v0.9.0

What's Changed

This PR establishes the v0.9.0 API and CLI contracts for OCSF Toolkit. It replaces the eventschema-owned pipeline with the new eventpipeline API, makes enrichment and validation configuration more explicit, adds opt-in observable deduplication, improves benchmark comparison tooling, and refreshes release documentation and automation.

Highlights

• Replace the eventschema public API with eventpipeline, including reusable schema loaders for files, fs.FS, bytes, and readers.
• Construct pipelines through explicit options: select enum-sibling and observable actions independently, configure validation, issue levels, observable filtering, and path notation.
• Introduce typed validation and processing-issue codes/levels, with per-code policy controls in both the Go API and CLI.
• Add opt-in generated-observable deduplication. Default enrichment now preserves all generated candidates; generated-only deduplication is available through WithObservableDeduplication(...) / --deduplicate-observables generated.
• Simplify CLI configuration and reporting: component action flags replace the old negation retention flags; summaries are opt-in via --summary; validation findings no longer suppress selected output.
• Improve schema compilation/loading structure, processing allocation coverage, benchmark comparison tooling, and release verification.
• Update examples, architecture and behavior documentation, migration guidance, changelog, OCSF 1.9.0 fixtures, and validator-comparison documentation.

Breaking changes

v0.9.0 intentionally changes both the public Go API and CLI behavior while the project remains pre-1.0. Notable migrations include:

• Library pipeline construction moves from eventschema.Schema methods to eventpipeline.NewPipeline(eventpipeline.WithSchema(schema), ...).
• Combined enrichment/removal processors are replaced with independently configurable enum-sibling and observable actions. In the CLI, --enrich and --unenrich remain shorthands.
• Added per-code issue-level validation-level controls.
  • In the library: WithIssueLevel(...) / WithAllIssueLevels(...) and WithValidationLevel(...) / WithAllValidationLevels(...).
  • In the CLI: --issue-level and --validation-level.
• Library WithWarnOnMissingRecommended() and CLI --warn-on-missing-recommended are removed.
  • In the library, use WithValidationLevel(validation.AttributeRecommendedMissing, validation.LevelWarning) instead.
  • In the CLI, use --validation-level validation_attribute_recommended_missing=warning instead.
• CLI summary output is no longer printed by default; request it with --summary.
• CLI --skip-invalid-output is removed; validation errors affect exit status when requested but do not suppress configured output.

See CHANGELOG.md for the complete migration table and behavioral details.

New Contributors

• @SynqlyGabriel made their first contribution in #1, adding schema loading from io.Reader, allowing applications to supply embedded schemas.
• @lkwdwrd made their first contribution in #3, reducing enrichment allocations and adding representative benchmark and allocation-regression coverage.
• @rmouritzen-splunk made their first contribution in #2, with API and performance improvements.

Full Changelog: v0.8.0...v0.9.0