Repository navigation
chore: prepare release 2.18.1 - #620
Merged
Merged
Conversation
Prepares the 2.18.1 release by hand, same approach as 2.17.0 in #613 and 2.18.0 in #618: rulesets block the release workflow from pushing version bumps straight to main, so the bump lands as a normal PR. 2.18.0 published Docker images and the Homebrew formula successfully, but its GitHub release was created by hand and then deleted. This repo has immutable releases enabled, which permanently reserves a tag name once an immutable release has used it, so v2.18.0 can never carry a release. The archives Procore needs are therefore unreachable, and the Homebrew formula bumped to 2.18.0 points at download URLs that 404. No code changes from 2.18.0 -- only the version constant, the changelog and the Action metadata pins. The toolchain pin and dependency bumps are carried forward unchanged. Also backfills the 2.17.1 changelog entry, which was tagged off main and so never landed here. Release notes on the publish order, given immutability allows one attempt per tag name: - build artifacts first (make products-for-release) - create the release as a draft with all 15 assets attached, verify, then publish; never publish an empty release - do not push the tag before running the release workflow, since prepare-release.sh runs a bare `git tag` under `set -e` Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
ari-launchdarkly
approved these changes
Sep 23, 2026
cspath1
added a commit
that referenced
this pull request
Sep 25, 2026
Prepares the 2.18.2 release by hand, same approach as 2.18.1 in #620 and 2.18.0 in #618: rulesets block the release workflow from pushing version bumps straight to main, so the bump lands as a normal PR. Ships the pelletier/go-toml/v2 v2.4.3 bump from #621, which clears the XRAY-1033007 finding Procore reported against the 2.18.1 binary. Also realigns the Action tag and the scanner version at 2.18.2. The 2.18.1 prep replaced every 2.17.0 reference in the Action metadata README, including the `uses: launchdarkly/find-code-references@v2.17.0` examples, but the Action repo was tagged v2.18.0 rather than v2.18.1. That left the README -- here and, after the #67 sync, live in the Action repo -- pointing at a tag that does not exist, so the examples 404 when copy-pasted. Both streams now read 2.18.2. Publish order, unchanged from 2.18.1 and worth repeating because immutable releases allow one attempt per tag name: - do not push the tag before running the release workflow - build artifacts first (make products-for-release) - create the release as a draft with all 15 assets attached, verify the count, then publish - sync find-code-references and tag it v2.18.2 so the README examples resolve, then move its v2 tag <!-- CURSOR_SUMMARY --> --- > [!NOTE] > **Overview** > **Release 2.18.2** bumps the embedded scanner version and aligns GitHub Action metadata so copy-paste examples and default container images point at **`v2.18.2`** / **`launchdarkly/ld-find-code-refs-github-action:2.18.2`** instead of the missing **`v2.18.1`** Action tag. > > The changelog records **2.18.2** as addressing **XRAY-1033007** via **`github.com/pelletier/go-toml/v2` v2.4.3** (indirect through Viper; config stays YAML-only) and fixing the Action README/tag mismatch from the 2.18.1 prep. > > <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit 2616ac2. Bugbot is set up for automated code reviews on this repo. Configure [here](https://www.cursor.com/dashboard/bugbot).</sup> <!-- /CURSOR_SUMMARY --> Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
cspath1
added a commit
that referenced
this pull request
Sep 25, 2026
Prepares the 2.18.3 release by hand, same approach as 2.18.2 in #622 and 2.18.1 in #620: rulesets block the release workflow from pushing version bumps straight to main, so the bump lands as a normal PR. Re-release of 2.18.2 under correct artifact names. No code changes -- only the version constant, the changelog and the Action metadata pins. v2.18.2 published all 15 archives named 2.18.1. The binaries were correct (verified go-toml v2.4.3 and go1.26.8 inside the published asset), but goreleaser templated the filenames from the newest tag it could see rather than the release tag, because products-for-release passes --skip-validate and suppresses the tag/HEAD check. Two consequences: the Homebrew formula, generated from the real tag, points at 2.18.2 filenames that 404, so brew install is broken; and ld-find-code-refs_2.18.1_*.tar.gz now exists on two releases with different contents. The v2.18.2 tag is immutable, so neither can be fixed in place. When building artifacts for this release, force the version instead of letting goreleaser infer it, and check the names rather than just the count: GORELEASER_CURRENT_TAG=v2.18.3 make products-for-release ls -1 dist/*.tar.gz | grep -c '2\.18\.3' # expect 8 Then create the release as a draft with all 15 assets, verify both the count and the filenames, and only then publish. <!-- CURSOR_SUMMARY --> --- > [!NOTE] > **Overview** > Prepares **v2.18.3** as a metadata-only re-release of 2.18.2: bumps `internal/version.Version` to `2.18.3` and documents in **CHANGELOG** that v2.18.2 shipped correct binaries but **misnamed archives** (`2.18.1` filenames from goreleaser/`--skip-validate`), which broke Homebrew URLs and collided with real 2.18.1 assets. > > **GitHub Action** packaging is realigned to the new tag: the action `Dockerfile` base image, README workflow examples (`@v2.18.3` and `docker@v2.18.3`), and `docker/action.yml` default/example `dockerImage` pins all move from `2.18.2` to `2.18.3`. No application logic or dependency changes beyond the version string. > > <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit cdffded. Bugbot is set up for automated code reviews on this repo. Configure [here](https://www.cursor.com/dashboard/bugbot).</sup> <!-- /CURSOR_SUMMARY --> Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Prepares the 2.18.1 release by hand, same approach as 2.17.0 in #613 and 2.18.0 in #618: rulesets block the release workflow from pushing version bumps straight to main, so the bump lands as a normal PR.
2.18.0 published Docker images and the Homebrew formula successfully, but its GitHub release was created by hand and then deleted. This repo has immutable releases enabled, which permanently reserves a tag name once an immutable release has used it, so v2.18.0 can never carry a release. The archives Procore needs are therefore unreachable, and the Homebrew formula bumped to 2.18.0 points at download URLs that 404.
No code changes from 2.18.0 -- only the version constant, the changelog and the Action metadata pins. The toolchain pin and dependency bumps are carried forward unchanged.
Also backfills the 2.17.1 changelog entry, which was tagged off main and so never landed here.
Release notes on the publish order, given immutability allows one attempt per tag name:
git tagunderset -eNote
Overview
2.18.1 is a patch release with no application code changes from 2.18.0. It exists because v2.18.0’s GitHub release was removed after publish while immutable releases still block reusing that tag, so Linux/macOS/Windows tarballs, deb/rpm, and Homebrew download URLs were broken.
This PR bumps
Versionto2.18.1, documents the fix in CHANGELOG, and updates GitHub Action metadata (Dockerfile base image, README examples, anddocker/action defaultdockerImage) from v2.18.0 to v2.18.1. It also backfills the missing 2.17.1 changelog entry on main.Reviewed by Cursor Bugbot for commit 260e6b7. Bugbot is set up for automated code reviews on this repo. Configure here.