Release dry-run: urn:sha256:d981a0abaf2c6c2878470cdb6891f181de8e82eca0109181b82cc42a5db63871
Assets include a CycloneDX SBOM, SLSA v1 in-toto provenance, and SSH-signed checksums.

Verify the checksum attestation with:

ssh-keygen -Y verify -f ALLOWED_SIGNERS -I brian@cline.sh -n golib-release -s SHA256SUMS.sig < SHA256SUMS