🌿 Mint v1.0.0 — Releases, distilled

🌿 Mint reaches v1.0.0

Mint turns Git history into explicit, traceable releases. This first stable release brings version resolution, changelogs, immutable Git tags, GitHub Releases, and reviewed environment release controls together behind one Go implementation and a GitHub Action.

🪙 Release state, from source to publication

• Resolve conventional commits into strict SemVer versions, or select an existing release tag without creating a new one.
• Generate changelogs and release notes with GitHub issue links and configurable Linear issue links.
• Create or reuse annotated tags without moving conflicting tags; publish GitHub Releases through the GitHub API.
• Version monorepo components with scoped paths and tag prefixes such as backend/v1.2.3.
• Generate GHCR/ECR publishing workflows while keeping application builds and registry operations in the application's workflow.

⚙️ Actions first, local CLI optional

Use jamesonstone/mint@v1.0.0 in your workflow, or pin this release's full commit SHA. Mint builds its CLI from the published source on the runner; no locally installed Mint binary is needed. command: none places Mint and its adapters on PATH for later steps. The local CLI remains an optional manual helper.

For tags and GitHub Releases, use command: release-publish after a full-history checkout and grant contents: write only to the trusted release job. Read-only commands can run with contents: read. See the integration guide and agent entrypoint.

🧭 Reviewed environment releases

Schema 2 policies support named environments, reviewed/manual/automatic promotion, immutable candidate and artifact binding, team repository authorization, verified deployment history, observation, and explicit reconciliation. Recovery supports roll-forward, isolated hotfixes, and retained-artifact rollback. Project-owned adapters supply trusted build, deployment, and runtime evidence; installing Mint alone does not activate a deployment.

🔒 Concrete release hardening

• Build with patched Go 1.26.9 by default and update golang.org/x/sys to v0.44.0.
• Require HTTPS for release API endpoints, reject embedded URL credentials, refuse redirects, and use a bounded default request timeout. Loopback HTTP remains available for tests.
• Pin the action's Go setup and the self-release checkout to verified upstream commits.
• Capture stdout with a collision-safe multiline delimiter and refresh release tags without forcing updates.
• Generate workflows with the published v1.0.0 reference instead of an absent v1 alias.

📜 License

Mint is released under Apache-2.0, with project attribution in NOTICE. Bundled JetBrains Mono fonts retain their SIL Open Font License.

🧩 Compatibility and migration

Go 1.26.9 or newer is now required to build Mint; Actions installs the default toolchain for you. Custom release API endpoints must support HTTPS without redirects. Replace unpublished @v1 examples with @v1.0.0 or this release's full commit SHA. Public CLI/action interfaces follow SemVer; incompatible public interface changes require a major release. Existing schema 1 production controls remain compatible. Review schema 2 adapter and activation prerequisites before adopting environment control.

🧪 Validation and limits

Full Go tests, vet, build, adapter tests, documentation tests/build, action/workflow YAML checks, workflow lint, and module verification passed. Independent source review covered token transport, promotion authorization and provenance, immutable intents, Git operations, archive handling, and adapters. Redacted source/history secret scans found no leaks; patched-toolchain govulncheck found no vulnerabilities. These checks are scoped evidence, not a guarantee that every defect is absent.

Mint owns release state and coordination. Applications own Docker builds, registry authentication, infrastructure, deployment, and runtime verification. This release does not add prebuilt CLI binaries or provision cloud resources.

Full changes: v0.9.0...v1.0.0