0.5.0 release

.github/scripts/generate-release-notes.sh

@@ -59,7 +59,7 @@ if [ -f "CHANGELOG.md" ]; then
 
   # Look for version with ## [Version] format (Keep a Changelog standard)
   awk -v version="$VERSION_NUM" '
-    BEGIN { found=0; in_section=0 }
+    BEGIN { found=0; in_section=0; release_title="" }
 
     # Match version headers with ## [version] format
     /^## \[/ {
@@ -75,6 +75,11 @@ if [ -f "CHANGELOG.md" ]; then
         if (ver == version) {
           found=1
           in_section=1
+          # Extract the full line after ## [version]
+          # Example: ## [0.2.1] - 2025-12-03 -> v0.2.1 - 2025-12-03
+          sub(/^## \[/, "", $0)
+          sub(/\]/, "", $0)
+          release_title = "v" $0
           next  # Skip the header itself
         }
       }
@@ -89,18 +94,20 @@ if [ -f "CHANGELOG.md" ]; then
       print
     }
 
-    # Output found status at the end
-    END { print "FOUND=" found }
+    # Output found status and title at the end
+    END {
+      print "FOUND=" found
+      print "RELEASE_TITLE=" release_title
+    }
   ' CHANGELOG.md > changelog_section.tmp
 
-  # Extract the FOUND status from the last line
-  FOUND_STATUS=$(tail -n 1 changelog_section.tmp | grep "^FOUND=" | cut -d= -f2)
+  # Extract the FOUND status and RELEASE_TITLE from the last two lines
+  RELEASE_TITLE=$(tail -n 1 changelog_section.tmp | grep "^RELEASE_TITLE=" | cut -d= -f2-)
+  FOUND_STATUS=$(tail -n 2 changelog_section.tmp | head -n 1 | grep "^FOUND=" | cut -d= -f2)
 
-  # Remove the FOUND status line from the temp file
-  if grep -q "^FOUND=" changelog_section.tmp; then
-    sed -i.bak '$d' changelog_section.tmp
-    rm -f changelog_section.tmp.bak
-  fi
+  # Remove the FOUND/RELEASE_TITLE status lines from the temp file
+  head -n -2 changelog_section.tmp > changelog_section_clean.tmp
+  mv changelog_section_clean.tmp changelog_section.tmp
 
   # Check if version was found in changelog
   if [ "$FOUND_STATUS" != "1" ]; then
@@ -110,6 +117,11 @@ if [ -f "CHANGELOG.md" ]; then
     exit 1
   fi
 
+  # Output release title to GitHub Actions
+  if [ -n "$GITHUB_OUTPUT" ] && [ -n "$RELEASE_TITLE" ]; then
+    echo "release_title=$RELEASE_TITLE" >> "$GITHUB_OUTPUT"
+  fi
+
   if [ -s changelog_section.tmp ]; then
     cat changelog_section.tmp >> release_notes.md
     echo "" >> release_notes.md

.github/workflows/release.yml

@@ -11,30 +11,6 @@ env:
   IMAGE_NAME: ${{ github.repository }}
 
 jobs:
-  codeql-scan:
-    name: CodeQL Security Scan
-    runs-on: ubuntu-latest
-    permissions:
-      actions: read
-      contents: read
-      security-events: write
-    steps:
-      - name: Checkout Repository
-        uses: actions/checkout@v6
-
-      - name: Set up Go
-        uses: actions/setup-go@v5
-        with:
-          go-version-file: 'go.mod'
-
-      - name: Initialize CodeQL
-        uses: github/codeql-action/init@v4
-        with:
-          languages: go
-
-      - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@v4
-
   build-binaries:
     name: Build Release Binaries
     runs-on: ubuntu-latest
@@ -69,7 +45,7 @@ jobs:
   build-and-scan-container:
     name: Build, Scan, and Push Container Image
     runs-on: ubuntu-latest
-    needs: [codeql-scan, build-binaries]
+    needs: [build-binaries]
     permissions:
       contents: read
       packages: write
@@ -141,7 +117,7 @@ jobs:
         tags: local-scan-image:${{ steps.version.outputs.version }}
 
     - name: Scan container with Trivy
-      uses: aquasecurity/trivy-action@0.28.0
+      uses: aquasecurity/trivy-action@v0.36.0
       continue-on-error: true
       with:
         image-ref: local-scan-image:${{ steps.version.outputs.version }}
@@ -192,16 +168,16 @@ jobs:
       id: release_notes
       run: ./.github/scripts/generate-release-notes.sh "$GITHUB_REF" "${{ github.repository }}" "$GITHUB_OUTPUT"
 
-    - name: Create Release
+    - name: Create Draft Release
       uses: softprops/action-gh-release@v2
       with:
-        name: Release ${{ steps.release_notes.outputs.tag_name }}
+        name: ${{ steps.release_notes.outputs.release_title }}
         body_path: release_notes.md
         files: |
           release-assets/flows2fim-darwin-arm64.tar.gz
           release-assets/flows2fim-linux-amd64.tar.gz
           release-assets/flows2fim-linux-arm64.tar.gz
           release-assets/flows2fim-windows-amd64.zip
           release-assets/checksums.txt
-        draft: false
+        draft: true
         prerelease: ${{ steps.release_notes.outputs.is_prerelease == 'true' }}

CHANGELOG.md

@@ -7,12 +7,14 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.5.0] - 2026-08-04
+
 **Note:** Compatible with outputs from Ripple1D Pipeline version 0.11.0 (the release containing the `scenarios` rename) to present. Not compatible with earlier outputs, which carry a `rating_curves` table instead, see the Changed section below.
 
 ### Added
 
 - `controls` and `validate` now fail with an actionable message when the database has a pre-0.5.0 `rating_curves` table instead of `scenarios`
-- `controls` and `validate` now fail with an actionable message when the database has a pre-0.5.0 `rating_curves_no_map` table exists
+- `controls` and `validate` now fail with an actionable message when the database has a pre-0.5.0 `rating_curves_no_map` table
 - `controls` output file now has a `map_exists` column
 - `fim` leaves records whose `map_exists` is `0` out of the composite. If the controls file has no `map_exists` column, it warns about that and includes every record
 - `validate` now has a third check and a `-o_unexpected_fims` flag (default `unexpected_fims.csv`), listing FIM files whose scenario records have `map_exists = 0`, that is, a raster exists where the database says none was written
@@ -43,11 +45,12 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ### Changed
 
 Build Support Matrix:
-| OS \ ARCH      | AMD64       | ARM64       |
-| :------------- | :---------: | :---------: |
-| **Linux**      | ✅          | ✅          |
-| **MacOS**      |             | ✅          |
-| **Windows**    | ✅          |             |
+
+| OS \ ARCH   | AMD64 | ARM64 |
+| :---------- | :---: | :---: |
+| **Linux**   | ✅    | ✅    |
+| **MacOS**   |       | ✅    |
+| **Windows** | ✅    |       |
 
 ## [0.4.0] - 2025-05-15
 
@@ -73,8 +76,8 @@ Build Support Matrix:
 
 - New `validate` command to validate FIM libraries (stored locally or on cloud) against rating curves table in a database. See Install.md for setup details
 - Configuration through environment variables:
-  - `F2F_LOG_LEVEL`: Set logging level ('DEBUG', 'INFO', 'WARN', 'ERROR'). Default is 'INFO'
-  - `F2F_NO_COLOR`: Set to 'TRUE' to disable colored output. Default is 'FALSE'
+    - `F2F_LOG_LEVEL`: Set logging level ('DEBUG', 'INFO', 'WARN', 'ERROR'). Default is 'INFO'
+    - `F2F_NO_COLOR`: Set to 'TRUE' to disable colored output. Default is 'FALSE'
 - Structured logging support
 
 ### Changed
@@ -117,9 +120,9 @@ Build Support Matrix:
 
 - Command-line utility for generating composite Flood Inundation Maps (FIMs) under varying flow conditions
 - Core commands:
-  - `controls`: Process flow files with rating curve data to generate control tables containing reach flows and downstream boundary conditions
-  - `fim`: Combine control tables with FIM library folders to produce flood inundation maps matching specified flow conditions
-  - `domain`: Generate composite domain maps from reach identifier lists or control tables using FIM library data
+    - `controls`: Process flow files with rating curve data to generate control tables containing reach flows and downstream boundary conditions
+    - `fim`: Combine control tables with FIM library folders to produce flood inundation maps matching specified flow conditions
+    - `domain`: Generate composite domain maps from reach identifier lists or control tables using FIM library data
 - FIM library support for local and cloud-stored libraries
 - Rating curve database integration
 - GDAL-based geospatial operations
@@ -128,5 +131,5 @@ Build Support Matrix:
 
 **Note:** This initial release is based on the archived repository at [NGWPC/flows2fim-archive](https://github.com/NGWPC/flows2fim-archive/releases/tag/v0.1.0)
 
-
-[Unreleased]: https://github.com/NGWPC/flows2fim/compare/v0.4.1...HEAD
+[Unreleased]: https://github.com/NGWPC/flows2fim/compare/v0.5.0...HEAD
+[0.5.0]: https://github.com/NGWPC/flows2fim/releases/tag/v0.5.0

CONTRIBUTING.md

@@ -1,18 +1 @@
-# Release Checklist
-
-## Pre-release
-- [ ] Run all tests
-- [ ] Update changelog
-- [ ] Provide sample data
-- [ ] Update README.md
-- [ ] Update help docs for commands
-
-## Tag and Build
-- [ ] Create a new tag
-- [ ] Run build scripts
-- [ ] Upload builds
-- [ ] Push tag
-
-## Release
-- [ ] Update release notes from changelog
-- [ ] Notify stakeholders
+# Contributing

DEV_GUIDE.md

@@ -0,0 +1,32 @@
+# DEV GUIDE
+
+Notes and checklists for repository maintainers. See [CONTRIBUTING.md](CONTRIBUTING.md) for the general contribution process.
+
+## Release Checklist
+
+### Pre-release
+
+- [ ] Run all tests
+- [ ] Make the following changes in a separate branch
+- [ ] Add a `## [x.y.z] - YYYY-MM-DD` entry to `CHANGELOG.md` for the version being released, the release workflow reads this section for the release notes/title and fails if it's missing
+- [ ] Update the footnote links at the bottom of `CHANGELOG.md`: retarget `[Unreleased]`'s compare link to start from the new tag, and add a new `[x.y.z]: https://github.com/NGWPC/flows2fim/releases/tag/vx.y.z` line for the version being released
+- [ ] Update sample/test data, if needed
+- [ ] Update README.md and help docs for commands, if needed
+
+### Tag and Push
+
+- [ ] Create and push a semver tag (`v*.*.*`) from the release-prep branch, to trigger the `Release` GitHub Actions workflow, which:
+
+  - builds release binaries for all platforms
+  - builds, scans with Trivy, and pushes the multi-arch (`amd64`/`arm64`) container image
+  - generates release notes and title from the `CHANGELOG.md` entry
+  - creates the GitHub release as a **draft**, with all binaries attached
+- [ ] If a workflow run fails partway, just fix the issue and re-run it. The release is created as a draft, so retries under the same tag are safe, nothing is locked until it's published
+
+### Publish
+
+- [ ] Review the draft release on GitHub (title, generated notes, attached assets)
+- [ ] If everything looks good, merge release-prep branch into `master` with a merge commit (not squash or rebase), this keeps the tagged commit in history that the release will point to
+- [ ] Manually click **Publish release** on the draft in the GitHub UI to finalize it
+
+  - This is permanent: GitHub's immutable-releases feature locks the tag and assets once published. The tag can never be reused, even if the release is later deleted