v0.4.0

Changes

• Add shuck compliance discover to bootstrap and sync .github/compliance.yml @justanotherspy (#58)
• Expand fuzzing to every parser of external input @justanotherspy (#57)
• Move compliance config to .github/compliance.yml @justanotherspy (#56)
• Exclude main.go from coverage and gate CI at 80% internal coverage @justanotherspy (#55)
• Assign Dependabot PRs to justanotherspy @justanotherspy (#54)
• Fix OSSF Scorecard code-scanning findings @justanotherspy (#52)
• Add shuck compliance — check repo settings against .shuck/compliance.yaml @justanotherspy (#49)
• Improve unit test coverage for internal packages @justanotherspy (#51)
• Drill cancelled jobs' logs to show the interrupted step @justanotherspy (#50)
• cache: store under XDG cache dir (~/.cache/shuck) instead of ~/.shuck @justanotherspy (#47)
• Align shuck with go-template's feature set @justanotherspy (#48)
• Add shuck image: GHCR image versions and digests @justanotherspy (#46)
• Modernize to Go 1.26 with go fix and add it to the build process @justanotherspy (#45)
• Harden cache paths and release extraction against traversal/symlink abuse @justanotherspy (#44)
• fix(cli): honor focus flags offline and normalize --state casing @justanotherspy (#43)
• fix: reviews render panic on empty comment body; propagate --refresh to security @justanotherspy (#42)
• refactor(plugin): source shuck from central claude-plugins marketplace @justanotherspy (#41)
• Add standard repo scaffolding from go-template @justanotherspy (#38)

Maintenance

• build(deps): bump chainguard/go from 3d8fa86 to 9b52ed6 in the docker group across 1 directory @dependabot[bot] (#53)
• build(deps): bump the github-actions group with 2 updates @dependabot[bot] (#40)
• build(deps): bump golang.org/x/term from 0.42.0 to 0.43.0 in the go-dependencies group @dependabot[bot] (#39)