chore: release v0.16.0#121
Merged
Merged
Conversation
A retrospective /code-review sweep of every merged PR that had never been reviewed — all 32, including the earlier retro-review PRs themselves, which had never been reviewed either. 13 turned up a confirmed, still-live defect; each was fixed in its own PR with a regression test (#108-#120), and the finding was posted as an inline comment on the PR that introduced it. The headline is a secret-redaction hole: v0.9.18's structured fallback only matched bare secret key names, so a compound key like access_token wrote its value to observations.jsonl unredacted. Three of the defects were in bugfix code written to prevent that exact class of bug, which reintroduced it through an unhandled path: pickFreePort's exhaustion fallback ignored the claimed map it exists to honor, kind: compose shipped without a mysql probe so a wrapped mysql fell back to a bare TCP dial (the very race plugins/engine/mysql already had to fix), and AddOrAttach's ENOENT-only prunable check missed the shape where the dir survives but its .git link is gone. No breaking changes; every entry is a fix to already-shipped behavior. The version itself is injected by goreleaser from the tag, so this commit is CHANGELOG-only.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Cuts v0.16.0 for the retrospective-review sweep: 28 commits on
mainsince v0.15.0, 13 of them merged fix PRs (#108-#120) from reviewing every previously-unreviewed merged PR.CHANGELOG-only — goreleaser injects the version from the tag (
-X main.version={{.Version}}), so there is no version constant to bump.Why v0.16.0 (minor) rather than a patch
Every entry is a fix to already-shipped behavior with no breaking changes, so semver would permit v0.15.1. Going minor instead because the sweep includes a security fix (a secret-redaction hole that persisted
access_token-style values unredacted) plus several fixes that change whether a feature runs at all — quality gates never fired outside the monorepo root,on_repo:was dead since it shipped, evolved agents/commands were linked nowhere. Operators reading a patch bump would reasonably skip it; these warrant the attention.Highlights
access_token,client_secret, ...) were missed by the structured redaction fallback added in v0.9.18 and written toobservations.jsonlin the clear.pickFreePort's exhaustion fallback ignored its ownclaimedmap;kind: composeshipped without a mysql probe, so a wrapped mysql fell back to a bare TCP dial — the very two-phase-startup raceplugins/engine/mysqlalready had to fix (measured: ~1.6s of false-ready against a realmysql:8.4);AddOrAttach's ENOENT-only prunable check missed the shape where the dir survives but its.gitlink is gone.on_repo:matching, evolved agents/commands deployment,backfill's CLAUDE.md relink, autostart's "diagnosable" failure logging.Full detail per entry in CHANGELOG.md.
Test plan
goreleaser check— config validgo build ./...go test ./... -short— all packages passgolangci-lint run ./...— 0 issuesAfter merge, tagging
v0.16.0triggers the goreleaser release workflow.