github-actions-maintainer 0.6.0

General-purpose GitHub Actions maintenance toolkit with secure workflow pinning
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127

# Changelog

<!--
  CHANGELOG.md — What makes this document good:

  A changelog communicates what changed, when, and why — for users deciding
  whether to upgrade and for maintainers tracking regression sources.

  Best practices:
  - Follow https://keepachangelog.com/en/1.1.0/ format.
  - Group entries under: Added, Changed, Deprecated, Removed, Fixed, Security.
  - Use past tense ("Added X") not imperative ("Add X").
  - Link each version header to the GitHub compare or release URL.
  - Never delete entries — changelogs are append-only history.
  - Include the date in YYYY-MM-DD format for every release.
  - For pre-1.0 projects, note breaking changes explicitly.
  - For monorepos / workspaces, consider per-crate changelogs.
  - Automate with tools like git-cliff when commit discipline is strong.

  Standard name: CHANGELOG.md (root)
  When to include: Every project that ships versioned releases.
-->

All notable changes to this project will be documented in this file.

The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).

## [Unreleased]

### Added

- `--tag-style` option for the `release` command; annotated tag objects are now the default so downstream provenance checks (`git cat-file -t`) pass, with `lightweight` as the opt-out
- `command` input on the root action, which now exposes `pin`, `update`, `status`, and `release` from a single action
- CLI options resolve from the `INPUT_<NAME>` environment variables GitHub sets for container actions when no explicit flag is given

### Changed

- `auto-release.yml` and `reusable-auto-release.yml` call the root action with `command: release` instead of the `release/` sub-action

### Deprecated

- `release/` sub-action (`ThreatFlux/github_actions/release@<ref>`); use `ThreatFlux/github_actions@<ref>` with `command: release`. It stays functional for the `v0` line and will be removed in the next major version

## [0.4.2] - 2026-08-07

### Fixed

- `release.yml` crates.io publish script died on an indented heredoc terminator before ever publishing; Windows release archives now ship a `.zip.sha256` checksum

## [0.4.1] - 2026-08-07

### Fixed

- `release.yml` native builds run under bash on Windows runners; the release sub-action image is pinned to a semver digest

## [0.4.0] - 2026-08-07

### Added

- `release/` sub-action (`ThreatFlux/github_actions/release@<ref>`) packaging the release command as a prebuilt-image Docker action for any Cargo repository
- `reusable-auto-release.yml` callable workflow wrapping checkout plus the release action
- Moving `v0` major alias tag maintained by the release automation

### Changed

- `auto-release.yml` now dogfoods the release action instead of the bash/python release steps

### Fixed

- Tag pipelines (`release.yml`, `docker.yml`) never ran for pushed tags because tags created with `GITHUB_TOKEN` do not trigger workflows; `auto-release.yml` now dispatches them explicitly on the new tag
- Container signing now also runs for `v*` tag builds instead of only `main`

## [0.3.0] - 2026-08-07

### Added

- `release` CLI command: conventional-commit-driven version bumps, Cargo manifest/lockfile rewriting, and API-driven release commit, tag, and GitHub Release creation

## [0.2.3] - 2026-08-01

### Added

- ARCHITECTURE.md with component map and design decision rationale
- CHANGELOG.md following Keep a Changelog format
- RELEASING.md with maintainer release runbook
- FAQ.md covering common setup and customization questions
- Expanded README_STANDARDS.md with comprehensive style guide
- Mermaid CI/CD pipeline diagram in README.md
- Table of contents and back-to-top navigation in all READMEs
- Centered header blocks with badge rows and quick navigation links

### Changed

- Reframed project identity from "CI/CD Template" to "Rust Project Template"
- Reorganized README.md configuration section into structured tables
- Updated README_TEMPLATE.md to inherit all structural best practices
- Updated Cargo.toml description and keywords

### Maintenance

- Refreshed Rust dependencies and Cargo.lock to the latest compatible stable releases
- Updated Docker and CI toolchains to Rust 1.97.1
- Updated pinned GitHub Actions and security tooling

## [0.5.0] - 2025-03-24

### Added

- Initial public template release
- GitHub Actions workflows: ci.yml, security.yml, release.yml, auto-release.yml, docker.yml
- Makefile with full build, test, lint, security, and release targets
- Dockerfile with multi-stage build, Trivy scan, Cosign signing
- Template placeholder validation via `make template-check`
- Repository governance files: CODEOWNERS, issue templates, PR template
- CONTRIBUTING.md, SECURITY.md, CODE_OF_CONDUCT.md
- README_TEMPLATE.md starter for generated projects
- Bootstrap checklist and README standards documentation
- Rust 2024 edition default with 1.96.0 MSRV baseline

[Unreleased]: https://github.com/ThreatFlux/github_actions/compare/v0.4.2...HEAD
[0.4.2]: https://github.com/ThreatFlux/github_actions/compare/v0.4.1...v0.4.2
[0.4.1]: https://github.com/ThreatFlux/github_actions/compare/v0.4.0...v0.4.1
[0.4.0]: https://github.com/ThreatFlux/github_actions/compare/v0.3.0...v0.4.0
[0.3.0]: https://github.com/ThreatFlux/github_actions/compare/v0.2.2...v0.3.0
[0.2.3]: https://github.com/ThreatFlux/github_actions/compare/v0.2.2...v0.3.0
[0.5.0]: https://github.com/ThreatFlux/rust-cicd-template/releases/tag/v0.5.0