Tags give the ability to mark specific points in history as being important
-
v0.38.4
a1a85029 · ·v0.38.4 — the README described the behaviour v0.38.3 replaced It still claimed a fetch failure or a missing section fails the job, one release after both became warnings that render 'unknown'. That paragraph is the one explaining why the badge can be trusted, so it is a bad place to be stale. Now a table of the three outcomes, plus why the third warns rather than fails. The release gate also asserts the README mentions 'unknown' when the workflow can render it — narrow on purpose, since a grep cannot police prose.
-
v0.38.3
1ca90fb9 · ·v0.38.3 — a zero-importer module is a state, not a failure The badge was written against one page shape and failed the whole badges job on the two others pkg.go.dev serves: a module nothing imports (which says 'No known importers' and gives no count) and one not yet crawled (no section at all). Because the job is all-or-nothing, that took coverage/version/license down too. Three outcomes now: a countable page renders the cross-checked number, no known importers renders 0, anything else renders 'unknown' in grey with a warning. Unknown is still never rendered as 0 — 'nothing imports this' and 'I could not tell' are different facts, and on a schedule the second printed as the first would overwrite a real count.
-
v0.38.2
e478c7cb · ·v0.38.2 — document the imported-by badge It shipped across three releases with its inputs described only in the CHANGELOG and the workflow header; the README still announced three badge kinds. Now documented: the three inputs, what the badge measures (blast radius, not adoption), the self-checking scrape, and how to refresh it on a schedule without deleting your other badges. The release script now fails when a workflow input is missing from the README — doc drift breaks nothing and reddens no test, so only a gate that reads both catches it.
-
v0.38.1
878c6c56 · ·v0.38.1 — importers.md loses the empty third column The external flag had its own column, which is blank on every row whenever all importers are your own -- the common case for a personal library, and one that reads as a broken table rather than as 'no strangers here'. Two columns now, with the mark inline in the repository cell so it shows only on rows it describes. The external count is still stated above the table.
-
v0.38.0
ccdf1814 · ·v0.38.0 — multi-owner support for the imported-by badge create-badges gains `importers_own_owners`. The external-importer flag was already generic (the owner comes from github.repository, never hardcoded), but single-owner: anyone publishing under both a personal account and an org saw their own second org flagged external. Empty keeps the previous behaviour, so no existing caller changes. Matching is on whole owner segments, so `acme` does not swallow `acme-labs`.
-
v0.37.0
f2635a72 · ·v0.37.0 — opt-in imported-by badge for Go modules create-badges gains `importers` (default false), rendering importers.svg plus an importers.md backlink list of the importing repositories, grouped and flagged by owner. pkg.go.dev has no API for this, so the scrape self-checks: it reads the total both from the links and from the count the page states, and refuses to render anything if the two disagree -- on a schedule, a wrongly-rendered 0 would overwrite a real count and still look like data.
-
v0.36.3
9b67e6f6 · ·v0.36.3 — reject unpublishable OCI package shapes The MCP registry refuses an OCI package that carries registryBaseUrl, and wants the registry host inside identifier. Both are checkable against the file, and both previously surfaced as a 400 after the image push, the GitHub Release and any ClawHub publish had already succeeded.
-
v0.36.2
15c125e3 · ·v0.36.2 — guard server.json description length The MCP registry caps description at 100 characters and reports it as a 422 from the publish call, which runs after the image push, the GitHub Release and any ClawHub publish have already succeeded. The job now fails on the length up front, reading the field straight out of server.json.
-
v0.36.1
29786cf6 · ·v0.36.1 — fix issue-pull's stderr capture The call sites merged stderr into the captured payload, so the helper's retrying-anonymously warning was prepended to the JSON and jq died with 'parse error: Expected string key before ':' at line 1, column 1'. Every caller whose authenticated read was refused -- 63 of 64 -- failed on every scheduled run since the workflow shipped. read_issues now also validates that the payload is a JSON array, so a mirror returning an HTML error page or an empty body skips that platform for the run instead of aborting the job.
-
v0.36.0
c094895a · ·v0.36.0 — make-checks.yml Lint and test for repos whose toolchain lives in their container, with no setup-go / setup-python step installing something nothing uses. Inputs: lint_command, test_command, dep_command, coverage_file, coverage_artifact, runs_on; the command inputs take '-' or '' to skip a step. Lint and test run as steps in one job, not two parallel jobs, because parallel jobs would each rebuild the repo's dev image from scratch. dep_command is off by default: a container-built dependency env cannot be handed to a host step. New workflow only. No existing workflow changes behaviour.
-
v0.35.2
77dc0445 · ·v0.35.2 — state the Docker Hub token scope dockerhub_token needs Read, Write AND Delete. Pushing an image only needs Write, but writing repository metadata sits behind the same scope Docker Hub uses for Delete and there is no tier between them, so a Read/Write token pushes fine and then fails every metadata call with 'access denied: insufficient scope'. Nothing here ever issues a DELETE. Docs only; no behaviour change.
-
v0.35.1
4e84849e · ·v0.35.1 — keep the Docker Hub credentials out of process argv The visibility step shipped in v0.35.0 passed the access token to jq as --arg and the session token to curl as -H. Both land in a process argument list, which /proc exposes to anything else on the machine. jq now reads the credentials from the environment, and the session token goes in a 0600 file passed as curl --config and removed on exit. No input or behaviour change. Anyone already on v0.35.0 should take this.
-
v0.35.0
99521b2a · ·v0.35.0 — keep the Docker Hub page in step with the GitHub one dockerhub_private (default false) is read back after every push and corrected when it differs. Pushing to a repository that does not exist creates it with whatever visibility the account default says, so the result used to depend on a setting nobody looks at -- and a private one still gave a green run with a successful push nobody else could pull. sync_description sets the Docker Hub short description from the GitHub repository description, cut to Docker Hub's 100-character cap and counted in codepoints rather than bytes. readme_url_header prepends a source link, and the project page when one is set, to the long description -- Docker Hub has no field for either. Topics are not synced: Docker Hub's categories are a fixed taxonomy rather than free-form tags.
-
v0.34.0
d0cea5eb · ·v0.34.0 — pass an OpenVEX document to the image scanner New scan_vex_file input on docker-image-workflow.yml takes a path in the repo to an OpenVEX document, passed to Grype as --vex, for a CVE the maintainer has assessed as not affecting the image. Unlike an ignore list it records why: a machine-readable justification plus a human impact statement, in a reviewable file. New scan_only_fixed reports only vulnerabilities with a published fix. Both were already supported by the pinned scan-action and simply never wired. Defaults preserve the previous behaviour exactly. A VEX-suppressed finding also leaves the Security tab, so a wrong assertion hides a real vulnerability -- documented at the input and in the README. The scan jobs check the repo out only when a VEX path is set, since otherwise it resolved to nothing on a runner that had never cloned the repo.
-
v0.33.1
72c0e0d9 · ·v0.33.1 — halve the daily new-item ceiling on archive.org The ceiling is per day, but what it guards against is a burst: creating roughly a dozen items inside an hour is what answers 503 SlowDown with 'appears to be spam'. Ten a day can still be ten inside ten minutes when several repositories' schedules land together. It is also counted by querying archive.org rather than by keeping a tally, and that search index lags by minutes, so the number in flight can exceed the ceiling before the count catches up. Five leaves margin for both. Nothing is lost by going slower. An item created a day later is the same item, and a repository whose tree has not changed uploads nothing at all.
-
v0.33.0
78704200 · ·v0.33.0 — mirrors stop pretending to accept contributions Breaking: archive.yml's secrets are renamed wayback_access_key -> archiveorg_access_key and wayback_secret_key -> archiveorg_secret_key. The pair is an account credential signing Save Page Now, the S3 upload API and the metadata API alike; naming it after one caller made every other use look like it needed its own key. Callers passing the old names fail at startup. New issue-pull.yml copies issues opened on the Codeberg and GitLab mirrors into GitHub and closes the copy when the original closes, noting where it was closed, how many comments it drew and how long it was open. It only reads the mirrors and writes here, so no GitHub credential leaves the runner. git-mirror.yml now turns pull requests off on the mirrors by default. A mirror is force-pushed from its source, so anything merged on one is destroyed by the next sync, and unlike GitHub neither platform can refuse a PR -- so the button comes off instead. Issues and forking stay on. Its description prefix also defaults to empty now. archive.yml uploads the repository to archive.org as a browsable item with real metadata, skipping when the recorded source revision already matches HEAD and capping new-item creation per day. Save Page Now handling is fixed in three places: a 404 under load is retryable, hitting the per-URL daily cap counts as archived, and the retry budget now outlasts the queue instead of racing it. Also: docker-image-workflow.yml's target_platforms is no longer both required and defaulted, five workflows gained a top-level permissions block, and the README is rewritten against the code.
-
v0.32.2
7fe4508d · ·Drop pip-audit --strict so releases stop failing on their own unpublished version
-
-
-