From d326a741fb48799d4f7d7d11525826fb20cd3149 Mon Sep 17 00:00:00 2001 From: forkless Date: Tue, 2 Jun 2026 18:48:29 +0200 Subject: [PATCH] bump to v0.3.1, add draft release workflow --- .github/workflows/release.yml | 3 ++- CHANGELOG.md | 22 +++++++++++++++++++--- Cargo.lock | 2 +- Cargo.toml | 2 +- GOVERNANCE.md | 11 ++++++++++- _release.md | 22 +++++++++++++++------- src/discovery.rs | 2 +- 7 files changed, 49 insertions(+), 15 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 3717280..ab599ae 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -71,11 +71,12 @@ jobs: run: | cd builds echo "hashes=$(sha256sum * | base64 -w0)" >> "$GITHUB_OUTPUT" - - name: Upload to release + - name: Upload to release (draft) uses: softprops/action-gh-release@v2 with: files: builds/* body_path: _release.md + draft: true provenance: needs: build diff --git a/CHANGELOG.md b/CHANGELOG.md index 8808bb9..e911b4f 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -4,6 +4,25 @@ All notable changes to NotAlterra are documented in this file. --- +## [v0.3.1] — 2026-06-02 + +### Added +- **Patrolling whale** in the Set save folder input dialog (was missing + the bottom separator present on all other screens) + +### Fixed +- **Path injection via paste** — control characters (newlines, tabs, null + bytes) are now stripped from user-provided paths before they reach + `config.ini` or `transaction.log` +- **Draft releases** — CI now creates releases as drafts. You can download + and test the binaries before publishing them live. + +### Removed +- **`Locate save files` menu item** — the deprecated auto-discovery entry + point is gone. `Set save folder` is the only path for configuring the + save location. The `discovery.rs` module remains for `validate_custom_path` + and `derive_ini_path` but is marked for removal in v0.4.0. + ## [v0.3.0] — 2026-06-02 ### Added @@ -54,9 +73,6 @@ All notable changes to NotAlterra are documented in this file. rustc 1.95 nightly. - **`KNOWN_ISSUES.md` moved from `docs/` to project root** — reflects v0.3.0 privacy improvements (manual path entry live, discovery deprecated). -- **`Locate save files` menu item removed** — the deprecated auto-discovery - entry point is gone. `Set save folder` is the only path for configuring the - save location. ### Notes - Working copy diverged from remote after signing the previous commit diff --git a/Cargo.lock b/Cargo.lock index bfbd9bb..28c5f08 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -495,7 +495,7 @@ dependencies = [ [[package]] name = "notalterra" -version = "0.3.0" +version = "0.3.1" dependencies = [ "anyhow", "chrono", diff --git a/Cargo.toml b/Cargo.toml index b324fce..17793fb 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -1,6 +1,6 @@ [package] name = "notalterra" -version = "0.3.0" +version = "0.3.1" edition = "2021" authors = ["NotAlterra"] license = "MIT" diff --git a/GOVERNANCE.md b/GOVERNANCE.md index b34e030..495f10f 100644 --- a/GOVERNANCE.md +++ b/GOVERNANCE.md @@ -61,13 +61,22 @@ welcome. Patience is appreciated. Kindness is non-negotiable. ## Release Checklist +CI now creates releases as drafts — binaries are built and uploaded but +not published. The maintainer tests the draft binaries before publishing. + Before signing a release tag, the maintainer verifies: - [ ] `cargo test --workspace` — all tests pass - [ ] `python3 tests/_check.py` — 100% doc coverage - [ ] CHANGELOG.md has an entry for the new version - [ ] `git status` — no uncommitted changes -- [ ] `_release.md` What's New section is updated +- [ ] `_release.md` is updated for the new version + +After the CI run completes: + +- [ ] Download draft binaries from the GitHub releases page +- [ ] Test on target platform(s) — basic menu flow, backup, restore, inspect +- [ ] Click **Publish release** on GitHub when satisfied ## Roadmap diff --git a/_release.md b/_release.md index aacb395..7578e78 100644 --- a/_release.md +++ b/_release.md @@ -4,13 +4,21 @@ Cross-platform terminal application. No admin permissions or network access req Pre-compiled binaries — no installation, no dependencies. Just download, extract, and run. -### What's New: +### v0.3.1 -• Column headers in file pickers -• Navigation prompt alongside item description -• Config keys renamed (save_path, save_scan, ini_path) -• Windows executable renamed to NotAlterra.exe -• Playtime zero-padded to 2 digits -• Removed unused dependencies — lighter compile +• Patrolling whale added to Set save folder input dialog +• Path injection sanitized — control characters stripped before writing to config or log +• Deprecated `Locate save files` menu item removed +• `Set save folder` is the sole method for configuring the save location + +### v0.3.0 + +• `Set save folder` — manual path entry with clipboard paste support +• No auto-scan on startup (privacy: scanning user profiles is disabled) +• Fuzz testing for GVAS parser (2 targets, ~450k runs clean) +• SLSA v3 provenance attestation on all release artifacts +• GPG-signed release tags +• Index-out-of-bounds fix in GVAS property extractors (found by fuzzing) +• Auto-discovery deprecated — scheduled for removal in v0.4.0 _Builds: Linux (amd64) • Windows x64_ diff --git a/src/discovery.rs b/src/discovery.rs index 8ac2340..d209613 100644 --- a/src/discovery.rs +++ b/src/discovery.rs @@ -1,7 +1,7 @@ //! Save-folder discovery. //! //! **Deprecated.** Auto-scanning user profiles and system directories for -//! Subnautica 2 saves is a privacy concern. Scheduled for removal in v0.3.0. +//! Subnautica 2 saves is a privacy concern. Scheduled for removal in v0.4.0. //! Use `Set save folder` from the main menu instead to enter paths manually. //! //! Traverses known path patterns across user profiles and common install