Skip to content

v0.30.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 26 Aug 08:00
· 188 commits to main since this release
v0.30.0
This tag was signed with the committer’s verified signature.
CybotTM Sebastian Mendel
SSH Key Fingerprint: NOxv8dcZlMFz3wrLdHILVNSnF6xskqAjN3bnn0i7K30
Verified
Learn about vigilant mode.
c38a03a
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

v0.30.0 is a maintenance release: Go 1.27, the whole dependency graph brought current, and the codebase modernized to the Go 1.26 idioms.

Toolchain

The Go toolchain moved to go1.27.0; the supported minimum stays Go 1.26 (#800). Two lint classes surfaced under the new toolchain and are resolved in the same change: gofumpt's new closing-paren placement, and six //nolint:goconst directives that goconst no longer needs.

Dependencies

The scheduler core netresearch/go-cron moved to v0.16.0, its first release with the Go 1.26 floor (#802). The rest of the graph followed: docker/cli 29.7.2, emersion/go-smtp 0.25.0, moby/moby/client 0.5.1, testify 1.12.1, golang.org/x/crypto 0.55.0, golang.org/x/text 0.41.0 plus indirect moves (#801), and the harden-runner action group (#799).

Internal

go fix and manual passes modernized the code — strings.Cut, slices.Backward (with the safety argument documented at the removal loop), maps.Copy, errors.AsType[T], atomic.Int32 in tests — with no behavior change (#800).

Full Changelog: v0.29.1...v0.30.0

Verify your download

Per-asset signatures are bundled. Verify any single file:

cosign verify-blob \
  --bundle ofelia-linux-amd64.sigstore.json \
  --certificate-identity-regexp "^https://github\.com/netresearch/\.github/\.github/workflows/release-go-app\.yml@" \
  --certificate-oidc-issuer "https://token.actions.githubusercontent.com" \
  ofelia-linux-amd64

Verify checksums against the signed manifest:

cosign verify-blob \
  --bundle checksums.txt.sigstore.json \
  --certificate-identity-regexp "^https://github\.com/netresearch/\.github/\.github/workflows/release-go-app\.yml@" \
  --certificate-oidc-issuer "https://token.actions.githubusercontent.com" \
  checksums.txt
sha256sum -c checksums.txt --ignore-missing

Verify build provenance. Releases are built by a reusable
workflow, so the signing identity is that workflow rather than
this repository -- --signer-workflow is required and
verification fails without it:

gh attestation verify <artifact> \
  --repo netresearch/ofelia \
  --signer-workflow netresearch/.github/.github/workflows/release-go-app.yml

Verify container image:

cosign verify ghcr.io/netresearch/ofelia:0.30.0 \
  --certificate-identity-regexp "^https://github\.com/netresearch/\.github/\.github/workflows/release-go-app\.yml@" \
  --certificate-oidc-issuer "https://token.actions.githubusercontent.com"
gh attestation verify oci://ghcr.io/netresearch/ofelia:0.30.0 \
  --repo netresearch/ofelia \
  --signer-workflow netresearch/.github/.github/workflows/release-go-app.yml
Assets 52
Loading