release: cut 0.2.1 - #9
Merged
Merged
Conversation
Consolidates what was in Unreleased: the P0 auth contract work, the resolver and verification-method hardening, the loopback bind defaults, the image rename, and the component-naming refactor. A patch number for content that includes contract hardening, and that is deliberate rather than sloppy. While the version is 0.x this file already declares that even minor releases may change the public API, so patch-vs-minor carries no compatibility promise here. What the number does buy is a stable consumer pin: provin.oss's quickstart tracks the moving v0.2 tag, and cutting v0.3 would have forced that pin to move for no benefit before the first announcement. Also rewrites the image-rename entry, which described the intermediate approach (naming each image explicitly in the publish matrix) that the component-naming refactor then replaced with derivation. A changelog describing a state the code no longer has is worse than one that is merely terse. Cutting this tag is what produces a moving v0.2 image tag at all: the publish workflow derives it from a semver tag push, so workflow_dispatch alone yields only branch and sha tags. That coupling — a version cut being the only way to refresh what consumers pin — is worth revisiting, but not by inflating a version number to work around it. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Consolidates what was in
Unreleased: the P0 auth contract work, the resolver and verification-method hardening, the loopback bind defaults, the image rename, and the component-naming refactor.Why a patch number for contract work
Deliberate, not sloppy. While the version is
0.xthis changelog already declares that even minor releases may change the public API, so patch-vs-minor carries no compatibility promise here.What the number does buy is a stable consumer pin:
provin.oss's quickstart tracks the movingv0.2tag, and cuttingv0.3would have forced that pin to move for no benefit before the first announcement.Why this tag has to exist at all
ghcr.io/provin-line/auth-provider:v0.2does not currently resolve. The publish workflow derives the moving minor tag fromtype=semveron a tag push, so theworkflow_dispatchruns that published the renamed image produced onlydevelopandsha-…tags.So the quickstart — which pins
v0.2— cannot reach the renamed provider image until a semver tag is pushed. That is what this release is for, and it is why the version was not inflated to work around it.Worth recording as a design problem rather than a one-off: a version cut is currently the only way to refresh what consumers pin. Revisiting that coupling (a
workflow_dispatchinput that re-points the moving tag at the current released minor) belongs after publication, not in a release that exists to unblock it.Also fixes a changelog entry that had gone stale
The image-rename entry described the intermediate approach — naming each image explicitly in the publish matrix (#7) — which the component-naming refactor (#8) then replaced with derivation from the component name. A changelog describing a state the code no longer has is worse than one that is merely terse.
After this merges
v0.2.1→publish-imagesfires onpush: tags: ["v*"], producing image tagsv0.2(semver),v0.2.1(ref) andlatestauth-provider:v0.2resolves — cache-free, registry-levelv0.2pin finally pointing at somethingauth-auth-providerpackage🤖 Generated with Claude Code