609 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
Kevin Veen-Birkenbach	9542f68f90	Release version 2.4.0 latest v2.4.0	2026-11-07 15:45:28 +00:00
Kevin Veen-BirkenbachandClaude Opus 5.5	7fb229688b	feat(worktree): keep a per-worktree merge flow that scripts read ... Every worktree can carry a deterministic merge flow in <git-dir>/pkgmgr/flow.yml (never committed, gone with the worktree): pull lists the refs merged into the branch, in order, before a gate, deploy or merge; push lists the branches the finished branch is merged into, in order, each then pushed by the operator. - pkgmgr worktree flow [PATH] [--json] shows it; flow set (--pull REF.. | --no-pull) (--push BRANCH.. | --no-push) replaces both lists atomically (0600 temp file, os.replace, pkgmgr/ of mode 0700); flow clear removes it. JSON: worktree, git_dir, branch, flow_branch, pull, push, source (file, none, invalid), warnings. - pkgmgr worktree up gains repeatable --pull/--push; without them pull is the base and push its local branch (origin/main gives main). - pkgmgr branch tree carries "flow": {pull, push, source} or null on every item with a worktree, read from the linked worktree's metadata dir without running git inside the worktree; the Agent Orchestrator shows it. The file and the arguments may come from an agent: every entry must equal its git check-ref-format --branch output (scan mode, cwd /) and must not start with -; the reader opens pkgmgr/ and flow.yml without following links, non-blocking, refuses anything but a regular file, caps at 64 KiB, uses yaml.safe_load, rejects unknown keys, wrong types and bool versions, and never raises into callers: a bad file reads as source invalid with empty lists and a warning. Tests: 30 new (unit and integration on real repositories), unit suite 500 OK, integration 254 with the two known sandbox signing errors of test_publish_integration only. 🎯 Fix: 92 % 💥 Break: 4 % 💸 Cost: 97 % ⏱️ Time: 93 % 🛡️ Security: 100 % 🏆 Score: 98 🚦 Gate: ✅ 90/5, cost and time <= 100, security 100 % Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-11-07 15:11:43 +00:00
Kevin Veen-BirkenbachandClaude Opus 5.5	4c8b137449	fix(git): refuse repository config that runs a program before push, release and gc ... An agent that can write a repository's .git/config could make the operator's pkgmgr push, release or branch gc run a program or reroute the push. UNSAFE_CONFIG lists the local keys that do (core.sshCommand, gitProxy, askPass, fsmonitor, alternateRefsCommand, credential helpers, gpg programs, protocol.*, config hooks, gc.recentObjectsHook, http proxy/TLS/cookie keys, remote pack programs and proxy, url rewrites). push and release refuse up front; gc skips its fetch and keeps remote branches. Filter drivers, hooksPath, gpg.format and include stay allowed for git-lfs, husky and per-repo signing. SCAN_FLAGS add --no-pager and switch off config-defined hooks (hook.<event>.enabled=false), which core.hooksPath does not cover. The signing amend, gc's fetch, delete push and branch -D run under them. Remote and ref names sit behind -- in every push, fetch, ls-remote and remote get-url, fetches and pushes no longer recurse into submodules, and a staged gitlink is no longer folded into the signed HEAD. gc skips a compose project that also has containers outside the worktree. 🎯 Fix: 92 % 💥 Break: 4 % 💸 Cost: 91 % ⏱️ Time: 89 % 🛡️ Security: 100 % 🏆 Score: 100 🚦 Gate: ✅ 90/5, cost and time <= 100, security 100 % Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-11-07 13:26:40 +00:00
Kevin Veen-BirkenbachandClaude Opus 5.5	fb6183838b	fix(push): sign only an unsigned HEAD instead of rebasing the range ... pkgmgr push re-signed every unpushed commit with rebase --rebase-merges -S, which rewrote history that mirrors or peers may already hold. It now amends only HEAD with -S (--no-edit --no-verify) and warns about older unsigned commits, which stay as they are; the push check refuses only an unsigned HEAD. The signing base prefers the branch's own remote-tracking ref. 🎯 Fix: 92 % 💥 Break: 3 % 💸 Cost: 100 % ⏱️ Time: 100 % 🛡️ Security: 100 % 🏆 Score: 89 🚦 Gate: ✅ 90/5, cost and time <= 100, security 100 % Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-11-07 12:20:01 +00:00
Kevin Veen-BirkenbachandClaude Opus 5.5	a324ed0b65	Merge branch 'feature/worktree-commands-v2' into merge/main-20261107 ... Brings the host-independent trust tests (4458fcc) that the Nix-based gate container needs. 🎯 Fix: 92 % 💥 Break: 1 % 💸 Cost: 100 % ⏱️ Time: 100 % 🛡️ Security: 100 % 🏆 Score: 91 🚦 Gate: ✅ 90/5, cost and time <= 100, security 100 % Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-11-07 12:09:09 +00:00
Kevin Veen-BirkenbachandClaude Opus 5.5	4458fcc160	test(worktree): take the trusted PATH fixture from os.defpath, not the host ... The full gate runs in a Nix-based container where true resolves into /nix/store, which is group-writable and therefore never root-controlled, so the two trusted_path tests failed there. They now take the first root-controlled os.defpath directory and skip when there is none. A sticky group-writable ancestor stays refused: on multi-user Nix any user can have the daemon build root-owned store content (skeptic round 7); the README says to pin an absolute path on Nix. 🎯 Fix: 92 % 💥 Break: 1 % 💸 Cost: 100 % ⏱️ Time: 100 % 🛡️ Security: 100 % 🏆 Score: 91 🚦 Gate: ✅ 90/5, cost and time <= 100, security 100 % Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-11-07 11:58:53 +00:00
Kevin Veen-BirkenbachandClaude Opus 5.5	c78e0a34a3	feat(gc): add pkgmgr gc --report, a read-only disk inventory ... pkgmgr gc --report lists each linked worktree and orphaned .claude/worktrees/agent-* dir with its size and last activity, the changes a cleanup would keep, the biggest children of every --root, ELF core dumps, docker system df with --docker, and free versus attributed space per filesystem; --json prints the same as JSON. It deletes and writes nothing and refuses --apply. git run() gains input_text for cat-file --batch-check. 🎯 Fix: 90 % 💥 Break: 2 % 💸 Cost: new ⏱️ Time: new 🛡️ Security: 100 % 🏆 Score: 88 🚦 Gate: cost new, time new: cleared by the operator's commit word for pkgmgr gc --report (2026-11-07) Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-11-07 11:42:26 +00:00
Kevin Veen-BirkenbachandClaude Opus 5.5	1b9b93a542	Merge branch 'feature/worktree-commands-v2' into merge/main-20261107 ... Both sides register CLI subparsers: review, worktree and gc are all kept. The review package now takes END_OF_OPTIONS from core.git.run and the repository filter keys from core.git.queries.local_config, where B moved them out of branch.gc; the semantics are unchanged (local and worktree scope, scan mode). 🎯 Fix: 93 % 💥 Break: 3 % 💸 Cost: 114 % ⏱️ Time: 129 % 🛡️ Security: 100 % 🏆 Score: 61 🚦 Gate: cost 114 % and time 129 %: accepted by the operator for B (2026-11-07); unit 457 OK, integration 93 OK on the merge Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-11-07 11:28:07 +00:00
Kevin Veen-BirkenbachandClaude Opus 5.5	102c74f1e0	feat(worktree): add worktree up/down and harden branch gc ... pkgmgr worktree up and down create and release a branch worktree with its own slot and run the operator-pinned worktree-init and worktree-fini hooks; branch gc removes merged worktrees, now also patch-merged ones (git cherry), and the hooks of each repository run only from worktree_hooks pins of a managed repository whose git directory is its own. Removal walks to the worktree without following a symbolic link and skips paths that are not their own realpath. A bare-name hook program resolves once to a root-controlled file on a root-controlled PATH: root is uid 0 only in the initial user namespace and the overflow uid elsewhere, nosuid mounts never count on the host, and the hook runs the resolved file with only those PATH entries, stdin closed and a timeout over its process group. 🎯 Fix: 93 % 💥 Break: 3 % 💸 Cost: 114 % ⏱️ Time: 129 % 🛡️ Security: 100 % 🏆 Score: 61 🚦 Gate: cost 114 % and time 129 %: accepted by the operator for B (2026-11-07) after skeptic round 6 found no hole and MEDUSA reached 100 % Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-11-07 11:18:57 +00:00
Kevin Veen-BirkenbachandClaude Opus 5.5	1b31b10df6	feat(review): render a branch review as a local HTML page ... pkgmgr review writes one self-contained HTML page for a repository: commits ahead of the base, the staged, unstaged and untracked diff per file, and the checks of the change set. Repository text reaches the packaged Jinja template only as autoescaped data, git runs in scan mode (now also without replace objects), and the page is written atomically through mkstemp and os.replace. 🎯 Fix: 92 % 💥 Break: 3 % 💸 Cost: new ⏱️ Time: new 🛡️ Security: 100 % 🏆 Score: 89 🚦 Gate: cost new, time new: cleared by the operator's commit word for C (2026-11-07) Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-11-07 10:39:52 +00:00
Kevin Veen-BirkenbachandClaude Opus 5.5	54f0cbb37b	feat(branch): add pkgmgr branch tree, a hardened meta-tree of all repos ... pkgmgr branch tree --format json|yaml --output FILE scans every known repository with gc's own classification (plan_repo with fetch=False) through the hardened git runner and writes one document atomically (flock, mkstemp, fsync, os.replace): per repo path, remote, default, missing, forge status, scanned_at, warnings and every branch and worktree item, plus orphan shared worktrees under ~/.local/share/worktrees. Forge facts take the token only from an unlocked Secret Service item, never unlocking, and cache per repository for 600 s. open, close, drop and gc --apply/purge refresh only their repository's entry and never overwrite a newer scan. Scan hardening for repositories an agent may write: log.showSignature=false joins the scan flags; status is skipped for local or worktree filter.* config and for worktrees with gitlinks; --end-of-options precedes every ref argument and -- every remote, branch and du path, and worktree list runs with -z. Before, a remote named --output=<path> made rev-list create that file on the host, and a worktree path with blank lines forged a record. MEDUSA acceptances (kvb-think-criticize 2026-11-07, 1 skeptic): EXA004 cli/parser/branch_cmd.py:68 by design (-f/--force help text on an operator CLI); B603 actions/branch/gc.py:146 false positive (docker argv list, no shell); B603 actions/branch/gc.py:311 fixed (du gets --, paths from worktree list -z); B603 core/git/run.py:83 by design (argv list, scan callers guard names). 🎯 Fix: 92 % 💥 Break: 4 % 💸 Cost: 104 % ⏱️ Time: 108 % 🛡️ Security: 100 % 🏆 Score: 79 🚦 Gate: ⚠️ cost 104 % > 100, time 108 % > 100: ask the operator before the commit Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-11-07 06:35:50 +00:00
Kevin Veen-BirkenbachandClaude Opus 5.5	c2f0a56699	feat(publish): rebuild releases nightly and let stable follow the tested one ... Every image build now carries <version> and the immutable <version>.<unix-ts>; latest goes to the newest release on main, each prefix (2, 2.3) to the newest release starting with it, and stable to the release the git tag stable marks, which "Mark stable commit" sets only after all tests passed. publish-containers.yml runs daily at 03:00 UTC and on workflow_dispatch. A rebuild publishes the newest release and, when the git tag stable sits on an older one, that release too, so both get base-image security updates. compute-publish-container-info.sh emits the release list with each release's moving tags; image.sh takes them as --aliases instead of --stable. A platform build whose installed package set equals the published <version> pushes nothing, and a merge whose image index equals the published one only moves the tags not yet on it, without a new stamp. Only vX.Y.Z tags count as releases; v2.4.0-rc1 no longer moves 2 or 2.4. The build scripts come from the release commit: releases tagged before this change keep the old scripts until a newer release replaces them. tests/integration: 22 tests for release choice, aliases, the stable rebuild, the push skip and the triggers. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-11-04 18:38:42 +01:00
Kevin Veen-Birkenbach	08738d812e	Release version 2.3.0 v2.3.0	2026-11-01 15:14:53 +01:00
Kevin Veen-Birkenbach	21cecf64fb	feat(branch-gc): add --merged-into, --sizes and --min-age	2026-11-01 12:54:19 +01:00
Kevin Veen-Birkenbach	d1a951ee94	Release version 2.2.0 v2.2.0	2026-11-01 01:55:31 +01:00
Kevin Veen-BirkenbachandClaude Opus 5.5	f40cc5cfde	feat(push): add --no-sign to push unsigned commits ... pkgmgr push --no-sign skips the re-sign rebase and the unsigned-range refusal, so a checkout without a usable signing key can still sync the fetch URL and every mirror pushurl. Leases and the git cherry guard still apply. push_branch takes sign as a required keyword; pkgmgr release and release --retry pass sign=True, so releases stay signed. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>	2026-11-01 01:55:31 +01:00
Kevin Veen-BirkenbachandClaude Opus 5.5	944b4cb663	ci(publish): build container images on native arch runners ... Each distro now builds amd64 on ubuntu-latest and arm64 on ubuntu-24.04-arm instead of emulating arm64 under QEMU. image.sh gains --platform, which pushes one <version>-<arch> tag, and --merge, which joins those tags under the release, stable and alias tags with buildx imagetools. The workflow splits into prepare, build and merge jobs; scripts/build/publish.sh follows the same sequence locally. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>	2026-11-01 00:53:16 +01:00
Kevin Veen-BirkenbachandClaude Opus 5.5	919e6a6434	feat(push): re-sign and lease every mirror pushurl ... pkgmgr push now signs unpushed commits like git-sign-push and pushes each pushurl with its own --force-with-lease: the fetch URL against the tracking ref, every mirror against its own fetched tip, each only after git cherry shows no commit exists only there. --rewrite allows a deliberate history rewrite. Without a repository selection it pushes the current checkout, including worktrees outside the base dir. pkgmgr release and release --retry sign before tagging and push the branch and tag through the same path. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>	2026-11-01 00:53:16 +01:00
Kevin Veen-Birkenbach	4a4bf137ac	Release version 2.1.1 v2.1.1	2026-10-31 18:47:35 +01:00
Kevin Veen-BirkenbachandClaude Opus 5.5	ea82d91b75	fix(release): skip pyproject.toml without a static project version ... A pyproject.toml that holds only tool config (no [project] table) or lists "version" in [project].dynamic now prints an INFO line and is skipped, like a missing file. A [project] table with neither a version nor a dynamic entry still raises. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>	2026-10-31 18:42:41 +01:00
Kevin Veen-Birkenbach	1c0a4abcbb	Release version 2.1.0 v2.1.0	2026-10-31 14:38:54 +01:00
Kevin Veen-BirkenbachandClaude Opus 5.5	810d27badc	feat(release): start from the highest version across all sources ... The release base used to be the latest v* tag only. It is now the highest version found in that tag and in every file the release writes: pyproject.toml, CHANGELOG.md, flake.nix, PKGBUILD, the RPM spec, debian/changelog and Cargo.toml. A lagging file can no longer lower the base and a file ahead of the tag raises it; when the sources disagree the release says so and names the version it starts from. Repos whose sources agree release exactly as before. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>	2026-10-31 14:18:07 +01:00
Kevin Veen-BirkenbachandClaude Opus 5.5	d823a42edc	feat(release): bump the root crate in Cargo.toml and Cargo.lock ... A repo whose Cargo.toml has a [package] section now gets its version set to the release version, and the matching local [[package]] entry in Cargo.lock (same name, no source line) follows in the same release commit, so cargo build --locked keeps passing. Workspaces without [package] and repos without Cargo.toml release as before; a Cargo.lock without the local entry aborts the release before any file is written. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>	2026-10-31 14:18:07 +01:00
Kevin Veen-BirkenbachandClaude Opus 5.5	168d59e1b2	feat(branch): add gc and purge for merged and abandoned branches ... pkgmgr branch gc lists every branch and worktree of the repo (or of all managed repos with --all) together with the compose stacks found via com.docker.compose.project.working_dir. Branches whose tips are merged (ancestor of the default branch off its first-parent line, or head SHA of a merged GitHub PR) and whose worktrees are clean are removed with --apply: compose down -v plus the project's images, the worktree (foreign-owned files through a throwaway alpine container, metadata only after the checkout is gone), the local branch and the branch on every remote via push --force-with-lease. Default, protected, open-PR, busy and locked items are skipped; every item is re-checked right before it is removed. pkgmgr branch purge handles unmerged or dirty items with a confirmation per item. Both refuse to act outside the host PID namespace, where processes and worktree locks cannot be verified. The fetch skips auto-maintenance, whose worktree-prune task deletes the metadata of sandboxed worktrees. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>	2026-10-31 14:18:06 +01:00
Kevin Veen-Birkenbach	579ded3438	Release version 2.0.5 v2.0.5	2026-10-29 13:57:31 +01:00
Kevin Veen-BirkenbachandClaude Opus 5.5	eb17cddd21	fix(config): open nano on the terminal in config edit ... pkgmgr config edit ran nano through run_command, which pipes stdout and stderr to capture them, so nano aborted with 'Standard output is not a terminal'. The editor now runs with subprocess.call and the inherited terminal, and a failing editor exits with its code. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-29 13:47:45 +01:00
Kevin Veen-Birkenbach	c7b070a62b	Release version 2.0.4 v2.0.4	2026-10-19 10:06:02 +02:00
Kevin Veen-BirkenbachandClaude Opus 5.5	20cd174a1f	fix(release): date changelog entries without a ruff-version-dependent noqa ... ruff 0.16 flags date.today() (DTZ011) while 0.17 drops that rule from its defaults and flags the noqa as unused (RUF100), so CI's unpinned ruff failed lint-python. datetime.now().astimezone().date() yields the same local date and passes both, matching debian.py and rpm_changelog.py. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>	2026-10-19 09:58:31 +02:00
Kevin Veen-Birkenbach	ae4bfb5965	Merge pull request #7 from kevinveenbirkenbach/dependabot/github_actions/actions/checkout-7 ... build(deps): bump actions/checkout from 4 to 7	2026-10-19 09:36:25 +02:00
Kevin Veen-Birkenbach	4f71680bb1	Merge pull request #6 from kevinveenbirkenbach/dependabot/github_actions/hadolint/hadolint-action-3.5.0 ... build(deps): bump hadolint/hadolint-action from 3.3.0 to 3.5.0	2026-10-19 09:35:34 +02:00
Kevin Veen-Birkenbach	c78f5ac75e	Release version 2.0.3 v2.0.3	2026-10-18 23:33:52 +02:00
Kevin Veen-BirkenbachandClaude Opus 5.5	32e896fd09	fix(release): lint the changelog entry inside the file it lands in ... The entry was linted alone, so rules that compare it with the rest of CHANGELOG.md never fired. infinito-nexus 16.0.0 passed this check with "-" bullets on top of older "*" entries, and the repository's own markdown lint then reported 400 MD004 findings and refused the push. update_changelog now also lints the merged file and reports only the findings the existing file does not already produce (lint_changelog_context), so pre-existing issues are not blamed on the entry. markdownlint-cli2 runs with --no-globs, so a target config with its own globs no longer lints the whole repository and blocks a release on unrelated files. Without markdownlint-cli2 the built-in check now requires "-" list markers (MD004 dash), the strictest style. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>	2026-10-18 23:31:22 +02:00
dependabot[bot]	d24eb0155c	build(deps): bump actions/checkout from 4 to 7 ... Bumps [actions/checkout](https://github.com/actions/checkout) from 4 to 7. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](https://github.com/actions/checkout/compare/v4...v7) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>	2026-10-05 00:15:09 +00:00
dependabot[bot]	c6e866b2c9	build(deps): bump hadolint/hadolint-action from 3.3.0 to 3.5.0 ... Bumps [hadolint/hadolint-action](https://github.com/hadolint/hadolint-action) from 3.3.0 to 3.5.0. - [Release notes](https://github.com/hadolint/hadolint-action/releases) - [Commits](https://github.com/hadolint/hadolint-action/compare/2332a7b74a6de0dda2e2221d575162eba76ba5e5...06be81baf89a55ffd0e24b8f04a4185738dd3387) --- updated-dependencies: - dependency-name: hadolint/hadolint-action dependency-version: 3.5.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>	2026-10-05 00:14:01 +00:00
Kevin Veen-Birkenbach	1f6fe52855	Release version 2.0.2 v2.0.2	2026-10-01 17:47:12 +02:00
Kevin Veen-BirkenbachandClaude Opus 5	156ac595e6	test: hold three tests against the code they are supposed to cover ... All three failed on behaviour that is correct, which is why they had to move rather than the code. Two date from aa48981, which moved the default configs into the package. The loader test still wrote them beside it, into site-packages, and read its own stale comment as proof that the loader looks there. The cli-update test demanded a fallback onto that same directory; on a wheel install it belongs to other packages, so the test now pins the opposite and keeps the boundary. The third read a config.yaml in the destination to show the source one was not copied over it. The code never writes that file, so the read died before it could show anything; the absence is the assertion. The debian installer test stubbed which() for apt-get and dpkg-buildpackage but not for sudo, so _privileged_prefix returned None and the installer warned and left before reaching the apt-get calls the test was waiting for. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-10-01 17:45:43 +02:00
Kevin Veen-BirkenbachandClaude Opus 5	b778ad7dbe	fix(install): treat install-* as what it is, not as an install target ... The detection accepted any target starting with install-, while the run below it has always called plain make install. A repository carrying install-python and no install therefore pulled the installer in and died on "No rule to make target 'install'" instead of being skipped, which is what the surrounding branch is there for. meta-infinite-graph, universal-logout and file-dedupe all failed this way, and with them two e2e tests. 775c301 added the parsing to run make install only where an install target exists. The prefix arm undid that, so it goes. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-10-01 17:45:42 +02:00
Kevin Veen-BirkenbachandClaude Opus 5	02384979bc	fix(release): stop rejecting the changelog entry pkgmgr itself produced ... A heading in the message became a bold line, and markdown-lint reads a bold line on its own as a heading: MD036. Every structured entry therefore failed the check it had just been normalised for, and since the loop reopens the editor on failure there was no text that could end it. Headings now move below the "## [version]" line the entry is filed under. A "###" under a "##" is the hierarchy, not a competitor; only "#" and "##" would have collided, and those are the ones raised. The findings never reached the person either. They were printed and the editor took the terminal over in the same breath, so the reason was gone before it could be read. They are held on screen until Enter, and written into the editor buffer as ';' lines above the rejected text, where the fix is actually made; the buffer already drops those lines when it is read back. transform_changelog_message and lint_changelog_entry were each tested alone, which is how a transform that produces lint errors went unnoticed. A test now runs the output of the first through the second. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-10-01 17:45:42 +02:00
Kevin Veen-Birkenbach	59f470fb5e	Merge pull request #5 from kevinveenbirkenbach/dependabot/github_actions/docker/login-action-4.6.0 ... build(deps): bump docker/login-action from 3.7.0 to 4.6.0	2026-10-01 16:28:28 +02:00
Kevin Veen-Birkenbach	1e5cc3f1aa	Merge pull request #4 from kevinveenbirkenbach/dependabot/github_actions/DeterminateSystems/nix-installer-action-23 ... build(deps): bump DeterminateSystems/nix-installer-action from 16 to 23	2026-10-01 16:28:14 +02:00
Kevin Veen-Birkenbach	fbe8018451	Merge pull request #3 from kevinveenbirkenbach/dependabot/github_actions/docker/setup-buildx-action-4.4.0 ... build(deps): bump docker/setup-buildx-action from 3.12.0 to 4.4.0	2026-10-01 16:27:57 +02:00
Kevin Veen-Birkenbach	161d5d220b	Merge pull request #2 from kevinveenbirkenbach/dependabot/github_actions/actions/setup-python-7 ... build(deps): bump actions/setup-python from 5 to 7	2026-10-01 16:27:32 +02:00
Kevin Veen-Birkenbach	0d4e33f4d3	Merge pull request #1 from kevinveenbirkenbach/dependabot/github_actions/DeterminateSystems/update-flake-lock-29 ... build(deps): bump DeterminateSystems/update-flake-lock from 24 to 29	2026-10-01 16:27:01 +02:00
Kevin Veen-Birkenbach	a4b29b4d49	Release version 2.0.1 v2.0.1	2026-09-18 17:15:35 +02:00
Kevin Veen-BirkenbachandClaude Opus 5	4e83779459	fix(release): do not end a changelog on a blank line ... An entry carries a trailing blank line so that a `## [version]` below it is separated. Two of the four placements in _insert_after_h1 put the entry at the end of the file instead, where that separator becomes a blank line after the final newline and markdownlint reports MD012. Both now pass the entry through _at_end_of_file. Only the first entry a file ever receives is affected, which is why it appears on a repository's opening release and never again: every later entry is inserted above an existing H2, and there the separator is correct. The base-images repository hit it on 1.0.0 and its lint job went red on the first push it ever had. The other two placements are deliberately untouched. In the legacy branch the old content follows the entry, and before the first H2 the previous release section does, so the blank line has to stay. Verified: four tests, one per placement, assert both that no document holds three consecutive newlines and that it ends on exactly one; two of them also assert the separator survives where it belongs, which fails if the trim is applied too widely. 74 tests pass under tests/unit/pkgmgr/actions/release. Unrelated and pre-existing: test_update_changelog_transforms_heading_and_inline_code fails wherever markdownlint-cli2 is installed, because transform_changelog_message renders a leading `#` as bold and markdownlint calls that MD036. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-09-18 17:14:11 +02:00
Kevin Veen-Birkenbach	b22ff17b0e	Release version 2.0.0 v2.0.0	2026-09-18 16:29:32 +02:00
dependabot[bot]	69dc430ca1	build(deps): bump docker/login-action from 3.7.0 to 4.6.0 ... Bumps [docker/login-action](https://github.com/docker/login-action) from 3.7.0 to 4.6.0. - [Release notes](https://github.com/docker/login-action/releases) - [Commits](https://github.com/docker/login-action/compare/c94ce9fb468520275223c153574b00df6fe4bcc9...dbcb813823bdd20940b903addbd779551569679f) --- updated-dependencies: - dependency-name: docker/login-action dependency-version: 4.6.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>	2026-09-18 14:26:19 +00:00
dependabot[bot]	dd172c0c99	build(deps): bump DeterminateSystems/nix-installer-action from 16 to 23 ... Bumps [DeterminateSystems/nix-installer-action](https://github.com/determinatesystems/nix-installer-action) from 16 to 23. - [Release notes](https://github.com/determinatesystems/nix-installer-action/releases) - [Commits](https://github.com/determinatesystems/nix-installer-action/compare/v16...v23) --- updated-dependencies: - dependency-name: DeterminateSystems/nix-installer-action dependency-version: '23' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>	2026-09-18 14:25:10 +00:00
dependabot[bot]	42a7445865	build(deps): bump docker/setup-buildx-action from 3.12.0 to 4.4.0 ... Bumps [docker/setup-buildx-action](https://github.com/docker/setup-buildx-action) from 3.12.0 to 4.4.0. - [Release notes](https://github.com/docker/setup-buildx-action/releases) - [Commits](https://github.com/docker/setup-buildx-action/compare/8d2750c68a42422c14e847fe6c8ac0403b4cbd6f...594f3bf4285d9ea8dc53c9a0c9c4092420091003) --- updated-dependencies: - dependency-name: docker/setup-buildx-action dependency-version: 4.4.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>	2026-09-18 14:25:03 +00:00
dependabot[bot]	0ec74ad06f	build(deps): bump actions/setup-python from 5 to 7 ... Bumps [actions/setup-python](https://github.com/actions/setup-python) from 5 to 7. - [Release notes](https://github.com/actions/setup-python/releases) - [Commits](https://github.com/actions/setup-python/compare/v5...v7) --- updated-dependencies: - dependency-name: actions/setup-python dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>	2026-09-18 14:24:58 +00:00