v1.0.0 release prep: docs rewrite, CI, dependabot, --version, SECURITY.md - #12
Merged
Conversation
- README: rewrite to production-grade layout (hero block with banner, badges for release/stars/downloads/license/Go Report Card; instant demo; install/usage/auth restructured; CI/CD moved to environment- scoped secrets with bot-account caution; subcommands folded into setup steps; support section) - architecture.md: refresh for current packages (session, httputil, cookies/jar) and multi-browser support; correct S3 status codes and upload URL in the data flow; document deterministic S3 field ordering - LICENSE: extend copyright to 2025-2026
- .github/workflows/test.yml: PR-time CI running go vet, go test -race -cover, and go build on push to main and on pull requests. README told contributors to run these before PRs; nothing enforced it. - .github/dependabot.yml: weekly gomod + github-actions updates. Especially relevant for kooky, which gates the Windows Chrome 127+ ABE fix (#4). - main.go + .goreleaser.yml: --version flag, with the version constant injected at release-build time via -X main.version={{.Version}} ldflags. Local builds report "dev". - SECURITY.md: disclosure policy via GitHub private vulnerability reporting, supported-versions table, and a pointer to the README's leak-remediation flow. Surfaces a "Security Policy" tab on the repo page. - README: NOTE callout under Authentication documenting that Chrome 127+ on Windows is not yet supported by kooky's ABE handling (tracking #4) — previously the README claimed unconditional Windows support.
GitHub Actions is deprecating Node.js 20 on 2026-06-02 (forced default to Node 24) and removing it 2026-09-16. checkout@v4 and setup-go@v5 both run on Node 20; bumping to v6 of each puts the workflows on Node 24 and clears the deprecation warning surfaced on the test workflow run. Ref: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
Mermaid renders natively on github.com, so swapping the ASCII art for a proper flowchart gives the data flow a real visual. The new diagram also adds color-coding the ASCII couldn't convey: - blue: GitHub-authenticated steps (carry user_session) - orange: the S3 upload (no GitHub auth — presigned policy handles it) - green: terminal nodes (input/output) This makes the architectural fact that step 4 is the only un-authed request visible at a glance, instead of buried in prose. The per-image loop is now wrapped in a subgraph so it's explicit which steps repeat per file vs the session-resolution that happens once.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Two commits' worth of prep work to get the repo ready for a v1.0.0 cut.
Docs polish (
9d1d1fc)documentation/architecture.mdrefreshed for current packages (session,httputil,cookies/jar), multi-browser support (Chrome, Brave, Edge, Chromium, Firefox, Opera, Safari), S3 status-code corrections, and the deterministic field-ordering note.LICENSE: extend copyright to2025-2026.Release readiness items (
46e33c1).github/workflows/test.yml— PR-time CI (go vet,go test -race -cover,go build). README told contributors to run these; nothing enforced it..github/dependabot.yml— weeklygomod+github-actionsupdates. Particularly relevant forkooky, which gates the Windows Chrome 127+ ABE fix (Windows: Chrome 127+ App-Bound Encryption (v20) cookies aren't auto-read — use a gh token or GH_SESSION_TOKEN #4).main.go+.goreleaser.yml—--versionflag, with the version constant injected at release-build time via-X main.version={{.Version}}ldflags. Local builds reportdev.SECURITY.md— disclosure policy via GitHub private vulnerability reporting, supported-versions table, pointer to the README's leak-remediation flow.kooky's ABE handling (tracking Windows: Chrome 127+ App-Bound Encryption (v20) cookies aren't auto-read — use a gh token or GH_SESSION_TOKEN #4) — previously the README claimed unconditional Windows support.Items intentionally deferred
The pre-release audit (REVIEW.md — not committed) flagged a few more items. Skipped for this PR:
internal/upload/— core protocol code is at 0% unit coverage. Real risk, but bounded (1,500+ downloads across 3 releases have functionally exercised the path). Better as a focused follow-up than a rushed addition here.Test plan
go vet ./...passes locallygo test -race ./...passes locallygo build -ldflags "-X main.version=1.0.0-test" .and./gh-image --versionprintsgh-image 1.0.0-testtest.ymlworkflow runs green on this PRSECURITY.mdsurfaces as a "Security Policy" tab on the repo page after mergedependabot.ymlis picked up (Settings → Code security → Dependabot version updates shows it active)