From 260e6b79345fe08507ff598a2088dac98aa8130c Mon Sep 17 00:00:00 2001 From: Cody Spath Date: Wed, 23 Sep 2026 16:18:38 -0400 Subject: [PATCH] chore: prepare release 2.18.1 Prepares the 2.18.1 release by hand, same approach as 2.17.0 in #613 and 2.18.0 in #618: rulesets block the release workflow from pushing version bumps straight to main, so the bump lands as a normal PR. 2.18.0 published Docker images and the Homebrew formula successfully, but its GitHub release was created by hand and then deleted. This repo has immutable releases enabled, which permanently reserves a tag name once an immutable release has used it, so v2.18.0 can never carry a release. The archives Procore needs are therefore unreachable, and the Homebrew formula bumped to 2.18.0 points at download URLs that 404. No code changes from 2.18.0 -- only the version constant, the changelog and the Action metadata pins. The toolchain pin and dependency bumps are carried forward unchanged. Also backfills the 2.17.1 changelog entry, which was tagged off main and so never landed here. Release notes on the publish order, given immutability allows one attempt per tag name: - build artifacts first (make products-for-release) - create the release as a draft with all 15 assets attached, verify, then publish; never publish an empty release - do not push the tag before running the release workflow, since prepare-release.sh runs a bare `git tag` under `set -e` Co-Authored-By: Claude Opus 5 --- CHANGELOG.md | 10 ++++++++++ build/metadata/github-actions/Dockerfile | 2 +- build/metadata/github-actions/README.md | 8 ++++---- build/metadata/github-actions/docker/action.yml | 4 ++-- internal/version/version.go | 2 +- 5 files changed, 18 insertions(+), 8 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index e23c0514..c2ca1778 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -4,6 +4,11 @@ All notable changes to the ld-find-code-refs program will be documented in this ## [Unreleased] +## [2.18.1] - 2026-09-23 + +### Fixed: +- GitHub release archives (Linux/macOS/Windows tarballs, deb, rpm) were missing from v2.18.0, and that tag name can no longer be used by a release, so the Homebrew formula pointed at download URLs that did not resolve. This patch republishes those assets under a usable tag. There are no code changes from 2.18.0 -- the Go toolchain pin and dependency bumps released there are unchanged. + ## [2.18.0] - 2026-09-23 ### Changed: @@ -14,6 +19,11 @@ All notable changes to the ld-find-code-refs program will be documented in this - resolved all 69 vulnerabilities reported by `govulncheck` against the v2.17.1 binary, including CVE-2025-68121 (`crypto/tls`), CVE-2026-39821 (Punycode validation in the standard library and `x/net/idna`), CVE-2026-45570 (`go-git` SSH transport) and CVE-2026-1229 (`circl` secp384r1). Dependencies bumped: `go-git/v5` to v5.19.2, `go-billy/v5` to v5.9.1, `x/net` to v0.59.0, `x/crypto` to v0.57.0, `x/text` to v0.42.0 and `circl` to v1.6.5 - the error message for an out-of-range `contextLines` value no longer renders the supplied number with a string format verb +## [2.17.1] - 2026-09-14 + +### Fixed: +- GitHub release archives (Linux/macOS/Windows tarballs, deb, rpm) were missing from the immutable v2.17.0 release. This patch publishes those assets. + ## [2.17.0] - 2026-08-13 ### Added: diff --git a/build/metadata/github-actions/Dockerfile b/build/metadata/github-actions/Dockerfile index f9b4ab4f..c50f77b3 100644 --- a/build/metadata/github-actions/Dockerfile +++ b/build/metadata/github-actions/Dockerfile @@ -1,4 +1,4 @@ -FROM launchdarkly/ld-find-code-refs-github-action:2.18.0 +FROM launchdarkly/ld-find-code-refs-github-action:2.18.1 LABEL com.github.actions.name="LaunchDarkly Code References" LABEL com.github.actions.description="Find references to feature flags in your code." diff --git a/build/metadata/github-actions/README.md b/build/metadata/github-actions/README.md index a2ab5ed6..05c02299 100644 --- a/build/metadata/github-actions/README.md +++ b/build/metadata/github-actions/README.md @@ -28,7 +28,7 @@ jobs: with: fetch-depth: 11 # This value must be set if the lookback configuration option is not disabled for find-code-references. Read more: https://github.com/launchdarkly/ld-find-code-refs#searching-for-unused-flags-extinctions - name: LaunchDarkly Code References - uses: launchdarkly/find-code-references@v2.18.0 + uses: launchdarkly/find-code-references@v2.18.1 with: accessToken: ${{ secrets.LD_ACCESS_TOKEN }} projKey: LD_PROJECT_KEY @@ -64,11 +64,11 @@ jobs: password: ${{ secrets.REGISTRY_TOKEN }} - name: LaunchDarkly Code References # Pin to a release that includes the docker/ entry point (see changelog). - uses: launchdarkly/find-code-references/docker@v2.18.0 + uses: launchdarkly/find-code-references/docker@v2.18.1 with: accessToken: ${{ secrets.LD_ACCESS_TOKEN }} projKey: LD_PROJECT_KEY - dockerImage: your.registry.example/launchdarkly/ld-find-code-refs-github-action:2.18.0 + dockerImage: your.registry.example/launchdarkly/ld-find-code-refs-github-action:2.18.1 ``` Mirror the public image `launchdarkly/ld-find-code-refs-github-action` into your registry (pin `dockerImage` to the scanner image tag you mirrored; it can lag the Action tag). This entry point requires a Docker CLI on the runner (included on GitHub-hosted `ubuntu-*` runners). Existing workflows that use the root Action do not need to change. @@ -104,7 +104,7 @@ jobs: with: fetch-depth: 11 # This value must be set if the lookback configuration option is not disabled for find-code-references. Read more: https://github.com/launchdarkly/ld-find-code-refs#searching-for-unused-flags-extinctions - name: LaunchDarkly Code References - uses: launchdarkly/find-code-references@v2.18.0 + uses: launchdarkly/find-code-references@v2.18.1 with: accessToken: ${{ secrets.LD_ACCESS_TOKEN }} projKey: LD_PROJECT_KEY diff --git a/build/metadata/github-actions/docker/action.yml b/build/metadata/github-actions/docker/action.yml index fecc3fb0..465d2d96 100644 --- a/build/metadata/github-actions/docker/action.yml +++ b/build/metadata/github-actions/docker/action.yml @@ -52,12 +52,12 @@ inputs: description: >- Container image to run. Defaults to the public Docker Hub image used by the root Action. Set this to your mirrored/proxy image (for example - your.registry.example/launchdarkly/ld-find-code-refs-github-action:2.18.0). + your.registry.example/launchdarkly/ld-find-code-refs-github-action:2.18.1). Authenticate to private registries with docker/login-action (or equivalent) in a prior step. Requires a runner with a Docker CLI (GitHub-hosted ubuntu-* runners include one). required: false - default: "launchdarkly/ld-find-code-refs-github-action:2.18.0" + default: "launchdarkly/ld-find-code-refs-github-action:2.18.1" runs: using: composite steps: diff --git a/internal/version/version.go b/internal/version/version.go index 35604e25..ebb4ffa7 100644 --- a/internal/version/version.go +++ b/internal/version/version.go @@ -1,3 +1,3 @@ package version -const Version = "2.18.0" +const Version = "2.18.1"