v0.5.0

Release Notes — First release since fork

This is the first release of krameff/goss, forked from goss-org/goss. Huge thank you to everyone whose issues and PRs are incorporated below.
This was created due to time constraints and very specific requirements asked of us. This will align fixes with the original fork where possible, but priorities maybe differ. Utilsing same semantic versioning style as the original to minimise issues for those who wish to use it.

Significant

• go 1.26
• gpg signed releases
• discovery and depends-on
• windows registry
• new build pipeline
• dependencies and versions updated to latest

NEW

• Discovery — run lightweight checks before the main suite and expose results as template variables, via --discover , inline discovery:, or --format discovery
  (goss-org/goss#784; thanks to @uk-bolly for raising the issue and @ekelali for the --vars + --format discovery pipeline suggestion)
• depends-on — declare test prerequisites on any resource; dependents are skipped (not failed) when a prerequisite fails
  (goss-org/goss#1043; thanks to @petkapou for raising the issue and @sshipway for the design feedback)
• registry resource — Windows registry validation (exists, value, type checks; five hives, six data types, native Go API)
  (goss-org/goss#1053; thanks to @Blankf)
• Windows service checks — implemented via PowerShell Get-Service (enabled, running, exists)
  (goss-org/goss#1017; thanks to @cthiel42)
• http resource: request-query-params — URL query parameters with proper encoding and duplicate-key support
  (goss-org/goss#1013; thanks to @riton)
• Multiple --vars files — merged in flag order, later files override; --vars-inline still applies last
  (goss-org/goss#1023; thanks to @Lirt for PR #1024)
• GoReleaser-based release pipeline — cross-platform archives, multi-arch container images with SBOMs
  (goss-org/goss#1052; thanks to @kgaughan)
• GPG-signed release checksums, with the public key published in the repo and documented setup for verifying a release
• linux/arm64, linux/ppc64le, and darwin/arm64 (Apple Silicon) platforms now supported in CI and release builds
• install.sh now supports s390x
  (goss-org/goss#1068)
• goss -v now shows build reference to distinguish from official goss release

FIXED

• HTTP checks now close response bodies after validation, preventing connection leaks and OOM under many concurrent HTTP tests
  (goss-org/goss#1058; thanks to @dukelion)
• File contents checks now report the actual file content on failure instead of a Go object reference
  (goss-org/goss#1055; thanks to @ckbaker10)
• have-patterns matcher now honours trailing regex flags (/i, /m, /s)
  (goss-org/goss#1057; thanks to @ckbaker10)
• port resource no longer silently discards netstat parse errors — a malformed line now fails the check explicitly instead of reporting the port as closed
• ContainElements matcher error messages restored to their clearer pre-iterator form for invalid inputs
  (goss-org/goss#1067; thanks to @kgaughan)
• CLI announce output, health-probe debug logging, and content-negotiation error handling no longer leak sensitive data (passwords, response bodies, raw headers) into logs

UPDATED

• CLI migrated from urfave/cli v1 to urfave/cli/v3, dropping legacy transitive dependencies
  (goss-org/goss#1060; thanks to @kgaughan)
• Error handling standardized on sentinel errors and %w wrapping, enabling errors.Is/errors.As for callers
  (goss-org/goss#1066; thanks to @kgaughan)
• Dependency and tooling refresh: golangci-lint v2, updated gomega and prometheus/common, Trivy action updates
  (goss-org/goss#1064; thanks to @kgaughan)
• Container images and Dockerfile simplified around GoReleaser-built binaries
• Docker base image bumped to Alpine 3.21 and Go to 1.26, resolving several CVEs
• Dependency scanning (govulncheck, Trivy) and CodeQL static analysis added to CI
• Continuous release verification: SECURITY.md and CODE_OF_CONDUCT.md added