Skip to content

Commit 4b32472

Browse files
airvzxfairvzxf
committed
docs(changelog): cut v2.1.0 — B-02, B-18, deprecation warning, release pipeline
Covers the changes between v2.0.0 and v2.1.0: * PR #50 (fix(b02,b18)) — B-02: max_retries=0 means infinite. B-18: README examples pinned to @v2. New Troubleshooting section + header badges. * PR #51 (feat:) — deprecation warning fired by init.sh for EOL / @latest / @master / older v1.x refs, with the new fail_on_deprecated input for strict policies. * The release pipeline + the digest pinning of the base image (B-13), both of which were already on main under [Unreleased] but not yet tagged. No code changes in this commit. The release tag v2.1.0 will be pushed separately and trigger the ghcr.io / cosign / SBOM release pipeline.
1 parent 90166c1 commit 4b32472

1 file changed

Lines changed: 95 additions & 35 deletions

File tree

‎CHANGELOG.md‎

Lines changed: 95 additions & 35 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,98 @@ All notable changes to this project will be documented in this file.
55
The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
66
and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
77

8+
9+
## [2.1.0] - 2026-07-05
10+
11+
Bundles three things: the release pipeline (already on `main`),
12+
the digest pinning of the base image (also already on `main`
13+
under `[Unreleased]`), and two follow-up PRs:
14+
15+
* **PR #50** (`fix(b02,b18)`) — quick wins + docs.
16+
* **PR #51** (`feat:`) — deprecation warning for EOL / `@latest` /
17+
`@master` / older v1.x refs.
18+
19+
### Added
20+
21+
- **Deprecation warning** (PR #51). At the very start of `init.sh`,
22+
the action inspects `$GITHUB_ACTION_REF` and emits a
23+
`::warning::`, `::notice::`, or `::error::` workflow command:
24+
25+
| Ref | Severity | Reason |
26+
|------------------------------|------------|-------------------------------------------------------|
27+
| `@latest` | `warning` | moving target, pin to `@v2` or `@<sha>` |
28+
| `@master` / `@main` | `warning` | development branch, use a tag |
29+
| v1.0-alpha.1, v1.0-alpha.2 | `warning` | EOL (see SECURITY.md: only v1.4+ supported) |
30+
| v1.1, v1.2.0 | `warning` | EOL |
31+
| v1.3.0 … v1.3.3 | `warning` | EOL |
32+
| v1.4 … v1.9 | `notice` | v2 is available (BREAKING: `ssl_verify_certificate` default flipped to `true`) |
33+
| v2.x, anything not in the list | (silent) | current line |
34+
35+
The actual image version is baked into `/app/VERSION` at build
36+
time (`ARG VERSION=<tag>` from `release.yml`, default `dev` for
37+
local builds) and shown in the warning text.
38+
39+
Strategy: hardcoded EOL list. No network call, no latency, no
40+
rate limit. Updated on each major-line cut (next cut: v3, when
41+
v2 becomes EOL).
42+
43+
- **`fail_on_deprecated` input** (PR #51, default `false`). When
44+
`true` and the ref is EOL, the warning is upgraded to
45+
`::error::` and the action exits 1. Other warnings stay
46+
advisory. Useful for orgs with a "no EOL versions" policy.
47+
48+
- **Troubleshooting section** in the README (PR #50). Five most
49+
common lftp errors (530, 550, TLS verify failed, connection
50+
refused, mirror access failed) with cause + fix in tabular form.
51+
52+
- **Header badges** in the README (PR #50): CI status, latest
53+
release, license.
54+
55+
- **`.github/workflows/release.yml`** (already on `main` under
56+
`[Unreleased]`): on every pushed `v*.*.*` tag (and via manual
57+
`workflow_dispatch` with a tag input), the workflow:
58+
- builds the Docker image with `docker/build-push-action@v6`
59+
using GitHub Actions cache (`type=gha`),
60+
- pushes the result to `ghcr.io/airvzxf/ftp-deployment-action`
61+
with tags `<version>` and `v<version>` plus OCI image labels
62+
(source, license, version),
63+
- generates a CycloneDX SBOM with `anchore/sbom-action@v0` and
64+
attaches it to the image as an in-toto attestation via
65+
`actions/attest@v4`,
66+
- signs the image with `cosign sign --yes` (keyless, OIDC).
67+
68+
- **CI and release workflows use `actions/checkout@v5`** (was v4).
69+
v5 targets Node 24, which silences the deprecation warning
70+
every push produced since Node 20 was deprecated on the GH
71+
Actions runners. No user-facing behaviour change.
72+
73+
### Fixed
74+
75+
- **B-02** (PR #50): `max_retries=0` now means "retry forever"
76+
(the only exits are lftp success or the 5h global timeout). The
77+
README and `action.yml` description already implied this but
78+
`init.sh` treated 0 as a single attempt. The loop guard now
79+
skips the counter check when `INPUT_MAX_RETRIES` is 0.
80+
Non-breaking for every caller that uses the default
81+
`max_retries=10`; only callers that explicitly passed
82+
`max_retries=0` see the change.
83+
84+
- **B-13** (already on `main` under `[Unreleased]`): Dockerfile
85+
now pins the base image by digest
86+
(`alpine@sha256:25109184c71bdad752c8312a8623239686a9a2071e8825f20acb8f2198c3f659`,
87+
the digest of `alpine:3.23.3` at the time of v2.0.1). The
88+
package versions are pinned too (`lftp=4.9.2-r9`,
89+
`ca-certificates=20260611-r0`), which resolves hadolint
90+
`DL3018`. Bumping the base image is now a controlled cadence
91+
done via the release pipeline; the next bump will need a digest
92+
refresh in the same commit that bumps the tag.
93+
94+
- **B-18** (PR #50): README examples now use `@v2` instead of
95+
`@latest`, with a callout recommending major-version pins over
96+
floating tags. The `@latest` / `@main` antipattern is now
97+
additionally enforced from inside the action via the
98+
deprecation warning above.
99+
8100
## [2.0.0] - 2026-07-05
9101

10102
### Breaking
@@ -30,6 +122,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
30122
known-insecure default but about the rare case of a user
31123
explicitly opting back into the v1.x lax behaviour.
32124

125+
33126
## [1.5.0] - 2026-07-05
34127

35128
Bundles two PRs on top of v1.3.3 with no behaviour change for the
@@ -107,46 +200,13 @@ malformed input).
107200
- Password and other input values are no longer printed to the workflow
108201
log by default.
109202

203+
110204
## [1.3.3] - 2024-XX-XX
111205

112206
Historical. See git history for changes prior to `CHANGELOG.md` adoption.
113207

114-
## [Unreleased]
115-
116-
### Changed
117-
- CI and release workflows now use `actions/checkout@v5` (was v4).
118-
v5 targets Node 24, which silences the deprecation warning
119-
every push produced since Node 20 was deprecated on the GH
120-
Actions runners. No user-facing behaviour change.
121-
122-
### Added
123-
- `.github/workflows/release.yml`: on every pushed `v*.*.*` tag
124-
(and via manual `workflow_dispatch` with a tag input), the
125-
workflow:
126-
- builds the Docker image with `docker/build-push-action@v6`
127-
using GitHub Actions cache (`type=gha`),
128-
- pushes the result to `ghcr.io/airvzxf/ftp-deployment-action`
129-
with tags `<version>` and `v<version>` plus OCI image labels
130-
(source, license, version),
131-
- generates a CycloneDX SBOM with `anchore/sbom-action@v0` and
132-
attaches it to the image as an in-toto attestation via
133-
`actions/attest@v4`,
134-
- signs the image with `cosign sign --yes` (keyless, OIDC).
135-
After this lands, the next `v2.x.y` tag will produce a signed
136-
image at `ghcr.io/airvzxf/ftp-deployment-action:<version>` with
137-
an attached SBOM, automatically.
138-
139-
### Fixed
140-
- B-13: Dockerfile now pins the base image by digest
141-
(`alpine@sha256:25109184c71bdad752c8312a8623239686a9a2071e8825f20acb8f2198c3f659`,
142-
the digest of `alpine:3.23.3` at the time of v2.0.1). The
143-
package versions are pinned too (`lftp=4.9.2-r9`,
144-
`ca-certificates=20260611-r0`), which resolves hadolint
145-
`DL3018`. Bumping the base image is now a controlled cadence
146-
done via the release pipeline; the next bump will need a digest
147-
refresh in the same commit that bumps the tag.
148208

149-
[Unreleased]: https://github.com/airvzxf/ftp-deployment-action/compare/v2.0.1...HEAD
209+
[2.1.0]: https://github.com/airvzxf/ftp-deployment-action/compare/v2.0.1...v2.1.0
150210
[2.0.0]: https://github.com/airvzxf/ftp-deployment-action/compare/v1.5.0...v2.0.0
151211
[1.5.0]: https://github.com/airvzxf/ftp-deployment-action/releases/tag/v1.5.0
152212
[1.3.3]: https://github.com/airvzxf/ftp-deployment-action/releases/tag/v1.3.3

0 commit comments

Comments
 (0)