From a2bea0ea17fed7dc80a827aace728554ef787c20 Mon Sep 17 00:00:00 2001 From: hmmhmmhm Date: Sat, 25 Jul 2026 16:44:57 +0900 Subject: [PATCH 1/3] docs: design v0.1.1 release --- .../specs/2026-07-25-v0.1.1-release-design.md | 130 ++++++++++++++++++ 1 file changed, 130 insertions(+) create mode 100644 docs/superpowers/specs/2026-07-25-v0.1.1-release-design.md diff --git a/docs/superpowers/specs/2026-07-25-v0.1.1-release-design.md b/docs/superpowers/specs/2026-07-25-v0.1.1-release-design.md new file mode 100644 index 0000000..7f14756 --- /dev/null +++ b/docs/superpowers/specs/2026-07-25-v0.1.1-release-design.md @@ -0,0 +1,130 @@ +# v0.1.1 Release Design + +## Goal + +Publish the project health and runtime-safety improvements currently on `main` +as v0.1.1, exercise the new `Protect main` ruleset through a real pull request, +and run both configured Dependabot update checks immediately. + +## Release contents + +v0.1.1 contains all commits after v0.1.0: + +- a modern quick-start README and real terminal demo; +- Dependabot, Dependency Review, CodeQL, secret scanning, and push protection; +- immutable GoReleaser and Dependency Review Action references; +- stale session-refresh result protection; +- cancellation of in-flight tmux work when the UI exits; +- a compiled-binary smoke test; +- the documented and enforced 450-line source policy; and +- dedicated `govulncheck`, `actionlint`, and ShellCheck CI checks. + +The CLI syntax, key bindings, installer locations, supported platforms, and +archive names do not change. + +## Release preparation pull request + +Create `release/v0.1.1` from the current protected `main`. + +The pull request adds: + +- a root `CHANGELOG.md` with v0.1.1 and v0.1.0 entries; +- a README release badge update from v0.1.0 to v0.1.1; and +- the release design and execution plan. + +The pull request is created as draft to follow repository policy. The user's +explicit instruction in this conversation authorizes ready-for-review +transition and squash merge after every required check passes. + +The pull request is also the first end-to-end validation of ruleset 19720203. +It must demonstrate that these required contexts run successfully: + +- `Test (ubuntu-latest)` +- `Test (macos-latest)` +- `Test (windows-latest)` +- `Integration (Ubuntu)` +- `Quality (Ubuntu)` +- `Dependency Review` +- `Analyze (go)` +- `Analyze (actions)` + +The merge method must be squash. The feature branch is deleted after merge. + +## Tag and release + +After synchronizing the merged `main`, create an annotated `v0.1.1` tag on the +merge commit and push only that tag. + +The existing Release workflow and GoReleaser configuration produce: + +- `tab_darwin_amd64.tar.gz` +- `tab_darwin_arm64.tar.gz` +- `tab_linux_amd64.tar.gz` +- `tab_linux_arm64.tar.gz` +- `tab_windows_amd64.zip` +- `tab_windows_arm64.zip` +- `checksums.txt` + +The release must be public, non-draft, non-prerelease, and marked latest. + +## Release verification + +Verification is complete only when: + +1. the tag resolves to the merged `main` commit; +2. the Release workflow succeeds; +3. all seven assets are uploaded; +4. every asset matches `checksums.txt`; +5. each tar or zip contains the expected `tab` or `tab.exe`; +6. the public one-line installer selects v0.1.1; +7. the installed binary reports v0.1.1; +8. tmux is available and the binary smoke test still passes; and +9. the local `~/.local/bin/tab` installation is upgraded to v0.1.1. + +## Dependabot immediate checks + +The repository has two weekly Dependabot version-update configurations: + +- Go modules in `/`; +- GitHub Actions in `/`. + +First try GitHub's supported workflow-dispatch API for the dynamic Dependabot +workflow. A rejection that the dynamic workflow has no `workflow_dispatch` +trigger is evidence that this route is unavailable, not a project failure. + +If the public API cannot dispatch the job, use the authenticated repository +Dependabot page to select “Check for updates” for both configurations. Do not +change the schedule merely to force a run. + +For each check, record the new Dependabot Updates run ID and verify a successful +conclusion. If a pull request is created: + +- inspect the dependency and release notes; +- require the repository's pull-request checks; +- merge patch or minor updates after success under the user's approval; +- leave a major update unmerged unless its compatibility has been separately + established. + +If no update is available, completion evidence is a successful job whose log +states that no update is needed. + +## Failure handling + +- Do not create the tag if any required pull-request check fails. +- Do not move or recreate an existing tag. +- Do not publish a second release for the same tag. +- If the Release workflow fails, diagnose and fix the workflow before retrying. +- Do not accept an asset whose checksum or archive structure fails verification. +- Do not alter the weekly Dependabot schedule solely to obtain a manual run. + +## Completion state + +At completion: + +- `main` and `origin/main` point to the v0.1.1 release commit; +- local and remote branches contain only `main`; +- v0.1.1 is the latest public release; +- the local installed command reports v0.1.1; +- both immediate Dependabot checks have a recorded successful run; and +- `PROJECT.md` records the one-time user approval, PR, release, ruleset + validation, Dependabot results, and remaining alerts or pull requests. From 3360002a236f4a8ac4215b7f535722e0eee5c0a3 Mon Sep 17 00:00:00 2001 From: hmmhmmhm Date: Sat, 25 Jul 2026 16:47:43 +0900 Subject: [PATCH 2/3] docs: plan v0.1.1 release --- .../plans/2026-07-25-v0.1.1-release.md | 441 ++++++++++++++++++ 1 file changed, 441 insertions(+) create mode 100644 docs/superpowers/plans/2026-07-25-v0.1.1-release.md diff --git a/docs/superpowers/plans/2026-07-25-v0.1.1-release.md b/docs/superpowers/plans/2026-07-25-v0.1.1-release.md new file mode 100644 index 0000000..0313a3c --- /dev/null +++ b/docs/superpowers/plans/2026-07-25-v0.1.1-release.md @@ -0,0 +1,441 @@ +# v0.1.1 Release Implementation Plan + +> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking. + +**Goal:** Publish v0.1.1 through the protected pull-request and release workflows, then run both Dependabot version-update checks immediately. + +**Architecture:** Use one documentation-only release preparation pull request to validate the active `Protect main` ruleset. Tag the resulting squash merge, let the existing Release workflow build all assets, and verify the public installer against the new release. Trigger Dependabot through the dynamic workflow API when supported, otherwise use the authenticated repository UI without changing its weekly schedule. + +**Tech Stack:** Git, GitHub CLI, GitHub Actions, GoReleaser v2, POSIX shell, GitHub Dependabot, authenticated browser automation. + +--- + +## File map + +- Create `CHANGELOG.md`: public version history for v0.1.1 and v0.1.0. +- Modify `README.md`: update the release badge to v0.1.1. +- Create `docs/superpowers/specs/2026-07-25-v0.1.1-release-design.md`: approved release design. +- Create `docs/superpowers/plans/2026-07-25-v0.1.1-release.md`: executable release procedure. +- Update `projects/tmux-attach-browser/PROJECT.md` outside the repository after completion. + +### Task 1: Prepare release documentation + +**Files:** +- Create: `CHANGELOG.md` +- Modify: `README.md:8` + +- [ ] **Step 1: Verify the pre-release state** + +Run: + +```sh +test ! -e CHANGELOG.md +rg -n 'release-v0\\.1\\.0' README.md +``` + +Expected: both commands return zero and the badge is on README line 8. + +- [ ] **Step 2: Write the changelog** + +Create `CHANGELOG.md` with this content: + +```markdown +# Changelog + +All notable changes to tmux-attach-browser are documented here. + +The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), +and this project uses [Semantic Versioning](https://semver.org/spec/v2.0.0.html). + +## [0.1.1] - 2026-07-25 + +### Added + +- Add a real terminal demo and a quick-start README. +- Add Dependabot, Dependency Review, CodeQL, secret scanning, push protection, + and a protected `main` ruleset. +- Add compiled-binary, installer, real-tmux, source-length, vulnerability, + workflow, and shell checks. + +### Changed + +- Pin the GoReleaser and Dependency Review actions to immutable commits. +- Document and enforce the 450-line limit for hand-written source files. + +### Fixed + +- Ignore stale asynchronous session refresh results. +- Cancel in-flight tmux list and create operations when the UI exits. + +## [0.1.0] - 2026-07-19 + +### Added + +- Browse, filter, select, create, attach to, and switch between tmux sessions. +- Install prebuilt macOS, Linux, and Windows binaries with checksum validation. + +[0.1.1]: https://github.com/hmmhmmhm/tmux-attach-browser/compare/v0.1.0...v0.1.1 +[0.1.0]: https://github.com/hmmhmmhm/tmux-attach-browser/releases/tag/v0.1.0 +``` + +- [ ] **Step 3: Update the README release badge** + +Replace: + +```markdown +[![Release](https://img.shields.io/badge/release-v0.1.0-blue)](https://github.com/hmmhmmhm/tmux-attach-browser/releases/latest) +``` + +with: + +```markdown +[![Release](https://img.shields.io/badge/release-v0.1.1-blue)](https://github.com/hmmhmmhm/tmux-attach-browser/releases/latest) +``` + +- [ ] **Step 4: Verify the documentation** + +Run: + +```sh +rg -n '^## \\[0\\.1\\.1\\] - 2026-07-25$' CHANGELOG.md +rg -n 'release-v0\\.1\\.1' README.md +test -z "$(rg -l 'release-v0\\.1\\.0' README.md || true)" +git diff --check +``` + +Expected: the v0.1.1 headings are found, no old release badge remains, and the +diff check returns zero. + +- [ ] **Step 5: Commit** + +```sh +git add CHANGELOG.md README.md +git commit -m "docs: prepare v0.1.1 release" +``` + +### Task 2: Verify and merge through the protected pull request + +**Files:** +- Verify all repository files. + +- [ ] **Step 1: Run the complete local suite** + +Run: + +```sh +test -z "$(gofmt -l .)" +git diff --check origin/main...HEAD +go mod verify +go vet ./... +go test -count=1 ./... +go test -race -count=1 ./... +go build ./... +sh scripts/check-source-lines.sh +sh scripts/test-source-lines.sh +sh scripts/test-install.sh +sh scripts/tmux-smoke.sh +sh scripts/tab-binary-smoke.sh +go run golang.org/x/vuln/cmd/govulncheck@v1.6.0 ./... +go run github.com/rhysd/actionlint/cmd/actionlint@v1.7.12 +shellcheck install.sh scripts/*.sh +``` + +Expected: every command returns zero and `govulncheck` reports zero reachable +vulnerabilities. + +- [ ] **Step 2: Push and create the draft pull request** + +Run: + +```sh +git push -u origin release/v0.1.1 +gh pr create --draft --base main --head release/v0.1.1 \ + --title "Prepare v0.1.1 release" \ + --body "$(printf '%s\n' \ + '## Summary' \ + '- add the v0.1.1 changelog' \ + '- update the README release badge' \ + '- exercise the protected main pull-request workflow before tagging' \ + '' \ + '## Verification' \ + '- complete local test, race, build, smoke, and quality suites pass')" +``` + +Expected: GitHub returns the new pull-request URL and `isDraft` is `true`. + +- [ ] **Step 3: Watch all pull-request checks** + +Run: + +```sh +release_pr=$(gh pr view release/v0.1.1 --json number --jq .number) +gh pr checks "$release_pr" --watch --interval 10 +``` + +Expected: the three OS tests, integration, quality, Dependency Review, and both +CodeQL analyses all report success. + +- [ ] **Step 4: Validate the ruleset and merge authorization** + +Run: + +```sh +gh api repos/hmmhmmhm/tmux-attach-browser/rulesets/19720203 \ + --jq '{enforcement,rule_types:[.rules[].type], + required_checks:[.rules[] | + select(.type=="required_status_checks") | + .parameters.required_status_checks[].context]}' +``` + +Expected: enforcement is active; rules include pull request, deletion, +non-fast-forward, and required status checks; all eight expected contexts are +present. + +The user's explicit instruction authorizes the following transition and merge: + +```sh +release_pr=$(gh pr view release/v0.1.1 --json number --jq .number) +gh pr ready "$release_pr" +gh pr merge "$release_pr" --squash --delete-branch +``` + +Expected: the pull request becomes merged with `mergeStateStatus` clean before +merge and the remote release branch is deleted. + +- [ ] **Step 5: Synchronize and verify merged main** + +Run: + +```sh +git switch main +git pull --ff-only origin main +go test -count=1 ./... +git status --short --branch +``` + +Expected: tests pass and local `main` equals `origin/main` with no changes. + +### Task 3: Publish and verify v0.1.1 + +**Files:** +- No repository file changes. + +- [ ] **Step 1: Verify the tag does not exist** + +Run: + +```sh +test -z "$(git tag -l v0.1.1)" +test -z "$(git ls-remote --tags origin refs/tags/v0.1.1)" +``` + +Expected: both outputs are empty. + +- [ ] **Step 2: Create and push the annotated tag** + +Run: + +```sh +release_commit=$(git rev-parse HEAD) +git tag -a v0.1.1 -m "v0.1.1" "$release_commit" +git push origin v0.1.1 +``` + +Expected: the remote reports a new `v0.1.1` tag. + +- [ ] **Step 3: Watch the Release workflow** + +Run: + +```sh +release_run=$(gh run list --workflow Release --event push --limit 10 \ + --json databaseId,headBranch --jq \ + '[.[] | select(.headBranch=="v0.1.1")][0].databaseId') +gh run watch "$release_run" --exit-status +``` + +Expected: the Release workflow completes successfully. + +- [ ] **Step 4: Verify release metadata and assets** + +Run: + +```sh +gh release view v0.1.1 --json tagName,isDraft,isPrerelease,url,assets \ + --jq '{tagName,isDraft,isPrerelease,url, + assets:[.assets[]|{name,size,state}]}' +``` + +Expected: v0.1.1 is public, final, and has six archives plus +`checksums.txt`. + +Download and verify: + +```sh +release_audit_dir=$(mktemp -d) +gh release download v0.1.1 --dir "$release_audit_dir" +cd "$release_audit_dir" +shasum -a 256 -c checksums.txt +for archive_file in tab_darwin_amd64.tar.gz tab_darwin_arm64.tar.gz \ + tab_linux_amd64.tar.gz tab_linux_arm64.tar.gz; do + tar -tzf "$archive_file" | grep -Fx tab +done +for zip_file in tab_windows_amd64.zip tab_windows_arm64.zip; do + unzip -t "$zip_file" +done +``` + +Expected: all checksum lines say `OK`, tar archives contain `tab`, and zip +tests report no errors. + +- [ ] **Step 5: Verify the public installer and upgrade this computer** + +Test without changing the user installation: + +```sh +installer_audit_dir=$(mktemp -d) +curl -fsSL \ + https://raw.githubusercontent.com/hmmhmmhm/tmux-attach-browser/main/install.sh | + TAB_INSTALL_DIR="$installer_audit_dir/bin" sh +"$installer_audit_dir/bin/tab" --version +``` + +Expected: version output begins `tab v0.1.1`. + +Then upgrade the requested local installation: + +```sh +curl -fsSL \ + https://raw.githubusercontent.com/hmmhmmhm/tmux-attach-browser/main/install.sh | + sh +tab --version +``` + +Expected: `~/.local/bin/tab` reports v0.1.1. + +### Task 4: Run Dependabot updates now + +**Files:** +- No repository file changes. + +- [ ] **Step 1: Record the current Dependabot runs** + +Run: + +```sh +gh run list --workflow "Dependabot Updates" --limit 20 \ + --json databaseId,displayTitle,createdAt,status,conclusion,url +baseline_go_run=$(gh run list --workflow "Dependabot Updates" --limit 20 \ + --json databaseId,displayTitle --jq \ + '[.[] | select(.displayTitle | startswith("go_modules"))][0].databaseId') +baseline_actions_run=$(gh run list --workflow "Dependabot Updates" --limit 20 \ + --json databaseId,displayTitle --jq \ + '[.[] | select(.displayTitle | startswith("github_actions"))][0].databaseId') +``` + +Keep both baseline IDs for comparison after the manual request. + +- [ ] **Step 2: Try the supported workflow dispatch endpoint** + +Run: + +```sh +gh api --method POST \ + repos/hmmhmmhm/tmux-attach-browser/actions/workflows/316349187/dispatches \ + -f ref=main +``` + +If it returns HTTP 204, wait for the new dynamic runs. If it returns HTTP 422 +stating that `workflow_dispatch` is absent, continue to the UI route. + +- [ ] **Step 3: Trigger both checks from the authenticated GitHub UI** + +Open: + +```text +https://github.com/hmmhmmhm/tmux-attach-browser/network/updates +``` + +Use the authenticated browser to invoke `Check for updates` once for the Go +modules configuration and once for the GitHub Actions configuration. Confirm +the page reports that each check was requested. + +- [ ] **Step 4: Identify and watch the new runs** + +Poll: + +```sh +gh run list --workflow "Dependabot Updates" --limit 20 \ + --json databaseId,displayTitle,createdAt,status,conclusion,url +``` + +Select runs different from the IDs from Step 1, then watch each: + +```sh +new_go_run=$(gh run list --workflow "Dependabot Updates" --limit 20 \ + --json databaseId,displayTitle --jq \ + "[.[] | select((.displayTitle | startswith(\"go_modules\")) and + .databaseId != $baseline_go_run)][0].databaseId") +new_actions_run=$(gh run list --workflow "Dependabot Updates" --limit 20 \ + --json databaseId,displayTitle --jq \ + "[.[] | select((.displayTitle | startswith(\"github_actions\")) and + .databaseId != $baseline_actions_run)][0].databaseId") +test -n "$new_go_run" +test -n "$new_actions_run" +gh run watch "$new_go_run" --exit-status +gh run watch "$new_actions_run" --exit-status +``` + +Expected: both runs complete successfully. + +- [ ] **Step 5: Handle update results** + +Run: + +```sh +gh pr list --author app/dependabot --state open \ + --json number,title,url,isDraft,mergeStateStatus,statusCheckRollup +``` + +If the list is empty, inspect both run logs and confirm no update was needed. +If pull requests exist, inspect each diff and upstream release notes, wait for +all required checks, and merge only compatible patch or minor updates under +the user's explicit approval. + +### Task 5: Final audit and cleanup + +**Files:** +- Modify: `projects/tmux-attach-browser/PROJECT.md` in the parent workspace. + +- [ ] **Step 1: Audit repository state** + +Run: + +```sh +git status --short --branch +git branch --format='%(refname:short)' +git ls-remote --heads origin +gh issue list --state open --json number,title,url +gh pr list --state open --json number,title,url +gh api 'repos/hmmhmmhm/tmux-attach-browser/dependabot/alerts?state=open' +gh api 'repos/hmmhmmhm/tmux-attach-browser/code-scanning/alerts?state=open' +``` + +Expected: local and remote branches contain only `main`; no unplanned issue, +pull request, or security alert remains. + +- [ ] **Step 2: Update project memory** + +Record: + +- the one-time user approval for PR merge and release; +- the release preparation PR number and squash commit; +- the v0.1.1 tag, Release run, asset and installer verification; +- the ruleset validation; +- both Dependabot run IDs and their results; and +- any remaining dependency pull requests or alerts. + +- [ ] **Step 3: Send completion notification** + +Send the configured Moshi completion webhook with a concise release and +Dependabot summary. From 04d6b8a7c3bbfd034c99414eee553bbbdfa9ad1a Mon Sep 17 00:00:00 2001 From: hmmhmmhm Date: Sat, 25 Jul 2026 16:49:19 +0900 Subject: [PATCH 3/3] docs: prepare v0.1.1 release --- CHANGELOG.md | 36 ++++++++++++++++++++++++++++++++++++ README.md | 2 +- 2 files changed, 37 insertions(+), 1 deletion(-) create mode 100644 CHANGELOG.md diff --git a/CHANGELOG.md b/CHANGELOG.md new file mode 100644 index 0000000..6e03014 --- /dev/null +++ b/CHANGELOG.md @@ -0,0 +1,36 @@ +# Changelog + +All notable changes to tmux-attach-browser are documented here. + +The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), +and this project uses [Semantic Versioning](https://semver.org/spec/v2.0.0.html). + +## [0.1.1] - 2026-07-25 + +### Added + +- Add a real terminal demo and a quick-start README. +- Add Dependabot, Dependency Review, CodeQL, secret scanning, push protection, + and a protected `main` ruleset. +- Add compiled-binary, installer, real-tmux, source-length, vulnerability, + workflow, and shell checks. + +### Changed + +- Pin the GoReleaser and Dependency Review actions to immutable commits. +- Document and enforce the 450-line limit for hand-written source files. + +### Fixed + +- Ignore stale asynchronous session refresh results. +- Cancel in-flight tmux list and create operations when the UI exits. + +## [0.1.0] - 2026-07-19 + +### Added + +- Browse, filter, select, create, attach to, and switch between tmux sessions. +- Install prebuilt macOS, Linux, and Windows binaries with checksum validation. + +[0.1.1]: https://github.com/hmmhmmhm/tmux-attach-browser/compare/v0.1.0...v0.1.1 +[0.1.0]: https://github.com/hmmhmmhm/tmux-attach-browser/releases/tag/v0.1.0 diff --git a/README.md b/README.md index 23b28f0..09073ec 100644 --- a/README.md +++ b/README.md @@ -5,7 +5,7 @@ **Choose or create a tmux session with one command.** [![CI](https://github.com/hmmhmmhm/tmux-attach-browser/actions/workflows/ci.yml/badge.svg)](https://github.com/hmmhmmhm/tmux-attach-browser/actions/workflows/ci.yml) -[![Release](https://img.shields.io/badge/release-v0.1.0-blue)](https://github.com/hmmhmmhm/tmux-attach-browser/releases/latest) +[![Release](https://img.shields.io/badge/release-v0.1.1-blue)](https://github.com/hmmhmmhm/tmux-attach-browser/releases/latest) [![Go](https://img.shields.io/badge/go-1.25-blue)](go.mod) [![License](https://img.shields.io/badge/License-MIT-blue.svg)](LICENSE)