v0.28.1

A documentation and tooling release. One change reaches a running deployment; the rest corrects what the documentation promised and makes the checks that should have caught it able to fail.

⚠️ If you configured container hardening, read this

The documentation described 37 configuration keys that do not exist. Ofelia ignores an unrecognized key without warning, so these lines were silently discarded. Git history shows none of them was ever implemented.

The ones that matter sat in SECURITY.md under container hardening — memory, memory-swap, cpu-shares, cpu-quota, capabilities-add, capabilities-drop, dns, tmpfs — presented as the way to constrain a job. If you set any of them, your jobs were never constrained. Resource limits belong on the Compose service for exec jobs and on the daemon for run jobs, per ADR-002.

Also corrected: max-runtime does not work on job-exec and a [global] max-runtime does not reach it; timeout, delay and max-concurrent-jobs exist nowhere; user is not a job-local key; job-compose takes only file, service and exec.

Fixed

• Notification mails no longer contain invisible characters. The HTML body carried five U+200B zero-width spaces around the job name, duration and command. They shipped in every notification and are a known spam-filter signal.
• The release-verification instructions could not work. Every command in SECURITY.md was wrong — wrong signature file extensions, a signer workflow that does not exist, a verifier aimed at assets no release ships. They are corrected and were executed against the published v0.28.0. The container image tag also drops the v the release tag keeps: v0.28.1 publishes ghcr.io/netresearch/ofelia:0.28.1.
• Nine packages, including the module root, showed "There is no documentation for this package" on pkg.go.dev. Every package and every exported symbol is now documented.

Security

Secret scanning matched nothing. .gitleaks.toml declared an allowlist and no rules, and a gitleaks config file replaces the built-in ruleset unless it extends it — so every scan reported "no leaks found" regardless of input. Verified by planting a token: reported with the fix, silent without it. Turning it on surfaced four documentation examples, now unmistakable placeholders. None is a live credential.

Changed

Error messages now start lowercase, matching Go convention. Anything matching on the leading capital of a message such as Docker image cannot be empty needs adjusting.

Quality gates

The linters could not fail on much: blanket staticcheck exclusions hid the mail template's invisible characters, output was capped at 50 issues per linter so a regression could hide behind the cap, and findings on a line another linter had already flagged were dropped.

New gates, each verified by breaking it — documented INI snippets are parsed with the real parser, so a renamed key cannot leave the docs behind; every HTTP route is held to a declared authentication expectation, closing the gap where a route outside /api/ shipped reachable without a token; and each published release is now re-verified with the commands SECURITY.md gives to users.

Full changelog: v0.28.0...v0.28.1