v0.14.0

v0.14.0

This release adds a public helper for custom job wrappers and fixes a high-severity concurrency bug in the test clock.

RunJob helper for custom wrappers

Writing a custom JobWrapper that correctly handles both plain Job and JobWithContext required reimplementing the same type-switch every time. The new RunJob(ctx, job) function encapsulates this dispatch — if the job implements JobWithContext, it calls RunWithContext(ctx); otherwise it calls Run(). All built-in wrappers and the internal scheduler now use RunJob, consolidating what was previously duplicated logic.

See the updated custom wrapper example in the architecture docs.

(#355, PR#356 — contributed by @jrouzierinverse)

FakeClock BlockUntil race condition fix

FakeClock.BlockUntil had a classic missed-wakeup race: after releasing the mutex, it waited on a channel — but if a timer was created in that gap, the notification was lost and the caller hung indefinitely. The fix replaces the channel-based waiter list with sync.Cond, where Wait() atomically releases the mutex and sleeps, guaranteeing no missed broadcasts. The redundant fired field on fakeTimer was also removed since timer activity is already tracked by heap presence.

A regression stress test (100 iterations of concurrent BlockUntil vs NewTimer) is included to prevent this from returning.

(#357, PR#358 — contributed by @jrouzierinverse)

Other changes

• CI: Org reusable workflow references now use @main instead of SHA pins, so upstream improvements propagate automatically (PR#359)
• Toolchain: Updated from go1.25.5 to go1.26.2; minimum go 1.25 unchanged (PR#360)
• DST docs: Added industry context and references — POSIX, ISC cron, systemd, Kubernetes CronJob (PR#354)

Contributors

• @jrouzierinverse — RunJob export, FakeClock race fix
• @CybotTM — review, tests, docs, CI improvements

Supply Chain Security

This release includes:

• SBOM: Software Bill of Materials in CycloneDX and SPDX formats
• Checksums: SHA256 checksums for all artifacts
• Signatures: Keyless Sigstore/Cosign signatures for verification
• SLSA Provenance: Generated by separate workflow after release

Verify with Cosign

# Install cosign: https://docs.sigstore.dev/cosign/installation/

# Download release artifacts
gh release download v0.14.0 -R netresearch/go-cron

# Verify checksums signature
cosign verify-blob \
  --certificate checksums.txt.pem \
  --signature checksums.txt.sig \
  --certificate-identity-regexp "https://github.com/netresearch/go-cron/*" \
  --certificate-oidc-issuer "https://token.actions.githubusercontent.com" \
  checksums.txt

# Verify file checksums
sha256sum -c checksums.txt

Full Changelog: v0.13.4...v0.14.0