Release cipherscope 0.3.0

.github/workflows/release.yml

@@ -84,6 +84,7 @@ jobs:
       - name: GitHub Release
         uses: softprops/action-gh-release@efb35369e0ad2afab669f228072c1b0d510eae64 # v3.0.3
         with:
+          body_path: docs/releases/${{ github.ref_name }}.md
           files: |
             dist/**/*.tar.gz
             dist/**/*.zip

Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "cipherscope"
-version = "0.2.5"
+version = "0.3.0"
 edition = "2024"
 rust-version = "1.88"
 description = "A high-performance, language-aware tool for scanning source code to detect cryptographic libraries and algorithms usage."

docs/releases/v0.3.0.md

@@ -0,0 +1,56 @@
+CipherScope 0.3.0 adds JavaScript and TypeScript scanning and improves detection,
+scan safety, configuration validation, and release verification.
+
+### Compatibility and upgrading
+
+- Building from source requires **Rust 1.88 or newer**.
+- Library users should update their dependency requirement to `cipherscope = "0.3"`.
+  Public pattern/parser types have changed, including the new `Language::JavaScript`,
+  `Language::TypeScript`, and `Language::Tsx` variants. Update exhaustive matches
+  and code that constructs public pattern types directly.
+- Invalid custom pattern files now fail with diagnostics. Check unknown fields,
+  misspelled language names, unsupported schema versions, duplicate library names,
+  and empty names/language lists.
+- Incomplete scans now exit unsuccessfully. Stdout may contain partial findings;
+  check the exit status before treating an inventory as complete.
+- `--output` stages results and replaces the destination only after a successful
+  scan. Existing source files, explicit inputs, custom pattern files, and symlink
+  destinations are protected. The destination directory must be writable. On
+  Windows, close handles to an existing destination before scanning.
+- Use `--gitignore=false` to disable ignore handling. `--threads 0` is rejected.
+
+### Added and improved
+
+- JavaScript and TypeScript grammars and patterns for Node.js crypto, Web Crypto,
+  and CryptoJS, with dedicated TSX parsing and case-aware source discovery.
+- A shared `scan_with_patterns` library API for caller-supplied patterns.
+- Bounded discovery/result queues, precompiled include and constant patterns,
+  cached line offsets, and reduced duplicate scanning work.
+- Owned, bounded source reads instead of file-backed memory maps; file-size limits
+  are also enforced while reading.
+- Conservative import hints preserve imports that occur after comments or inside
+  indented code. AST comment masking prevents commented-out APIs from becoming
+  algorithm findings while preserving evidence byte offsets.
+- Independent language feature checks and C-only header/fixture support.
+- Expanded regression tests and benchmarks, platform CI for Linux/macOS/Windows,
+  Rust 1.88 checks, pinned GitHub Actions, and recurring dependency audits.
+- Patched `anyhow` and `crossbeam-epoch` dependencies; removed `memmap2`.
+
+### Install
+
+```sh
+cargo install cipherscope --version 0.3.0 --locked
+```
+
+Prebuilt binaries are attached for Linux x86_64, Windows x86_64, macOS Intel,
+and macOS Apple silicon. Each archive contains the `cipherscope` executable.
+
+### Known limitations
+
+Constant resolution is not scope-aware, finding deduplication is coarse, and
+ordinary strings/docstrings may still match fallback patterns. Kotlin and Erlang
+catalog entries do not yet have parsers. See the
+[engineering review](https://github.com/script3r/cipherscope/blob/v0.3.0/docs/code-review-2026-09-05.md)
+for details and follow-up findings.
+
+[All changes since v0.2.5](https://github.com/script3r/cipherscope/compare/v0.2.5...v0.3.0)

docs/releasing.md

@@ -0,0 +1,23 @@
+# Releasing CipherScope
+
+1. Choose an unused version after checking crates.io and GitHub releases. Account
+   for public API and CLI compatibility changes; for this pre-1.0 crate, use a new
+   minor version for incompatible changes.
+2. Update the package version in `Cargo.toml` and refresh the local package entry
+   in `Cargo.lock` with `cargo check`. Add release notes at
+   `docs/releases/v<VERSION>.md`, including upgrade requirements.
+3. Run formatting, warnings-denied Clippy for all targets under both all and
+   minimal features, all-feature/minimal tests, the dependency audit, and
+   actionlint. Commit the release preparation, verify it with
+   `cargo publish --locked --dry-run`, and get the commit onto main with green CI.
+4. Create an annotated `v<VERSION>` tag on that main commit and push the tag.
+   `.github/workflows/release.yml` builds four binary archives, publishes the crate
+   using the repository's `CARGO_REGISTRY_TOKEN` secret, then creates a GitHub
+   release using the committed release notes.
+5. Monitor the Release workflow. Verify the crates.io version, all four GitHub
+   assets, and the reported version of a downloaded binary. Do not move a tag or
+   republish an already published crate version to recover from a failed release.
+
+Crates.io publication and the GitHub release are separate workflow steps. If
+publication succeeds but a later step fails, preserve the published version and
+complete only the remaining GitHub release/asset work.