Repository navigation
chore: prepare release 2.18.2 - #622
Merged
Merged
Conversation
Prepares the 2.18.2 release by hand, same approach as 2.18.1 in #620 and 2.18.0 in #618: rulesets block the release workflow from pushing version bumps straight to main, so the bump lands as a normal PR. Ships the pelletier/go-toml/v2 v2.4.3 bump from #621, which clears the XRAY-1033007 finding Procore reported against the 2.18.1 binary. Also realigns the Action tag and the scanner version at 2.18.2. The 2.18.1 prep replaced every 2.17.0 reference in the Action metadata README, including the `uses: launchdarkly/find-code-references@v2.17.0` examples, but the Action repo was tagged v2.18.0 rather than v2.18.1. That left the README -- here and, after the #67 sync, live in the Action repo -- pointing at a tag that does not exist, so the examples 404 when copy-pasted. Both streams now read 2.18.2. Publish order, unchanged from 2.18.1 and worth repeating because immutable releases allow one attempt per tag name: - do not push the tag before running the release workflow - build artifacts first (make products-for-release) - create the release as a draft with all 15 assets attached, verify the count, then publish - sync find-code-references and tag it v2.18.2 so the README examples resolve, then move its v2 tag Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
ari-launchdarkly
approved these changes
Sep 25, 2026
cspath1
added a commit
that referenced
this pull request
Sep 25, 2026
Prepares the 2.18.3 release by hand, same approach as 2.18.2 in #622 and 2.18.1 in #620: rulesets block the release workflow from pushing version bumps straight to main, so the bump lands as a normal PR. Re-release of 2.18.2 under correct artifact names. No code changes -- only the version constant, the changelog and the Action metadata pins. v2.18.2 published all 15 archives named 2.18.1. The binaries were correct (verified go-toml v2.4.3 and go1.26.8 inside the published asset), but goreleaser templated the filenames from the newest tag it could see rather than the release tag, because products-for-release passes --skip-validate and suppresses the tag/HEAD check. Two consequences: the Homebrew formula, generated from the real tag, points at 2.18.2 filenames that 404, so brew install is broken; and ld-find-code-refs_2.18.1_*.tar.gz now exists on two releases with different contents. The v2.18.2 tag is immutable, so neither can be fixed in place. When building artifacts for this release, force the version instead of letting goreleaser infer it, and check the names rather than just the count: GORELEASER_CURRENT_TAG=v2.18.3 make products-for-release ls -1 dist/*.tar.gz | grep -c '2\.18\.3' # expect 8 Then create the release as a draft with all 15 assets, verify both the count and the filenames, and only then publish. <!-- CURSOR_SUMMARY --> --- > [!NOTE] > **Overview** > Prepares **v2.18.3** as a metadata-only re-release of 2.18.2: bumps `internal/version.Version` to `2.18.3` and documents in **CHANGELOG** that v2.18.2 shipped correct binaries but **misnamed archives** (`2.18.1` filenames from goreleaser/`--skip-validate`), which broke Homebrew URLs and collided with real 2.18.1 assets. > > **GitHub Action** packaging is realigned to the new tag: the action `Dockerfile` base image, README workflow examples (`@v2.18.3` and `docker@v2.18.3`), and `docker/action.yml` default/example `dockerImage` pins all move from `2.18.2` to `2.18.3`. No application logic or dependency changes beyond the version string. > > <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit cdffded. Bugbot is set up for automated code reviews on this repo. Configure [here](https://www.cursor.com/dashboard/bugbot).</sup> <!-- /CURSOR_SUMMARY --> Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Prepares the 2.18.2 release by hand, same approach as 2.18.1 in #620 and 2.18.0 in #618: rulesets block the release workflow from pushing version bumps straight to main, so the bump lands as a normal PR.
Ships the pelletier/go-toml/v2 v2.4.3 bump from #621, which clears the XRAY-1033007 finding Procore reported against the 2.18.1 binary.
Also realigns the Action tag and the scanner version at 2.18.2. The 2.18.1 prep replaced every 2.17.0 reference in the Action metadata README, including the
uses: launchdarkly/find-code-references@v2.17.0examples, but the Action repo was tagged v2.18.0 rather than v2.18.1. That left the README -- here and, after the #67 sync, live in the Action repo -- pointing at a tag that does not exist, so the examples 404 when copy-pasted. Both streams now read 2.18.2.Publish order, unchanged from 2.18.1 and worth repeating because immutable releases allow one attempt per tag name:
Note
Overview
Release 2.18.2 bumps the embedded scanner version and aligns GitHub Action metadata so copy-paste examples and default container images point at
v2.18.2/launchdarkly/ld-find-code-refs-github-action:2.18.2instead of the missingv2.18.1Action tag.The changelog records 2.18.2 as addressing XRAY-1033007 via
github.com/pelletier/go-toml/v2v2.4.3 (indirect through Viper; config stays YAML-only) and fixing the Action README/tag mismatch from the 2.18.1 prep.Reviewed by Cursor Bugbot for commit 2616ac2. Bugbot is set up for automated code reviews on this repo. Configure here.