v0.10.0

0.10.0: migrate gossfile templating from sprig to sprout

Replaces github.com/Masterminds/sprig/v3 with github.com/go-sprout/sprout
v1.1.1 as the template engine behind {{ }} blocks in a gossfile. Sprig has gone quiet since its last release; sprout is the maintained community successor and its sprigin package is a near drop-in replacement.

What changes for anyone writing a gossfile

No function is lost. Sprig had 211, sprout has 293, and the extra 82 are new names rather than replacements.

Five functions render differently, and in every case sprout is fixing a sprig bug rather than introducing one:

Expression	sprig	sprout
{{ "foo bar" | snakecase }}	foo__bar	foo_bar
{{ "foo bar" | camelcase }}	Foo Bar	FooBar
{{ "foo bar" | kebabcase }}	foo--bar	foo-bar
{{ plural 1 "a" "b" }}	exec error	<no value>
{{ "hello" | reverse }}	exec error	[]

A gossfile that leaned on the old doubled-separator output will render differently. This is why the release is a MINOR rather than a patch.

Sprout also prints a deprecation warning at render time for some names, which sprig never did. It fires for 55 of the 95 names sprout marks deprecated, mostly the must* and regex* families and older hash spellings such as sha256sum. The other 40 are silent, including upper, which is the only deprecated name used anywhere in this repo. No logger suppression was needed or added.

One thing gets better rather than differently: docs/goss.yaml carried a commented-out sping_basic block with a TODO saying sprig could not accept it. It works under sprout and is now live in the docs.

Dependencies

Net three fewer indirect requirements: Masterminds/goutils, huandu/xstrings and shopspring/decimal all drop out. The x/crypto Trivy suppression stays and its comment now says why: sprout needs it for the same bcrypt template
functions sprig did, so the suppression survives the swap on its own merits rather than by inheritance.

• x/crypto bumped to v0.56.0

Testing, including one thing reviewers should know

template_test.go is new. The template layer had almost no direct coverage before this, so it is the whole safety net for the swap: it pins the five corrected expressions, the funcMap collision behaviour, both missingkey modes, and the measurement that upper is silent.

Two problems were found while verifying it, both fixed here:

1. The .Funcs() ordering in template.go was unprotected. Its comment calls the ordering load-bearing and warns that reversing it turns a loud failure into a silent one, but swapping the two calls broke no test. The
   existing collision test rebuilds the two-call chain inside the test with its own marker map, so it passes whatever production does. TestFuncMapOrderingIsLoadBearing closes that by rendering through the real filter and asserting on a non-string, where the two implementations actually differ: {{ toUpper 42 }} errors under the correct order and renders <no value> under the reversed one.

2. The golden baseline was blind to the template engine. Every templated spec in the tree needs vars or env the harness does not supply, so all eight rendered as zero-byte failures and their goldens recorded an error string that is identical either side of an engine change. A new render-vars case renders one spec with its vars, using a deliberately double-spaced input because that is where the two engines disagree. While wiring it up, the manifest turned out to list validate render add only, so the new golden would have been written on every run and never compared.

Baseline moves 205 to 208, additions only, nothing existing changed.
Predecessor kept at .golden-baseline.pre-render-vars-205.

Gate

go test -race ./...   532 passed / 0 failed / 7 packages
make lint             0 issues
make vet / make fmt / go mod tidy -diff   clean
make check            exit 0, govulncheck and Trivy no findings
golden-baseline       208/208 byte-identical

Changelog

• 8d98c6c Merge branch 'devel' into feat/sprig-sprout-change
• 22161d2 Merge pull request #29 from krameff/feat/sprig-sprout-change
• 8490d59 Merge pull request #30 from krameff/devel
• fc7201e Merge pull request #31 from krameff/devel
• 6ecaf97 deps: bump golang.org/x/crypto to v0.56.0
• 9fe6090 feat: migrate gossfile templating from sprig to sprout