Releases

Changelog

All notable changes to this project will be documented in this file.

Builder contract, release 1. The builder contract (ADR-038, “thin core plus admissible sugar”) removes several hundred Create*/Set*/Add* helpers and every value the constructors used to inject. Every removal is listed once, with the expression that replaces it, in Builder contract: release 1 migration notes : the deleted helpers and sub-type constructors, and the constructor and workflow defaults that no longer apply. Read it before upgrading across the entries below. The contract itself is Kubernetes Builders .

Builder contract, release 2. The Kind(&Config) layer — one function per kind taking a kure-invented Config struct — is retired in certmanager, cnpg, externalsecrets, prometheus, cilium and volsync, together with the sealed IssuerVariant, ACMESolver, DNS01Provider, SourceMover and DestinationMover sums and the values that layer injected. Every removed function, type and field is mapped to the upstream field that replaces it in Builder contract: release 2 migration notes .

[0.2.0-beta.17] - 2026-10-18

Added

• Let umbrellas hold no controller worker

Build

• Update dependency hugo to v0.168.0
• Update go-patch

Fixed

• Refuse umbrella rewrites onto leaves the dependent creates
• Build UmbrellaTerminals errors with the errors package

Maintenance

• Update go-kure/.github digest to 7aa603a

[0.2.0-beta.16] - 2026-10-11

Breaking

• Apply FileNaming to flux-system and augmenter layouts
• Add constructors for ten more base kinds of k8s.io/api
• Check Flux-delivered trees before writing
• Flatten a list document of a registered kind into its items
• Add constructors for ImageRepository and ImagePolicy
• Add a constructor for APIService
• Point the gotk bootstrap at the directory the sync path names
• Validate the layout rules in the walk, for every entry point
• Remove the unapplied ApplicationFileMode from LayoutRules
• Walk with the caller’s layout rules in GenerateFromCluster
• Render the root node’s bundle in a directory of its own
• Refuse a directory child whose Namespace is its own path
• Refuse names that cannot be a Kustomization or a directory
• Take no generated Source for a Kustomization that applies it
• Refuse a per-layout tree in GenerateFromLayout
• Name and order a node’s own Flux Kustomization
• Point the bootstrap at the top directory of the written tree
• Build the MetalLB BGPPeer at metallb.io/v1beta2
• Give a list document one reading and keep what it says
• Give a per-layout Kustomization readiness settings and labels
• Refuse a duration the Flux API does not take
• Give a per-layout Kustomization six more settings
• Refuse an object written without a kind or an apiVersion
• Write no child health checks on an umbrella that waits
• Refuse a layout’s Kustomization settings where it gets none

Added

• Name a bundle’s Kustomization separately from the bundle
• Delivery intent on Application
• Check names at the entry points that skip cluster validation
• Name a bundle’s directory separately from the bundle
• Export the default per-layout Kustomization name

Build

• Update module sigs.k8s.io/gateway-api to v1.6.3
• Update dependency external-secrets/external-secrets to v2.12.0
• Widen external-secrets supported_range to 2.12
• Update Go to 1.26.9 and golang.org/x/net to v0.60.0
• Update module github.com/cloudnative-pg/machinery to v0.6.1
• Update module golang.org/x/tools to v0.52.0
• Update module golang.org/x/vuln to v1.9.0

CI

• Save the tool caches from main only
• Raise the test job timeout from 20 to 30 minutes
• Drop the stale GO-2026-6596 allowlist entry
• Correct the stale pin and source references in the GO-2026-5377 waiver comment

Changed

• Let the sync root-name check accept a nil config
• Keep the root-name check clear of the bootstrap path code
• Remove the root-directory refusal no bundle name can reach
• Check every application layout’s name, drop origin.appDir

Documentation

• Add layout and Flux naming design (current behaviour and target)
• Link the layout and Flux naming changes to their issues
• List the layout and Flux naming page for the doc-examples check
• Correct current-behaviour claims in the layout and Flux naming page
• Scope the augmenter opt-out and the FileNaming target to where they apply
• Scope the leading ./ statement to the Kustomization spec.path
• Align the target sections with the updated issues
• Close the remaining gaps between the page and the issues
• Address the review of the roles and three target sections
• Qualify two collision rows and the issue references
• State when a payload Kustomization is kept, not refused
• Name the layout that hosts its own Kustomization
• State the flux-operator distribution requirement in the domain model
• Mark the empty-distribution refusal as shipped on the layout page
• Qualify three FileNaming statements
• Widen the FileNaming acceptance exception
• Mark the FileNaming section as shipped
• Say which files FileNaming names
• Restore the FileNaming text of the design page after the rebase
• State the kept-Kustomization rule in the Flux workflow guide
• Say where the bootstrap directory and a walked root differ
• State the two walks whose root is not the bootstrap directory exactly
• Say what removing the rules field leaves unchanged
• Correct the SourceRef, hook-group and DependsOn statements
• Cite code by symbol on the design page and mark what shipped
• State that merged bundles share a Kustomization and that DependsOn holds Kustomization names
• Qualify which bundle-less child layouts get a Kustomization
• Mark the kept-Kustomization checks of the behaviour-bug ticket as shipped
• List the patch-scope case of the behaviour-bug ticket as a target
• State that the walked root hosts its own Kustomization and what the patch-scope check counts
• Say that a Kustomization already in place is kept, not refused
• Qualify the kept Kustomization by the generated namespace
• Name the layout rules of the workflow entry points in the domain-model guide
• Say that GenerateFromCluster also returns generated Sources
• Bring the behaviour-bug section of the naming design up to main
• Say which rules made the old GenerateFromCluster paths disagree
• Name references follow the Kustomization name, not the bundle name
• Mark the Kustomization name section of the naming page shipped
• State the GenerateForBundle refusals on the names in effect
• State the patch-scope gap for a collapsed per-layout directory
• State the shipped delivery intent in the layout and Flux naming page
• Say which writer call SameDirectory does not describe
• Say which stored tree was rewritten for the path move
• Say where the root bundle’s Kustomization sits per placement
• Scope the unset-field guarantee to its own change
• Drop the comparison with child nodes’ bundles in the guide
• Say which layouts the root bundle’s name is compared with
• State the directory-child refusal in the Flux workflow guide
• State the name validation rules as delivered in the naming page
• Say what a NamedDependsOn entry refers to
• Split the naming page’s row on dotted and over-long names
• Say in the naming page that a nil DependsOn entry is refused at validation
• Name the test file of the per-layout Kustomization names in the naming page
• Describe Bundle.DirName as shipped in the naming page
• Describe node Kustomizations as shipped in the naming page
• State how the YAML encoders write a float that holds an integer
• Bound the float rule at -2^63 and 2^64, both excluded
• Limit the float rule to a float64 that holds an integer
• State the WriteManifest change as a rule
• Name the rules argument of GenerateBootstrap on the stack pages
• Say the walk and TopDirectory name the same directory
• Say which parse failures leave the rest of a stream
• Describe a document that fails to decode, not every document
• Say in the Flux guide where a node’s layout takes its source
• Name the root bundle’s source where the ones below differ
• Say which streams end a parse at malformed JSON
• State the JSON-only stream by what the decoder checks
• Name the MetalLB BGPPeer among the kinds a parse returns typed
• Point the layout integration refusal at what its error names
• State per-layout inheritance in the domain model
• Say that a zero duration is not refused
• Say in the Flux workflow guide what a per-layout Kustomization now takes
• Say that only a plain patch is placed by object
• List a layout’s interval among the durations refused
• Say a patch that is not plain can remove its object
• State what follows a removal only for a removed object
• Cite where kyaml removes an annotation set to null
• Say the local-config annotation drops its object where the merge gives it
• Cite gateway-api v1.6.3 and date the ledger’s citations
• Say widen –note appends to the notes key
• Count one separator in the layout name shortening bound
• State the unreadable-list fallback in the library guide
• Drop two older copies of the corrected layout claims
• Qualify why a parent does not list an umbrella child
• State what an invalid-duration refusal names
• State the refusal of a layout’s settings in the Flux workflow
• State the trimmed prefix and the hash-only long-name form
• Qualify the long-name form in the field and test comments
• Generate the service account example and qualify the unset identity
• Name the first bundle’s unit for merged bundles
• Name the default layout Kustomization helper
• Add an example for DefaultLayoutKustomizationName

Fixed

• Refuse an empty Registry or FluxVersion in flux-operator mode
• Read raw and empty items of a typed List
• Read typed List items that carry no object metadata
• Read a raw typed List item from its raw JSON
• Read raw List items by element type, through ExtractList
• Check a kept Kustomization in whatever form it has
• Name the placement in use in the SourceRef refusal
• State what FluxPlacement still decides, pass one set of rules in the integration tests
• Refuse the per-layout placement in the Flux GenerateFromCluster
• Refuse the per-layout placement before the empty-cluster guard
• Refuse invalid layout rules in GenerateFromCluster for an empty cluster too
• Refuse a GenerateForBundle reference to the bundle’s own Kustomization name
• Refuse a GenerateForBundle bundle that depends on itself
• Refuse a GenerateForBundle health check on the bundle’s own Kustomization
• Keep three name checks true with KustomizationName set
• Refuse a DependsOn copy that names another Kustomization
• Compare a DependsOn copy with its bundle on the name in effect
• Refuse a bundle that is its own umbrella child in GenerateForBundle
• Delivery intent reaches nested Lists and hand-built ArgoCD layouts
• Decide what a List is the way kustomize does
• Read a typed List’s items from its written form
• Refuse a written form that lacks the delivery annotation
• Match a generated ConfigMap’s annotations in the patch-scope check
• Patch-scope check covers ConfigMaps generated in child layouts
• Delivery intent reads raw List items as written and reaches a derived Source
• Refuse a delivery intent in the Flux GenerateFromCluster
• Keep the root bundle’s directory to one owner and one layout
• Compare the root bundle’s directory as the writers do
• Resolve a rooted path as the writers do in SameDirectory
• Refuse a root bundle name that resolves to the root node’s directory
• Refuse a root bundle name that resolves to a directory further down
• Refuse the nested directory child in another case, ask each parent once
• Check the root name only where a path is built, refuse a NUL byte
• Check Flux’s 63-character name limit in the Flux workflow only
• Check the bundle names a Kustomization refers to
• Check an application’s name on the tree the walk returns
• Check a Kustomization’s name on the name it gets
• Refuse a nil DependsOn entry
• Check the bootstrap source name and per-layout Kustomization names
• Name an umbrella descendant by its path when a DependsOn entry is nil
• Pass over only a Source the integration can generate
• Say the Source rule without the wait it need not cause
• Write an integer above 2^53 as the integer it is
• Write an integer above the int64 range as the integer it is
• Return the top directory without a leading slash
• Refuse a root node name that is no directory name in TopDirectory
• Report a panic in a registered type’s decoder as a parse error
• Give a node’s layout Kustomization its node’s bundle source
• Let the node’s bundle decide where the SourceRefs below differ
• End a parse at a stream the decoder cannot move past
• Keep what is version-specific per version
• Say whose Kustomization a generated one meets and what names it apart
• Name the field in effect in the Kustomization clash refusal
• Name an application only for the object the tree still holds
• Do not panic on an object Go cannot compare
• Read a list’s metadata from every place the list states it
• Join an item and its list’s identity without a size sum
• Read a List by one rule in the layout checks and the Flux integration
• Read a typed List’s items only where they are what it writes
• Read an item that is a nil pointer to raw content as empty
• Word the duration refusal and the List cycle rule as they are
• Place a bundle’s patches by object only while the list is plain
• Return from the root-build check on a patch kustomize cannot read
• Say the remedy for a patch of several documents
• Count a patch’s objects, not its documents, in the remedy
• Keep a per-layout Kustomization’s postBuild and patches from its parent’s substitution
• Read only the patches again when checking the parent’s substitution
• Judge a per-layout Kustomization’s patches by its own substitution
• Count any change the parent makes to a per-layout Kustomization’s patches
• Judge the opt-out over every Kustomization that builds a per-layout one
• Word the two-parent opt-out refusal without attributing fields
• Check a per-layout Kustomization’s annotations with the opt-out in them
• Count a patch that deletes its object as not plain
• Count a patch that marks its object local-config as not plain
• Take a typed object for a List by the kind it is written with
• Read an Items field apimachinery cannot read as no List
• Read an object apimachinery’s list reading panics on from what it writes
• Take a local-config object without an apiVersion as before
• Name a refused List item by the resource it is held in
• Shorten a layout’s composed Kustomization name over 63
• Read a registered List’s items without an apimachinery panic
• State accurately why a refused layout has no Kustomization
• State a wrapped error’s cause once
• State an invalid duration’s parse error once
• Shorten a long layout name’s default Kustomization name
• Let a bundle name the service account its Kustomization applies with

Maintenance

• Update github-actions-trusted
• Update go-kure/.github digest to 8494b10

Testing

• Build List test objects in the subtest that uses them
• Make the refused-integration rollback assertion bite
• Hold the output without KustomizationName to the stored bytes
• Compare the health checks GenerateForBundle keeps, not their count
• Require the Application the dependency copy test reads
• Pass layout rules to GenerateFromCluster in the name tests
• Move the ArgoCD cluster-entry intent cases out of delivery_intent_test.go
• Name the entry points the ArgoCD refusal test covers
• Name the rule sets the ArgoCD refusal test runs
• Fail when an expected object is missing from the layout
• Fail when a check in the delivery tests meets nothing
• Keep the root bundle’s directory named by its Name
• Read application records where the root bundle is rendered
• Say which record shapes the collapse used to absorb
• Pass the layout rules to GenerateFromCluster in the long-name test
• Fail the over-limit subtest on its own testing.T
• Expect the name refusal where a name no longer reaches a directory check
• Pin the patch scope of a generated ConfigMap under per-layout
• Pin the root-build check by the build and the kept forms on the written tree
• Build the gotk bootstrap once per input in the path matrix
• Pin that a recovered decoder panic returns the error alone
• Register the schemes in the direct decoder test
• Pin the node’s bundle source with every node in one directory
• Pin malformed JSON that ends the stream after one document
• Pin two malformed documents in a row behind separator lines
• Hold each scope source against its own type
• Say what joining a list’s identity keeps of an item’s bytes
• Check the postBuild and patches of a tree the parent leaves as written
• Compare the whole patch of a tree the parent leaves as written
• Match the duration parse error by its message
• State the hash-only case in the long-name test comment

[0.2.0-beta.15] - 2026-10-02

Added

• Release through the shared Release workflow
• Add crdvalidate, an apiserver-faithful CRD validator
• Create the namespaces getting-started applies into

Build

• Update sigs.k8s.io to v0.21.2
• Update module github.com/cloudnative-pg/plugin-barman-cloud to v0.15.1
• Update module sigs.k8s.io/controller-runtime to v0.25.2
• Update module golang.org/x/tools to v0.51.0

CI

• Remove a docs slot through the shared deploy-docs-push step
• Add the Release / State dispatch workflow
• Waive GO-2026-6596, a cilium advisory the pinned v1.20.2 is outside of

Changed

• Move the vendored Flux bundle to internal/gotk
• Lift the CRD reader to internal/crds and read whole definitions

Documentation

• Name the analyze-changes base branches as examples
• Qualify the docs-root guarantee for tags cut before the deploy action
• Say the root check does not confirm the label is a tag
• Say a waiting removal can also cancel a waiting deploy
• Name the per-slot group the slot check precedes
• State the older action’s root rule and the tag check exactly
• Say pin-impact checked the PR’s recorded base, not the merge base
• Describe schema validation and the moved readers
• Vendor the shared workflows guide
• Correct three statements in the workflows page
• Name the path check and the build in the package summary
• Name every rule stricter than a Flux build
• Say which named data readTree still decodes
• Say what isLocal compares and what kustomize compares
• Bound the data files the scanned read takes

Fixed

• Count analyze-changes lines against the PR’s own base
• Deploy docs through the shared deploy-docs-push action
• Make Manage Docs act on kure’s own docs slots
• Serialize Manage Docs removals with deploys of the same slot
• Validate the Manage Docs slot before joining a deploy group
• Refuse mixed go-kure/.github pins in the merge queue
• Drop the ObjectStore serverName the CRD forbids
• Use a protocol the LocalRedirectPolicy CRD accepts
• Hold validation to the server’s definition check, name rules and decoder
• Route validator errors through pkg/errors
• Mirror kustomize’s List rule, two more name rules, create the fixture dir
• Refuse a symbolic link or a stale .original before building
• Decode a file named both as a resource and as data
• Read an entry that names a file whatever its name
• Refuse an entry by kustomize’s parser, not by what exists
• Compare a github host as kustomize does, and refuse by form
• Decode every file a kustomization file lists, whatever its name
• Hold a Kustomization’s components to the tree
• Build nothing after an entry leaves the tree
• Read the data-named files Flux’s scan applies

Maintenance

• Update go-kure/.github digest to 64e5348
• Update go-kure/.github digest to 31e5d57
• Update go-kure/.github digest to d9fae71
• Update go-kure/.github digest to acd114e
• Update go-kure/.github digest to 4252fb3
• Update go-kure/.github digest to 592439e
• Update go-kure/.github digest to 59f8799
• Update go-kure/.github digest to 233676b
• Update go-kure/.github digest to ab9eec3
• Pin deploy-docs-push at the same go-kure/.github commit as the other actions
• Update go-kure/.github to 8c18551
• Update go-kure/.github digest to ea181d3
• Update go-kure/.github digest to 19ff5ba
• Bump go-kure/.github to 177d427 and re-vendor the release guide
• Update go-kure/.github digest to 9ba85b3
• Update go-kure/.github digest to a81814d
• Update go-kure/.github digest to 9a5c7fa

Testing

• Wire the pinned CRDs into kuretest
• Complete the five partial fixtures
• Share one schema-validating golden helper
• Validate bootstrap, cluster output and getting-started
• Exercise the refusal paths of crdvalidate and kuretest
• Check New’s error before compiling a refused definition
• Check a tree’s references and namespaces against what it holds
• Check every path a tree names and build what Flux applies
• Read the written tree through kuretest
• Hold the getting-started tree to the consistency pass

[0.2.0-beta.14] - 2026-09-30

Breaking

• Make Namespace the parent path; same-name layouts nest
• Record origins in the walkers; refuse lossy nodeFlat merges
• Derive every Kustomization spec.path from the layout tree
• Take Application paths from the walked layout
• Honour every grouping axis with one merge rule
• Emit one Kustomization per directory that renders bundles
• Give every reconciliation unit one owner
• KustomizationRecursive writes no kustomization.yaml

Added

• Record layout origins and index them with IndexOrigins
• Generate pkg/kubernetes README Go blocks from Example functions
• Generate the remaining pkg README Go blocks from Example functions
• Generate the docs and site Go blocks from Example functions

Build

• Update dependency hugo to v0.167.0
• Update dependency yq to v4.54.1

CI

• Raise the lint job timeout from 15 to 25 minutes

Documentation

• Add parent-path migration guidance to the flux-workflow guide
• Correct the ClusterName and unnamed-root migration notes
• Note that an unnamed root’s grandchildren now nest
• Document Kustomization paths derived from the layout tree
• Mark the removed-API note as deliberate for the doc API check
• Match the unit, dependency and re-integration docs to the code
• An AppFileSingle root lists its children in its Namespace
• Name the AI review check and the real approval rule for main
• State the approval rule and required checks the same way everywhere
• Complete the layout structs and past-tense the retired volsync notes
• Address review of the doc-example pages
• Address review of the docs and site doc-example pages
• Complete the two-versions sentence in the build-identity paragraph
• Bring the single-child comments in line with the Name refusal
• List the pin-impact shapes left uncovered and the remaining false aborts
• Scope the flattened-root refusal to the writers that reach it
• Record root-hosted Sources and the wrapper refusal in the Flux workflow guide
• Say a non-constant slice length may allocate elements
• Say the library-usage guide’s append and insert shapes take one value

Fixed

• Coalesce excluded-node wrappers under in-package parents
• Keep an unnamed root at cluster/ when no ClusterName is set
• Keep a package’s out-of-package root wrapper at cluster/
• Index doc API references by parsing Go source
• Skip testdata in the doc API index and correct two comments
• Transfer origins when FlattenSingleTier collapses a tier
• Give the ClusterName wrapper layout its FluxPlacement
• Apply hosted Sources in Recursive mode; refuse duplicate CRs already in the tree
• Refuse a Source that collides by identity with a different one
• Check CR identity against every Kustomization in the tree, in every placement
• Keep an earlier flux-system child only when nothing was added beneath it
• Write a kustomization.yaml for every layout that renders a bundle
• Write a kustomization.yaml for every directory a PerLayout CR targets
• Write “resources: []” for a kustomization that lists nothing
• Keep an earlier flux-system child only in the directory its parent references
• Give every written directory a kustomization.yaml
• Treat an omitted namespace as “default” in the identity check
• Check a List’s items, not its envelope, for identity
• Skip objects without a kind in the identity check
• Keep node and bundle layouts out of Config’s AppFileSingle
• Resolve unit dependencies by name and include readiness waits
• Remap every Kustomization reference a merge changes
• Refuse any Kustomization set that can never become Ready
• Scope the reconcile-order check to what kure generates
• Wait on every applied CR; compare layout sources effectively
• Check separate placement and re-integrated CRs for deadlocks
• Keep a refused separate integration from passing on retry
• Emit a shared Source once and match it by effective namespace
• Keep PerLayout CR targets out of Config single-file mode
• Pin every PerLayout CR target to its own directory
• Place layouts without a placement per layout like their parent
• Apply the integration’s placement to the whole tree
• Keep an integrated tree’s placement; put it back on refusal
• List hosted Flux objects in every placement; compare only emitted source fields
• Refuse a patch that reaches another bundle in a shared directory
• Count only placed Kustomizations; roll back a refused call; match kustomize namespaces
• Count AppFileSingle application files in a PerLayout unit’s patch scope
• Report a merged unit’s label conflict before its annotation conflict
• Check Flux object identity across the whole integration pass
• Refuse an existing Source of a generated identity under FluxSeparate
• Compare Sources by content whatever their Go type
• Keep the parent’s kustomization.yaml when a child is AppFileSingle
• Refuse an AppFileSingle child with children; list only written files
• Refuse an AppFileSingle file that replaces a file in its directory
• Refuse a single file over another layout’s extra file
• Refuse an extra file clash before writing anything
• A resource-less single child reserves no file name
• A resource-less single child still reserves its directory
• Name one owner when an extra file takes a needed directory
• Host a shared Source once per kustomize build
• Check every name a page qualifies with a kure package
• Scope the retired-layer markers to their own lines
• Read output comments and Go fences as go test does; document the doc-example check
• Refuse files the Flux build of a Recursive directory reads differently
• Refuse an unlisted single-file child in a Recursive build
• Word a control-named unlisted file as never listed
• Refuse an unlisted child directory in a Recursive build
• Compare PackageRef values, not pointers, when skipping a cross-package child
• Close the four pin-impact script gaps from #731 rounds 8-9
• Refuse the pin-impact shapes the review found still read as inert
• Bound the pin-impact exemptions and SCRIPT_DIR definitions
• Refuse a single layout’s file that needs a directory where another path is a file
• Check single layouts’ directories against written files; accept extras in a child’s directory
• Refuse only the kustomization.yaml a layout writes as a directory clash
• Refuse one object in two layouts of one kustomize build
• Match kustomize’s object identity in the build check
• Refuse one object held twice by one layout in the build check
• List an AppFileSingle child’s file by its path below the parent
• List single children only where the path matches what is written
• Find a single child above a root whose directory is “.”
• Fail closed on the pin-impact shapes the line scan cannot read
• Close the pin-impact gaps the review found
• Close the remaining pin-impact gaps and state the threat model
• Count flow-mapping run steps and read no pin from a block scalar
• Read no key from an action’s run body, and accept a step’s dash alone on its line
• Quote a kustomization entry kustomize would read as a bool, null or number
• Refuse dropped and duplicate ConfigMapGenerators
• Name the generator refusal by the child’s file, and document every path it covers
• State where the package walk refuses generators, and pin the refusal’s file
• Read a checkout’s repository only in its with: mapping
• Refuse generators on a root that writes no kustomization.yaml
• Refuse generators on an AppFileSingle Recursive root
• Save Go module cache from main only
• Refuse a generated Flux Kustomization over an empty Recursive directory
• Compare filled directories exactly and count an AppFileSingle root’s files
• Refuse an empty marked AppFileSingle Recursive root
• Host every generated Source once, in the root layout
• Host generated Sources in the root node’s layout, not a ClusterName wrapper
• Keep a caller’s Source in a ClusterName wrapper’s build
• Refuse a caller’s Source in a wrapper build that holds the root’s
• Refuse a root-bundle patch or postBuild that changes a hosted Source
• Refuse a root postBuild reading a substituteFrom var
• Refuse a conditionally executed admitted write
• Resolve nil in the nil-init guard through type information
• Count a slice make as a zero value only at constant length 0
• Count a zero value as the nil-init only for a map, slice or pointer field

Maintenance

• Update go-kure/.github digest to f074d4b
• Update go-kure/.github digest to 1d74851
• Update go-kure/.github digest to 7c4928e
• Update go-kure/.github digest to b85115b

Testing

• Pin case-folded refusal, WriteManifest no-write, argocd placement
• Pin every Flux and ArgoCD path to the layout directory
• Migrate tests off the removed path derivation
• Cover the refusal paths of the layout-derived generation
• Report a listed directory without kustomization.yaml instead of aborting
• A caller’s Source copy below the integration’s is kept
• Cover AppFileSingle files in a Source build; say depth-first
• Skip nil children when counting Source copies
• Pin one Source per build under Recursive; reword the bundle-mode comment
• Give the subdirectory extra-file fixture its own object
• Build a resource file whose name needs quoting, and bound yamlString to valid UTF-8
• Pin the with: key of a checkout’s repository and ref
• Cover each half of the AppFileSingle root’s filled directories
• Refuse range-clause and read-modify-write field writes
• Count indexed, parenthesised and nil-initialised read-modify-write targets
• Trace slice expressions and alias chains for read-modify-write targets
• Unparenthesise alias destinations in read-modify-write tracking
• Track a comma-ok map read as a copy of the caller’s element
• Root a comma-ok map read only for read-modify-write targets
• Refuse a spelled-out read-modify-write of a caller’s element
• Follow append results, range variables and alias spellings in read-modify-write checks
• Match class-a write-backs to their source and follow conversions and reference-holding copies
• Check class-a append inputs and parenthesised reassignments against the write-back field
• Evaluate a multi-assignment’s sources before its updates in class-a tracking
• Count the write-back of a local class a refused as a bare write
• Count a refused write-back through an initialised pointer as a bare write
• Admit class a only as one direct statement
• Admit a helper body only through a closed grammar
• Compare constant indexes by value in the helper grammar
• Pin each branch of the helper grammar with its own fixture
• Refuse a write that meets more than its nil-init assigned
• Refuse a helper that leaves a parameter out
• Freeze the verdict of generated helper bodies
• Record what the helper grammar alone answers
• Refuse a function literal in the helper grammar
• Refuse a stray append in the helper grammar
• Count appends and inserts in the helper grammar
• Refuse a slice make with a length in a nil-init
• Compare a nil-init guard with its path as written
• Refuse a written value that reads its target
• Read a write through a pointer nil-init as spelled
• Refuse a value named nil in the helper grammar
• Refuse a bare &P or *P in the helper grammar
• Name the cause of an S1, S8 or P1 refusal
• Read the class of a helper off the writes of the grammar
• Read a helper body through the grammar only
• State three spelling rules as the grammar reads them
• Say that V7 reads its target as written
• Print a reason’s expressions as written

[0.2.0-beta.13] - 2026-09-24

Breaking

• Refuse colliding or non-portable ExtraFiles, and “..” in layout paths
• Reject unparsable Bundle durations instead of silently using the 60m default interval or dropping Timeout/RetryInterval
• Remove the 61 sentinels no kure code returns
• Retire the config-struct layer and unseal the issuer sums
• Retire the config-struct layer and its invented defaults
• Retire the config-struct layer
• Retire the config-struct layer
• Retire the config-struct layer
• Retire the config-struct layer and its mover sums

Build

• Update module github.com/prometheus-operator/prometheus-operator/pkg/apis/monitoring to v0.94.1
• Fail docs-build on absolute links to the site outside the dev slot
• Update module github.com/cloudnative-pg/cloudnative-pg to v1.30.1
• Update dependency golangci-lint to v2.14.0
• Update kubernetes to v0.37.1

CI

• Run CI on pull requests against any base branch
• Run the Go jobs unless a PR is docs-only

Changed

• Remove internal/kubernetes, which nothing imports

Documentation

• Drop three Features bullets ci.yml does not implement
• Correct five overclaims in the builder-contract release-1 notes
• Stop promising decoded YAML always marshals
• Show that a Job must set its restartPolicy
• Restore two entries a regeneration made ungrammatical
• Name the two resource setters and mark a struct field for the reference checker
• Record the retired layer’s empty-input guards in the release 2 ledger
• Scope the empty-input guard to the fields that had one
• State the bootstrap and resource-quantity guards of the retired builder
• Correct the retired builder’s reach to two spec fields
• State the guards behind every constant-valued ledger row
• Recount the fluxcd defaults inventory after the FluxInstance name split
• Point site links at the version being read, not the release root
• Name the k8s.io/api minor, not a patch, in the controller-runtime note

Fixed

• Make widen append to notes instead of replacing them
• Reject a malformed supported_range before comparing it
• Reject a cyclic Node graph in ValidateCluster
• Accept Wait=false on an umbrella bundle
• Close six check-doc-api-refs residuals that passed stale pages
• Build gotk bootstrap from a vendored flux2 bundle
• Prepend each release’s changelog section, never regenerate
• Name the FluxInstance flux, not BootstrapName
• Resolve Type.Method against the type’s own methods
• Know a type from its declaration, not its surviving methods
• Check only published READMEs and stop on a partial page list
• Name a missing site/hugo.toml instead of exiting silently
• Allow dev-slot links only from CHANGELOG.md and cliff.toml
• Walk each module’s CRDs once per process, not per resolution

Testing

• Add a hermetic suite for check-pin-impact.sh
• Capture the config-struct layer output as goldens
• Forbid kure-defined parameter types under pkg/kubernetes
• Catch aliases to struct and interface literals in the parameter rule
• Follow ownership through every layer a parameter type can hide behind
• Decide alias ownership where the alias is declared
• Check generic type arguments and fail closed on an empty load
• Check generic-alias type arguments and type-parameter constraints
• Follow a constraint’s type set and state what the rule guards against

[0.2.0-beta.12] - 2026-09-22

Added

• Expose FluxInstance sync name via BootstrapConfig.SyncName

Build

• Update go-kure/.github digest to aa7c673
• Update go-kure/.github digest to 0c9368c
• Update go-minor
• Update module github.com/cert-manager/cert-manager to v1.21.2
• Update module sigs.k8s.io/controller-runtime to v0.25.1
• Update fluxcd (flux-operator held at v0.53.0)
• Constrain Renovate to the repo’s Go pin
• Update module github.com/cilium/cilium to v1.20.2
• Update dependency git-cliff to v2.14.2
• Update dependency external-secrets/external-secrets to v2.11.0
• Update fluxcd
• Widen flux-operator range to 0.58 and re-vendor the install bundle
• Re-vendor the flux-operator install bundle from Renovate

CI

• Allow manual re-publish of an existing tag
• Guard dispatch ref and correct the re-run recovery guidance
• Refuse a dispatch over a live release, split the rerun rows
• Serialize the wrapper, bound the re-run rows, flag docs rollback
• Probe for an existing release on re-attempts, not just dispatches

Documentation

• Detect partial publishes and cover post-publication recovery
• Key the completeness check on the tag, drop the scripted deletion
• Use the goreleaser job conclusion as the completion oracle
• Drop the SBOM and cosign claims kure does not produce
• Pin the attempt, key on not-success, state two limits
• Let the command flag carried-over job rows
• Find the attempt that ran goreleaser, not the latest
• Require positive release ownership before deletion
• Replace the partial-publish deletion branch with escalation
• Split transient re-run recovery, document the docs-deploy race
• Close the –failed class by enumeration, add the guard-failure row
• Wait for the corrective docs deploy, not just the recovered one
• Classify every removed default by what it costs
• Fix nested emphasis and reconcile the unsettled count
• Drop an ordering claim the class list does not honour
• State the omitempty count instead of contradicting it
• Settle the Cilium row, and stop reading omitempty as required
• Say what a golden diff shows, not what it does not
• Fix the golden-diff rule and the defaults the table never listed
• State the rule behind which app-label removals are silent
• Show the 0/false degradation shape with a fixture that has one
• Reclass CreateService as silent on a pinned selector
• Check the three unsettled rows against the standard the table already uses
• Cite the whole Service selector sentence, not half of it
• Class the container defaults the scheme never reached
• Narrow the pull-policy split to what the pinned comment supports
• Replace two claims the pinned dependencies contradict
• Fold in the frozen citation and wording findings
• Note the ModuleVersion provenance exemption in the doc-gate contract
• Note the ModuleVersion exemption in the workflow guide
• Link the vendored guard section to the canonical adoption procedure
• Make the canonical adoption procedure reference a hyperlink
• Record the external-secrets v2.11 folderID wire-format change
• State the admission-breaking CRD tightenings for flux-operator 0.58
• Say what a supported range does and does not promise
• Stop numbering the flux-operator pin cases in the guard-test note
• Document SyncName in the stack README and domain-model guide
• Scope the sync-ref equivalence to tags, branches and empty refs
• Explain SourceRef resolution in the flux-workflow guide

Fixed

• The guard’s message must not claim publication succeeded
• Probe the release on every path, fail closed on an undetermined answer
• Retry the release probe, and stop the waiver claiming more than it can
• Derive the canonical-guard checkout ref from the action pin
• Make the pin resolver portable to non-GNU grep/sed
• Enable strict constraintsFiltering instead of a toolchain override
• Re-pin external-secrets to v2.11.0 and widen supported_range
• Install Go in sync-eso-pin.sh when Renovate’s image lacks it
• Read only require directives and stop leaking pin fixtures
• Reject unlisted bundle kinds and check pin trees portably
• Stage every flux-operator pin output before replacing any
• Drop the no-op pull_request trigger from the Claude workflow
• Resolve the FluxInstance sync ref the way the gotk source does

Maintenance

• Bump go-kure/.github pin to 7cc86e2 for doc-gate provenance exemption
• Update go-kure/.github digest to 6c92665
• Update codecov/codecov-action digest to 0b35c9e
• Update go-kure/.github digest to bd0ce1a
• Update codecov/codecov-action digest to 303a32d
• Update go-kure/.github digest to 92da34e
• Update go-kure/.github digest to 75b120b

[0.2.0-beta.11] - 2026-09-10

Breaking

• Delete bare field forwarders and sub-type constructors
• Fold per-kind pod-template helpers onto PodSpec
• Drop error returns from resource and Helm values setters
• Stop sugar helpers writing fields the caller did not name
• Inline the ConfigMap helpers, drop the bulk-map ones
• Remove the per-kind label and annotation helpers
• Declare every injected default as an exported name

Added

• Track go-kure/.github ref: via customManager + vendor-guard
• Pin external-secrets to upstream releases, not main HEAD
• Detect the govulncheck env pin and keep golangci-lint pins in sync
• Add LayoutIntentAugmenter companion interface for layout placement intent
• Add pkg/versions, a stable Go API over versions.yaml metadata
• Guard pkg/versions/versions_gen.go against versions.yaml drift
• Mechanically enforce barman-cloud’s MVS-floor claim
• Gate go-kure/.github pin bumps on their real impact
• Land the builder contract core (ADR-038)
• Derive kind scope from the pinned upstream markers
• Walk the pinned API types for gated and deprecated fields
• Publish the derived kinds, scope and maturity tables

Build

• Update github.com/cloudnative-pg/barman-cloud digest to 5aa56cd
• Update toolchain
• Update kubernetes to v0.36.4
• Update go-kure/.github digest to 3cfa256
• Track external-secrets by release, not raw gomod
• Update module github.com/cilium/cilium to v1.20.1
• Update go-kure/.github digest to d22e3cf
• Update go-kure/.github digest to 9260c00
• Update go-kure/.github digest to 0c93c6f
• Update go-kure/.github digest to d96e444
• Update module golang.org/x/crypto to v0.55.0 [security]
• Update dependency external-secrets/external-secrets to v2.10.0
• Update toolchain
• Update kubernetes to v0.37.0
• Update go-kure/.github digest to b3513ac
• Update dependency git-cliff to v2.14.1
• Update module github.com/cloudnative-pg/machinery to v0.6.0
• Update go-kure/.github digest to 48d8390
• Update module google.golang.org/grpc to v1.83.1 [security]
• Update dependency go to v1.26.8
• Update go-kure/.github digest to d392f39
• Update module golang.org/x/crypto to v0.56.0 [security]
• Update go-kure/.github digest to abcba39
• Update go-kure/.github digest to 022fde2
• Update module golang.org/x/mod to v0.40.0 [security]
• Update go-kure/.github digest to 7d126c7
• Update module github.com/cloudnative-pg/plugin-barman-cloud to v0.15.0
• Update sigs.k8s.io
• Update go-kure/.github digest to 3f72c03
• Update go-kure/.github digest to f76dc32
• Update go-kure/.github digest to 636e9f2
• Update go-kure/.github digest to d904eef
• Update go-kure/.github digest to 5e5c8e1
• Update module golang.org/x/vuln to v1.8.0
• Update module golang.org/x/tools to v0.50.0
• Update dependency hugo to v0.166.0
• Update go-kure/.github digest to 992e9ee
• Update go-kure/.github digest to 6990dea

CI

• Only save Go build cache from the default branch
• Syntax-check version-sync scripts; make dep-updates example version-neutral
• Drop the sensitive-file grep, which warned on every run and on cache keys

Changed

• Delete the hand-kept scope tables, derive every scope
• Hand out copies of the generated tables, not the tables

Dependencies

• Widen prometheus-operator supported range to 0.94

Documentation

• Add AI agent gates (A1-A7) section
• Correct PATH-ordering troubleshooting note for pinned golangci-lint
• Fix CNPG Monitoring example to match the real Cluster/ClusterOptions API
• Strengthen the GO-2026-5377 govulncheck waiver justification
• Document the release-pinned dependency pattern
• List the four new tool-version-parity go: filter entries
• Fix golangci-lint recovery instructions to cover all four synced files
• Document pkg/versions and its regeneration
• Add external-secrets example to pkg/versions README
• Sync pkg/versions README example with 1.37 supported_range
• Note VolumeMount comparability as a public-API breaking change
• Correct controller-runtime note for the k8s v0.37.0 MVS bump
• Explain strip-ack/rerun gotcha on pin-impact-ack
• Note the strip-ack rerun gotcha in the pin-impact-ack section
• Scope pin-impact-ack rerun gotcha to same-repo PRs
• Say the prune rewrites class-shaped error-returning helpers
• Document direct field assignment in generators
• Make every removal in the ledger findable and replaceable
• Correct the CreateIngressRule replacement note
• Fix six defects the post-undraft review found
• Describe widen as YAML-only, not two-file regeneration
• Document where scope and maturity come from
• Point at the compatibility matrix instead of restating a pin
• Document that SupportedRange/Min/Max move on every widen
• Fail CI when a page names a builder function that no longer exists
• Describe a domain model and layout engine on a thin Kubernetes foundation
• Record the builder-contract design and point the changelog at the ledger
• Require a reason on every suppressing doc-api-refs marker
• Resolve documented builders per package, and scan examples/
• Name the Prune default among ARCHITECTURE’s non-mechanical migrations
• Correct the cnpg config-builder error model
• Say which release-1 migrations are silent at the call site
• Close three more ways a stale builder reference resolves
• Link the contract by absolute URL from the unpublished design record
• Check Go doc comments and the ledger’s replacement column
• Scan block-form GoDoc, and route a new family’s import path
• Check root Markdown, and fix three stale contract claims
• Correct the sugar-class rationale and the scope-failure remedy
• Correct the new-kind recipe for cluster scope and the doc gate
• Finish the sugar-class correction across Go doc and the glossary
• Qualify the follow-up issue reference in the design record
• Record a fourth checker residual, the nested-comment marker
• Test the whole object in the new-kind recipe
• State the metadata exemption, and align the agent guidance
• Name the examples exclusion on the per-package coverage floor
• Scope the migration claim, and fix two recipe defects
• Separate the doc gate’s bar from the repository’s rule
• Record the unscanned agent-guidance file as a seventh residual
• Correct two overstatements on the concepts page
• Correct two claims about what this release changes
• State the xargs tolerance’s limit at the site
• The config builders did change what they emit
• Replace worked examples that call a nonexistent API
• Flag spec.selector as required, not cosmetic
• Add the CronJob rows to the required-value call-out
• Scope the CronJob restart-policy loss to who it hits
• Split the call-out into rejected vs silently different
• Stop citing the one row the section declines to judge
• Correct the workflow tables that claim CI runs make targets
• Record ci.yml’s real PR trigger types and its base-branch filter
• Resolve two self-contradictions this guide introduced
• Narrow the removal rationale to what was observed
• Fix four accuracy defects in the removal rationale
• Scope the removed step’s uninformative-output claim to its annotation
• State what the removed step did, not what it could never do
• Cut the deleted step’s autopsy down to what the page needs
• Fix the non-provider-patterns claim and the match-scope claim
• A supported pattern earns an alert, not necessarily a block
• Document the bootstrap namespace in the mapped guide
• Scope the DefaultNamespace claim to gotk mode
• Say where a widening’s compatibility assessment lives

Fixed

• Align golangci-lint pins and add a version assertion to lint
• Use the canonical golangci-lint install.sh URL
• Enforce pinned golangci-lint version instead of only printing it
• Don’t mask a failed golangci-lint install behind a piped shell
• Stop tracking .claude/settings.local.json
• Preserve go.mod perms and fail loudly on missing replace-block anchor
• Guard get_gomod_pin_comment against pipefail abort
• Fix cliff.toml allow-term pragma adjacency for the platform component label
• Require k8s.io/api replace directive for pin comment, not require fallback
• Harden ref: extraction against future ambiguity
• Peel annotated tags to their commit in sync-eso-pin.sh
• Verify upstream_release_commit live, document ESO breaking change
• Distinguish unreachable-server from tag-not-found in resolve_tag_commit
• Guard sync-eso-pin.sh’s ls-remote fallback under set -euo pipefail
• Gate CI on sync-eso-pin.sh changes, bound its network calls
• Correct link-check and syntax-check bugs from PR review
• Strip a possible v-prefix from the mise golangci-lint pin
• Widen syncer’s sed patterns to match the checker’s tolerance
• Add check-tool-versions to make precommit
• Keep govulncheck version docs in sync with ci.yml
• Anchor govulncheck doc-sync extraction, sync stale task descriptions
• Harden govulncheck doc checker against case and duplicate-pin risk
• Doc-sync gaps and CI_VAL whitespace trim for govulncheck checks
• Sed -i -E portability + CI-vs-precommit doc-sync gap
• Tolerate trailing whitespace on the ci.yml pin line
• Scope the govulncheck-docs rule to its own customManager
• Strip trailing whitespace from Makefile golangci-lint pin, document sync-tool-versions.sh
• Anchor barman-cloud to its MVS floor, range-check it
• Syntax-check the two new sync scripts; reject duplicate mise pins
• Sh-vs-bash syntax-check dispatch; tolerate mise.toml = spacing
• Tolerate TOML single-quote pins; align syncer’s mise parser with the checker
• Scope mise.toml pin matching to [tools]; guard syncer against duplicate pins; fix stale doc line
• Tolerate whitespace around the [tools] table header
• Recognize TOML quoted-key [tools] table headers
• Retain the generated pkg/versions Go API on bot branches
• Don’t leave a truncated versions_gen.go on generate_go_api’s guard failure
• Don’t clobber validate_go_api_drift’s RETURN trap in generate_go_api
• Keep generated versions_gen.go world-readable (mktemp default is 0600)
• Close cross-device mv and multiline-value gaps in generate_go_api
• Guard go mod edit|yq pipe assignment under set -e
• Distinguish tool-pipe failure from confirmed missing requirement
• Apply GOWORK=off to sync-versions.sh’s step-4 go mod edit call
• Bound and root-anchor the MVS-floor guard’s go list probe
• Harden sync-versions.sh/vendor-guard.sh against missing timeout/mktemp
• Strengthen case 37’s mktemp-guard oracle and correct case 09 doc wording
• Harden mktemp helper and correct harness docs (round 3 review)
• Fail closed on action.yml steps outside the scripts/*.sh pattern
• Stop the pin-impact gate silently swallowing its own exit code
• Guard –old/–new argument parsing and non-ahead compares
• Add pin-impact-ack override, harden multi-step/dot-segment gaps
• Recognize uses:/run: written as the step’s first YAML key
• Rerun pin-impact on label change, detect compound-line source
• Scan .yaml workflows too, reject mixed deps in one run block
• Bind pin-impact-ack to the reviewed head SHA
• Skip label mutation on fork PRs, fix token auth, use immutable base SHA
• Fail closed on ack-strip failure, cover reopened PRs, tighten perms
• Re-sync external-secrets pin and widen supported_range to 2.10
• Sync CI/docs yq pins with mise.toml’s 4.53.6 bump
• Sync mise.toml’s own yq comment with the 4.53.6 bump
• Widen k8s supported_range to 1.37, fix VolumeMount comparability
• Wire go.mod’s go directive into the mise-sync postUpgradeTasks
• Sync versions.yaml’s go.current too, and reorder before generate
• Syntax-check sync-go-version.sh in CI, document its path filter, anchor its go.mod sed
• Drop dead self-substitution sed, harden go.mod directive sync
• Widen go-version postUpgradeTasks fileFilters to every workflow file
• Chain sync-versions.sh generate into make sync-go-version
• Mark GoVersion as doc-gate:trivial; trim README’s hardcoded examples
• Scope the rerun-gotcha warning to synchronize/reopened reruns
• Close admission gaps, catch orphaned generated files, sync package docs
• Align the admission classifier with ADR-038 and harden the generator
• Tie class (a) to a field and trace nil through literals and initialised locals
• Root admission field writes in a parameter and order local write-backs
• Track admission provenance by object and position, not by name
• Reject result-bearing helpers in the admission test
• Build generator errors with pkg/errors
• Let generate rewrite a rendered file that lost its header
• Reject a default written next to an admitted operation
• Require caller-supplied values and reject silent nil returns
• Close two admission classifier evasions
• Drop the orphaned PVC options struct, restore a nil guard
• Make bootstrap sourceRef name the source it emits
• Stop bootstrap panicking on a nil root node
• Stop range-checking MVS-floor dependencies, add widen subcommand
• Address Codex review findings on the widen subcommand
• Guard widen against a bare –note flag and unchecked yq writes
• Address Codex third-pass review on the widen test cases
• Reject a raw commit SHA in widen’s –note before writing
• Replace mm_key’s collision-prone fixed-multiplier key with mm_cmp
• Compare version components as digit strings, not bash arithmetic
• Make the marker-coverage check able to fail, and record what it found
• Resolve an unmarked kind’s scope from the CRD its module ships
• Refuse a half-read CRD manifest, and skip json:"-" fields
• Match the version in KindFor, and cover the table lookups
• Decide the docs root on the resolved path, not the spelling
• Read a field’s stability from its own words, not its neighbours'
• Regenerate the API tables on an external-secrets re-pin
• Claim stability only where the prose claims it, and keep IsNamespacedBuiltinKind about built-ins
• Let a supplied CRD govern the scope of a custom resource
• Widen cnpg-barman-cloud-plugin and controller-runtime ranges
• Close six ways the builder-reference check could pass wrongly
• Fail the builder-reference check when its page list is incomplete
• Scope the ledger exemption to the names it removed
• License the ledger’s names from a validated list, not its cells
• Widen the page set, reject nested fences, drop a hand-kept count
• Reject repeated fence markers; correct two ARCHITECTURE claims
• Stop a no-match xargs batch from killing the symbol scan
• Group breaking commits under their own section
• Match git-cliff’s parsed breaking field, not the subject
• Size the test budget for the slowest package, not a typical one
• Honour DefaultNamespace in the gotk components

Maintenance

• Drop stale ready_for_review from pr-review workflow
• Read yq and lychee versions from mise.toml at run time
• Bump go-kure/.github pin to post-#136 main
• Regenerate builder tables for plugin-barman-cloud v0.15.0
• Regenerate builder tables for sigs.k8s.io bump

Testing

• Drop TestGetKubernetes’s Min!=Max assertion, redundant and brittle
• Add hermetic failure-path harness for sync-versions.sh guards
• Make the sync-versions guard case 23 able to fail
• Fix docs-drift masking in mvs-floor/range/notes guard cases, scope case-32’s sed, add mise yq pin, sync ci docs
• Clear ambient GOWORK in harness runner, make fixture edits BSD-sed portable
• Harden guard-test harness against mktemp failure and missing seq; wire into make precommit
• Fix full-scope confirm-pass findings (mktemp in _run, seq in cases 21/22, ci coverage, case-09 flakiness)
• Give the self-reference test a deadline it can fail on
• Fail rather than panic when a table round trip loses rows
• Assert the gate copy-out on names, not on a count that cannot move

[0.2.0-beta.10] - 2026-08-23

Added

• Add release-identity RenderOption to RenderChart (the downstream operator#378)

Build

• Bump Go to 1.26.6 for stdlib CVE fixes
• Migrate dependency updates from Dependabot to Renovate

CI

• Re-trigger CI when a draft PR is marked ready for review
• Group the fluxcd ecosystem and fail check on stale compatibility docs
• Run the version guards for version-metadata-only PRs
• Add merge_group trigger to pr-review.yml
• Run checks + AI review on draft PRs (GitLab mr-review parity)
• Bump govulncheck to v1.7.0
• Reword the govulncheck pin comment to drop downstream names
• Remove the dead GitHub->GitLab mirror job

Changed

• Keep Helm’s ReleaseOptions out of the public RenderOption type

Dependencies

• Group the cloudnative-pg modules
• Bump helm.sh/helm/v4 from 4.2.3 to 4.2.4
• Bump github.com/prometheus-operator/prometheus-operator/pkg/apis/monitoring

Documentation

• Track cilium in versions.yaml with a 1.18 floor
• Document the doc-sync composite actions in docs-build/docs-check
• Qualify draft-review claim on rollout dependency (codex confirm-round, wording)
• Correct the documented coverage thresholds
• Correct the go.work ignore rationale
• Regenerate compatibility.md for prometheus-operator 0.93.1

Fixed

• Consume canonical doc-sync scripts from go-kure/.github
• Fix build.sh’s own dangling reference to the vendored script
• Block CI on reachable vulnerabilities
• Pin the govulncheck-gate ref; refresh the stale check-action-pins pin
• Address govulncheck-gate review findings on the security job
• Reword the GitLab-parity note to avoid the downstream repo name
• Keep ready_for_review in pr-review caller (A6 finding)
• Make CI safety checks signal correctly
• Reject invalid coverage profiles

Maintenance

• Pin third-party actions to commit SHAs
• Pin first-party composite actions to a commit SHA
• Bump tj-actions/changed-files in the actions group
• Git-ignore go.work and go.work.sum
• Enforce downstream-reference policy

Testing

• Temporary reproducer proving the vulnerability gate blocks

[0.2.0-beta.9] - 2026-08-03

Breaking

• Bump prometheus-operator monitoring API to v0.93.0

Dependencies

• Bump cilium 1.20.0, plugin-barman-cloud 0.14.0, cert-manager 1.21.1

Fixed

• Align unmapped-package message with the documented convention
• Drop the lychee invocation change, keep the Requires note
• Correct ResourceSet assertions so the package compiles

Maintenance

• Bump actions/setup-go from 6 to 7 in the actions group

[0.2.0-beta.8] - 2026-08-03

Dependencies

• Bump oras.land/oras-go/v2 from 2.6.1 to 2.6.2
• Bump google.golang.org/grpc from 1.81.1 to 1.82.1
• Bump Flux ecosystem, cilium, gateway-api and k8s.io to v0.36.3

[0.2.0-beta.7] - 2026-07-13

Added

• Add prerelease bump scope

Dependencies

• Bump github.com/prometheus-operator/prometheus-operator/pkg/apis/monitoring
• Bump helm.sh/helm/v4 from 4.2.2 to 4.2.3
• Bump fluxcd ecosystem to 2.9.1 / controllers 1.9.2
• Bump cert-manager 1.21, gateway-api 1.6, cnpg 1.30

Fixed

• Run tag-collision checks in preview + guard next dev version
• Resolve section-nav links under the version slot
• Make README cross-package links root-absolute

Maintenance

• Bump Go to 1.26.5

Performance

• Source-aware Go build cache, split by job purpose

[0.2.0-beta.6] - 2026-07-01

Added

• Single-source docs map with blocking sync enforcement
• Enforce link integrity + docs-with-code gate; agentic cascade
• Adopt Flux 2.9 API set (#607)

CI

• Cap govulncheck memory with GOMEMLIMIT to avoid runner OOM

Dependencies

• Bump go.universe.tf/metallb from 0.16.0 to 0.16.1
• Sync metallb 0.16.1 in versions.yaml and compatibility docs
• Bump github.com/backube/volsync from 0.15.0 to 0.16.0
• Bump github.com/cloudnative-pg/plugin-barman-cloud
• Widen cnpg-barman-cloud supported_range to 0.13
• Bump github.com/cert-manager/cert-manager
• Bump flux-operator to v0.53.0 + re-vendor install bundle
• Bump prometheus-operator to 0.92 + widen supported_range
• Bump github.com/cilium/cilium from 1.19.4 to 1.19.5

Documentation

• Remove stale references to removed generators package
• Correct backend to claude-max-proxy:3456
• Drop hardcoded versions from the illustrative example

Fixed

• Harden check-doc-sync; adopt canonical validator
• Derive build versions from go.mod, guard supported_range (#593)

Maintenance

• Bump codecov/codecov-action from 6 to 7 in the actions group
• Bump the actions group across 1 directory with 2 updates

[0.2.0-beta.5] - 2026-06-03

Added

• Add shared CRD/scope classifier

CI

• Add merge_group trigger and harden change detection for merge queue

Dependencies

• Bump github.com/cloudnative-pg/machinery

Maintenance

• Remove rebase-check job and auto-rebase workflow

[0.2.0-beta.4] - 2026-06-02

Fixed

• Collapse cluster-name double-nesting when ClusterName == root node name

Maintenance

• Set dependabot rebase-strategy to auto

[0.2.0-beta.3] - 2026-05-28

Breaking

• Add FluxIntegratedPerBundle placement mode

Fixed

• Gate umbrella-child augmenter CRs by per-bundle mode

[0.2.0-beta.2] - 2026-05-28

CI

• Redesign release workflows — Create/Promote/Bump/Publish
• Raise coverage threshold to 90%, document targets in AGENTS.md
• Enforce per-package 90% coverage gate; fix smoke-test assertion

Documentation

• Remove deprecated kurel/CLI content from docs site
• Rewrite homepage with improved UX and structure
• Remove stale generator registry references

Fixed

• Emit CRs for augmenter-added sub-layouts of umbrella children
• Correct broken and wrong API examples across package docs
• Add missing SetKustomizationPrune to quickstart example
• Improve error messages and docs accuracy in release tooling

Maintenance

• Remove pkg/stack/generators and ApplicationWrapper
• Tidy go.mod after removing pkg/stack/generators

Testing

• Cover WorkflowEngine delegation methods, EngineWithConfig, init factory, GetName/GetVersion
• Cover RenewBefore setter, Issuer/ClusterIssuer annotations, sealed interface markers
• Cover init factory invocation and CreateLayoutWithResources branches
• Cover generateValues and processExtension via GeneratePackageFiles
• Table-driven validation tests covering validateResourceSource, Dependency, ValuesConfig, Extension, Patch
• Filesystem-backed tests for gatherResourcesFromSource and generateKurelYAML
• Raise coverage from 83.1% to 90.2%
• Cover renderOCI error path, renderHTTP error paths, corrupt archive
• Cover MarshalKustomization and SetPodSpec
• Cover gap functions to reach 95% total coverage

[0.2.0-beta.1] - 2026-05-27

Breaking

• Rules.FluxPlacement is the sole controller of placement

[0.2.0-beta.0] - 2026-05-27

Added

• Add DependsOn field to ManifestLayout
• Add createKustomizationForLayout to ResourceGenerator
• Emit Flux CRs for augmenter-added child layouts in FluxIntegrated mode
• Add validateSourceRefsForFluxIntegrated
• Call validateSourceRefsForFluxIntegrated in CreateLayoutWithResources

Dependencies

• Bump Flux 2.8.8 and MetalLB 0.16.0 (coordinated batch)

Documentation

• Document augmenter child layout Flux CR generation, DependsOn, and naming constraint
• Document early SourceRef validation in FluxIntegrated mode

Fixed

• Skip duplicate kustomization.yaml entries for FluxIntegrated children
• Recurse into grandchildren even when direct child already has a CR

Testing

• End-to-end tests for augmenter child layout CR generation
• Add SourceRef to existing FluxIntegrated fixtures
• White-box unit tests for validateSourceRefsForFluxIntegrated
• Integration tests for SourceRef validation wiring in CreateLayoutWithResources

[0.2.0-alpha.10] - 2026-05-26

Added

• App-scoped augmentation in nodeOnly and cluster-name paths
• App-scoped augmentation in WalkClusterByPackage nodeOnly path

[0.2.0-alpha.9] - 2026-05-24

Fixed

• Raise default reconciliation interval to 60m

Testing

• Update default interval assertions to 60m

[0.2.0-alpha.8] - 2026-05-21

Fixed

• Skip NOTES.txt in assembleManifests

[0.2.0-alpha.7] - 2026-05-21

Fixed

• Cliff.toml skips release-bot commits; group chore as Maintenance; add alpha.6 CHANGELOG section

[0.2.0-alpha.6] - 2026-05-21

Maintenance

• Add goreleaser config for library-only release

[0.2.0-alpha.5] - 2026-05-21

Added

• Add GitRepository setter gaps
• Add Kustomization setter gaps
• Add HelmRelease Install/Upgrade flag setters
• Add ExternalArtifact builder
• Add ArtifactGenerator builder (source-watcher)
• Add NamedDependsOn to Bundle for name-based kustomization chaining
• Add SplitByHookWeight utility for helm hook-phase ordering
• Add SetHelmReleaseValuesFromMap; add HelmRelease golden test
• Extend RenderChart to support HTTP Helm repositories

Changed

• Remove CLI layer (cmd/, pkg/cmd/, pkg/cli/)

Dependencies

• Upgrade flux-operator to v0.48.0
• Bump sigs.k8s.io/controller-runtime
• Bump github.com/cilium/cilium from 1.19.3 to 1.19.4
• Bump github.com/google/cel-go from 0.28.0 to 0.28.1

Documentation

• Update README for new CRDs and setter coverage
• Add Organization Resources section referencing go-kure/.github
• Replace oci-layout.md with redirect to go-kure/.github
• Mark generators deprecated and pkg/patch moved to launcher
• Remove stale pkg/patch references from ARCHITECTURE.md
• Document HTTP RenderChart as public-only; explain Helm v4.2.0 bump

Fixed

• Address PR review findings — stale site content and doc cleanup
• Bump cnpg from 1.29.0 to 1.29.1 (CVE-2026-44477)
• Bump prometheus-operator from 0.90.1 to 0.91.0
• Upgrade FluxCD ecosystem to v2.8.7 (CVE-2026-45022)
• Remove SetHelmReleaseValuesFromMap from README (not yet added); fix sourcev1 import in guide
• Pre-release review — deepCopyBundle missing fields, renderHTTP guard, coverage gaps, docs

Maintenance

• Tidy go.sum
• Update controller-runtime to 0.24.1 in versions.yaml
• Regenerate compatibility.md for controller-runtime 0.24.1

Testing

• Add HelmRepository golden tests; rewrite pkg/kubernetes/fluxcd README for current API

[0.2.0-alpha.4] - 2026-05-11

Breaking

• Nil-receiver setters panic instead of returning error
• Migrate CRD subpackage constructors to CreateX pattern

Added

• Add actions:read permission to release-create workflow

CI

• Route cache through in-cluster server, rename runner label
• Explicitly set ACTIONS_CACHE_URL in workflow env to override job dispatch
• Drop go build cache, use gomod- key prefix, bump test timeout
• Restore build cache, fix Hugo cache, fix govulncheck, cache tools
• Fix govulncheck blocking on findings, fix codecov file input
• Increase test job timeout from 10 min to 20 min
• Remove ineffective ACTIONS_CACHE_URL env vars, document cache routing
• Make artifact upload/download resilient on ARC runners
• Set ACTIONS_RESULTS_URL at workflow level for step env routing
• Stable gobuild cache key and expand workflow path filter

Documentation

• Bump Go version to 1.26.3 in github-workflows.md

Fixed

• Remove deprecated SetServiceLoadBalancerIP
• Propagate SetNestedField errors
• Complete migration by removing all stale internal package imports

Maintenance

• Bump Go 1.26.2 → 1.26.3 for stdlib security fixes

Testing

• Add missing tests for CRD subpackage setters
• Suppress staticcheck SA1019 on intentional deprecated field usage

[0.2.0-alpha.3] - 2026-05-06

Added

• Promote ConfigMap builder to public API
• Add granular setters for RefreshInterval, Target, DataFrom
• Expose GenerateFluxInstance as public method
• Add Pooler builder
• Add CreateVolumeClaimTemplate helper for StatefulSet embedding
• Add public Namespace builder with PSA label support
• Add Type field to HelmRepositoryConfig for OCI registries
• Extend HelmReleaseConfig with chartRef, valuesFrom, and remediation fields closes #496
• Extend builders for infra component use cases
• Add CiliumNetworkPolicy, CiliumClusterwideNetworkPolicy, and CiliumCIDRGroup builders
• Add builders for remaining stable Cilium CRDs (#514)

Changed

• Wrap PgBouncerSpec in domain PgBouncerOptions

Documentation

• Add the downstream operator state analysis review (2026-05-06)
• Note that GenerateFluxInstance does not check config.Enabled
• Add Namespace builder section to README
• Add OCI HelmRepository example to README
• Fix variable name collision in README OCI example
• Update README with 10 new CRD builders

Fixed

• Remove dead variable and fix README ptr usage in HelmRelease tests
• Address review findings on #499 builders
• Address review findings on #501 builders
• Add EnableDefaultDeny setters for CNP and CCNP

Testing

• Add default label/annotation assertions in TestCreateConfigMap

[0.2.0-alpha.2] - 2026-05-05

Added

• Add domain config types for Cluster, Database, and ObjectStore

Fixed

• Use kure errors package instead of fmt.Errorf

Maintenance

• Fix gofmt alignment in cnpg types

[0.2.0-alpha.1] - 2026-05-04

Added

• Add configMapGenerator support to ManifestLayout
• Add ReplicationSource and ReplicationDestination builders
• Add LayoutRules.FlattenSingleTier opt-in flag

CI

• Fix build-binaries timeout and remove make dependency
• Remove make dependency from docs-build job
• Skip apt-get in test job when build-essential already installed

Dependencies

• Bump FluxCD ecosystem to v2.8.6 and cnpg/barman-cloud to 0.5.1
• Bump sigs.k8s.io/controller-runtime from 0.23.3 to 0.24.0
• Pin k8s.io to v0.36.0 to match controller-runtime v0.24.0
• Update versions.yaml for controller-runtime 0.24.0 and k8s 0.36.0

Documentation

• Fix stale references to deleted stack/v1alpha1 and generator aliases
• Fix remaining stale references after stack/v1alpha1 removal

Fixed

• Use kustomize.config.k8s.io domain in generated kustomization.yaml

Maintenance

• Bump dorny/paths-filter from v3 to v4
• Refactor builders to sealed-interface idiom
• Remove pkg/stack/v1alpha1 and deprecated generator aliases

[0.2.0-alpha.0] - 2026-05-01

Added

• Move kure docs site to /kure/ subpath

Build

• Remove kurel and extracted packages from build and docs

CI

• Trigger Claude Code action automatically on PRs
• Replace shared workflows with callers to go-kure/.github
• Optimize pipeline — parallel jobs, single test run, Hugo cache, path filtering
• Cancel in-progress runs when new push arrives on same branch

Fixed

• Handle large PR diffs in review workflow, fix formatting, update docs
• Set skipped output before early exits in pr-review workflow
• Add test to build gate needs to catch skipped cascade on failure
• Guard against empty Hugo version parse from mise.toml
• Add validate to build gate needs so lint failure blocks merge
• Sync hugo.toml mounts and check-mounts after package extraction
• Guard against empty Hugo version read
• Repair 5 broken links on deployed docs site
• Support unnamed root node — merge resources at cluster root

Maintenance

• Extract pkg/launcher, pkg/patch, cmd/kurel, pkg/cmd/kurel to go-kure/launcher

Testing

• Add missing tests for Patches/PostBuild and stable helm output
• Add OCI layout pattern tests (Namespace:"."/layer naming/3-layer structure)
• Assert spec.path and sourceRef in Layer 2 Kustomization tests

[0.1.0-rc.11] - 2026-04-20

Added

• Add public pkg/kubernetes/cnpg wrapper

Dependencies

• Bump github.com/moby/spdystream from 0.5.0 to 0.5.1
• Bump github.com/cloudnative-pg/machinery
• Bump github.com/cloudnative-pg/plugin-barman-cloud

Documentation

• Add internal design note for launcher extraction
• Correct patch.go treatment in launcher extraction design
• Document OCI folder layout and split strategy design
• Rename infra to platform in OCI layout design doc
• Register oci-layout.md in docs site scripts

Maintenance

• Update issue template labels to post-rename names
• Update versions.yaml for plugin-barman-cloud 0.12.0

[0.1.0-rc.10] - 2026-04-15

Added

• Add builders for Role, RoleBinding, ClusterRole, ClusterRoleBinding

[0.1.0-rc.9] - 2026-04-15

Added

• Add Patches and PostBuild fields to Bundle
• Add Force and Suspend fields to Bundle

Dependencies

• Bump github.com/cert-manager/cert-manager

Maintenance

• Update versions.yaml for cert-manager v1.20.2

[0.1.0-rc.8] - 2026-04-14

Added

• Add RenderChart for client-side OCI chart rendering

Dependencies

• Bump github.com/google/cel-go from 0.27.0 to 0.28.0

Documentation

• Document undocumented features across package READMEs and guides
• Add prometheus-builders API reference page and fix broken links

Fixed

• Sort manifest keys for stable output

[0.1.0-rc.7] - 2026-04-12

Fixed

• Honor FileNaming in WriteToDisk, WriteManifest, and package walker

[0.1.0-rc.6] - 2026-04-12

Added

• Propagate FileNaming to ManifestLayout and WriteToTar

Fixed

• Force FilePerResource for FluxIntegrated kustomization refs

[0.1.0-rc.5] - 2026-04-11

Added

• Emit full Flux Operator install bundle in flux-operator mode

[0.1.0-rc.4] - 2026-04-10

Added

• Add Bundle.Children + shared cluster validator
• Wire ValidateCluster into all entry points
• Umbrella Kustomization spec generation
• Umbrella layout walker + integrated placement + v1alpha1 parity
• Add umbrella cluster demo and fix writer CR duplication

Dependencies

• Bump github.com/fluxcd/flux2/v2 from 2.8.2 to 2.8.3
• Bump github.com/cert-manager/cert-manager
• Bump github.com/prometheus-operator/prometheus-operator/pkg/apis/monitoring
• Bump github.com/cloudnative-pg/cloudnative-pg
• Bump github.com/fluxcd/flux2/v2 from 2.8.2 to 2.8.3

Fixed

• Bump Go to 1.26.2 for stdlib security fixes
• Switch to claude-max-proxy
• Nest child nodes under root node layout when ClusterName is set

Maintenance

• Bump codecov/codecov-action from 5 to 6 in the actions group
• Add mise tasks for versions:check and versions:generate
• Update versions.yaml for fluxcd 2.8.5

Testing

• Move gotk network tests to integration, use flux-operator in workflow test

[0.1.0-rc.3] - 2026-03-22

Added

• Upgrade cert-manager v1.19.4 → v1.20.0
• Add PSAViolationError with field paths

Dependencies

• Bundle dependency updates

Documentation

• Update lint job timeout from 10 to 15 minutes

Fixed

• Map dependency-updates.md to docs site
• Increase lint job timeout to 15 minutes
• Resolve broken links on versioned doc subsites
• Disable setup-go built-in cache to prevent double-caching
• Resolve broken dependency-updates link on contributing guide page

[0.1.0-rc.2] - 2026-03-20

Added

• Dynamic version notice on homepage

CI

• Run all GitHub Actions on self-hosted runner

Changed

• Reorganize examples/ with demo/ grouping and READMEs

Documentation

• Update CI docs and changelog for isDeepEmpty fix

Fixed

• Patch pipeline bugs and update demo examples to AppWorkload format
• Correct containerport typo to containerPort in example YAMLs
• Pin yq version and cache Hugo modules in CI
• Add fallback for COMMIT_SHA in gen-versions-toml.sh
• Install missing tools on self-hosted runner in CI workflows
• Run apt-get update before installing make in CI workflows
• Install gcc and enable CGO for race tests on self-hosted runner
• Remove gotestfmt from unit test step to fix self-hosted runner
• Install build-essential to provide C headers for CGO
• Strip zero-value primitives in isDeepEmpty
• Add nil and []any handling to isDeepEmpty
• Install goimports before formatting check
• Increase lint timeout and scope cache to modules only
• Gate release on pre-release tests and fix CGO_ENABLED

Maintenance

• Revert unrelated settings.json changes from ci/selfhosted-runners

[0.1.0-rc.0] - 2026-03-09

Changed

• Simplify Bundle.Generate() label propagation
• Standardize CRD builders to void returns
• Standardize ConfigMap and Secret builders to void returns
• Standardize validation strategy with void returns

Dependencies

• Bump github.com/prometheus-operator/prometheus-operator/pkg/apis/monitoring
• Bump sigs.k8s.io/gateway-api from 1.4.0 to 1.5.0

Fixed

• Simplify SetSecretImmutable and remove unnecessary Immutable pre-allocation

Maintenance

• Sync versions.yaml for prometheus-operator v0.89.0
• Sync versions.yaml for gateway-api v1.5.0

Testing

• Add golden file tests for InitContainer builders

[0.1.0-beta.7] - 2026-03-08

Added

• Add public facade package
• Add public facade package
• Add public facade package
• Support flat root output with NodeGrouping=GroupFlat (#240)
• Add configurable layout presets (#263)
• Add NetworkPolicy and HTTPRoute builders (#242)
• Add PSA security context helpers (#243)
• Add Prometheus operator builders (#354)
• Add ResourceRequirements builder (#244)
• Add {kind}-{name}.yaml file naming pattern (#266)
• Set FileNamingKindName in centralized preset LayoutRules
• Add SourceKind field to BootstrapConfig (#254)
• Implement regex pattern validation in schema
• Add configurable kustomization mode per FluxPlacement (#265)
• Add Flux 2.8 remediation and wait strategy builders (#255)
• Promote flux-operator to primary bootstrap mode (#256)
• Add remediation config to ReleaseConfig (#236)

Documentation

• Add package README
• Add metallb to AGENTS.md reverse mapping table
• Fix version mismatches and outdated references across documentation
• Add godoc comments to namespace builder functions
• Document Provider/Alert v1beta3 blocked state (#250)
• Document k8s.io replace directives in go.mod (#291)

Fixed

• Add missing types.go, doc.go, tests and SetClusterIssuerCA
• Skip empty ACME solvers, make ACME and CA mutually exclusive
• Append GOPATH/bin to PATH instead of prepending in Makefile
• Use predefined nil error constants in metallb builders
• Use pkg/errors instead of fmt.Errorf in patch package
• Check FluxPlacement in WriteToDisk and WriteToTar (#264)
• Centralize error sentinels and add documentation
• Avoid slice mutation and validate ephemeral containers in PSA
• Use centralized sentinel errors and add missing Prometheus helpers
• Remove trailing blank line in bootstrap generator test

Maintenance

• Explicitly enable unused linter (#288)
• Document gosimple inclusion via staticcheck (#290)
• Align golangci-lint config with the downstream operator linter set (#293)

Testing

• Add comprehensive tests for public facade
• Add tests and docs for externalsecrets facade

[0.1.0-beta.6] - 2026-03-06

Added

• Add strategic merge patch support with namespace-aware target resolution
• Add HelmRelease targetNamespace and releaseName fields
• Expose valuesFrom in FluxHelm ReleaseConfig
• Add PostRenderer Kustomize builder helpers
• Add CRD lifecycle policy fields to ReleaseConfig
• Add chartRef support to FluxHelm generator (#267)
• Allow SourceRefName override in FluxHelm generator
• Support prune protection annotation on generated resources
• Add DriftDetection builder helpers for HelmRelease
• Add HealthChecks field to Bundle
• Add mise release task with dry-run trigger wrapper
• Promote internal/gvk to pkg/gvk
• Promote 7 internal K8s builders to public API
• Add CNPG Database CR builder
• Add CNPG ObjectStore CR builder
• Add CNPG ScheduledBackup plugin method and advanced knobs
• Enable gosec linter with fixes for all violations
• Add CNPG managed roles builder

Build

• Add gen-versions-toml.sh for Hugo config overlay
• Use versioned config overlay in docs-build
• Rework deploy-docs for multi-version deployment
• Trigger versioned docs deployment on stable release
• Add manage-docs admin workflow
• Migrate golangci-lint from v1 to v2
• Upgrade to Go 1.26.0
• Remove accidentally committed temp file
• Upgrade k8s.io dependencies to v0.35.1 (Kubernetes 1.35)
• Update versions.yaml for k8s 1.35 upgrade
• Remove broken k8s-compat CI job
• Upgrade cert-manager to v1.19.4 and metallb to v0.15.3
• Upgrade external-secrets to v1.3.2 (module path migration)

Changed

• Replace any with typed parameters in Workflow interface

Dependencies

• Upgrade FluxCD ecosystem to 2.8
• Bump sigs.k8s.io/controller-runtime

Documentation

• Update branch protection docs to reflect ruleset migration
• Add version-aware banner and header display
• Add pkg.go.dev reference links to package READMEs
• Document versioned docs system in github-workflows.md
• Add 2026-02-26 deep code review
• Add action plan, issue specs, and implementation design
• Clarify AGENTS.md fmt.Errorf guidance
• Add example_test.go for CRD builder packages
• Document deepCopyBundle shallow copy behavior
• Document Cluster getter/setter duality
• Add getting-started example for Cluster-to-Disk pipeline

Fixed

• Add release notes extraction to release workflow
• Use tab-indented code block for YAML example in doc comment
• Guard unstructured fallback from list decode panics
• Release read lock before invoking converter callback
• Fix CI lint baseline and resolve pre-existing lint issues
• Resolve 30+ broken links on gokure.dev
• Use json.Marshal for HelmRelease values encoding
• Exclude docs/development/ from unmapped docs check
• Replace gh CLI with curl in pr-review workflow
• Address AI review findings on pr-review workflow
• Enforce ChartRef validation and mutual exclusivity
• Check remote tags before releasing
• Use pkg/errors and pkg/logger in getting-started example
• Use ToClientObject helper instead of manual pointer-to-interface
• Isolate TestEnsureConfigDir from host environment
• Harden release-trigger.sh remote detection and hint output
• Remove curl|sh auto-install from lint-fast target
• Strip v prefix from pseudo-version in versions.yaml
• Add deprecation markers and update DESIGN.md references
• Add timeline notification comments for PR review updates
• Replace gh CLI with curl for timeline notice comments
• Add Content-Type header to timeline notice API calls
• Replace sticky comments with regular PR comments
• Sync controller-runtime version to 0.23.3 in versions.yaml
• Align pr-review workflow with GitLab mr-review template
• Correct yq pipe precedence in max_dependabot filter
• Migrate cosign signing to v3 bundle format
• Bump Go to 1.26.1 (security patch)
• Remove output flag and use sigstore.json extension for cosign v3
• Add release-notes.md to .gitignore

Maintenance

• Bump the actions group with 2 updates
• Align golangci-lint config with the downstream operator standard
• Replace generic code review with two-pass PR review workflow
• Bump the actions group with 3 updates
• Add CNPG to versions.yaml and dependency governance
• Update versions.yaml for completed dependency upgrades
• Update PR review model to gpt-5.4

Performance

• Add lint-fast Makefile target

Testing

• Improve test coverage from 78% to 88%

Pr-review

• Fix broken pipe and stale assessment comment

[0.1.0-beta.0] - 2026-02-17

Added

• Expose HPA helpers in pkg/kubernetes
• Expose PDB helpers in pkg/kubernetes
• Add deterministic YAML serialization option
• Expose Deployment, Service, Ingress helpers in pkg/kubernetes
• Expose CronJob helpers in pkg/kubernetes
• Add optional Validator interface for ApplicationConfig
• Add unstructured fallback for unknown GVKs
• Implement Generate() for stack pipeline integration
• Add comprehensive server-set field stripping (#196)
• Add kure init scaffolding command (#136)
• Rewrite fluent builders with immutable copy semantics (#139)
• Migrate release automation from semver.sh to CI-driven release.sh

Changed

• Consolidate generator registries into pkg/stack (#179)

Dependencies

• Bump sigs.k8s.io/kustomize/api in the k8s-ecosystem group

Documentation

• Add implementation workflow checklist
• Document ApplicationConfig breaking change (#178)

[0.1.0-alpha.3] - 2026-02-12

Documentation

• Add changelog entry for v0.1.0-alpha.3

Fixed

• Install syft in release workflow for SBOM generation

[0.1.0-alpha.2] - 2026-02-12

Added

• Deterministic kustomization.yaml ordering
• Add missing Bundle fields (Prune, Wait, Timeout, etc.)
• Clean YAML output in EncodeObjectsToYAML by default
• Implement createSource() for OCIRepository/GitRepository
• Add WriteToTar(io.Writer) for in-memory layout generation
• Propagate Bundle.Labels to all generated resources
• Rename CI job names to match branch protection check names
• Add Hugo documentation site with CI/CD and mise tasks
• Add auto-rebase workflow and rebase-check job

Build

• Improve release workflow security and reproducibility

CI

• Add GitLab mirror push after all checks pass
• Add divergence detection and tag sync to GitLab mirror

Dependencies

• Bump github.com/google/cel-go from 0.26.1 to 0.27.0

Documentation

• Archive completed PLAN.md to docs/history/
• Streamline README as landing page with badges
• Use shields.io badge for Go Report Card
• Restructure site around user needs with code-synced READMEs

Fixed

• Use git-cliff for changelog generation in release script
• Bump Go 1.24.12 → 1.24.13, add govulncheck summary to CI
• Use path-based matching in findLayoutNode()
• Anchor GO_VERSION patterns to avoid matching HUGO_VERSION
• Add rollup build gate job to satisfy branch protection check

Maintenance

• Use individual usernames in CODEOWNERS

[0.1.0-alpha.1] - 2026-01-30

Fixed

• Run tests directly in release workflow instead of checking CI status

[0.1.0-alpha.0] - 2026-01-30

Added

• Add storageclass helpers
• Add kustomize helpers
• Add flux source helpers
• Add helpers
• Add fluxcd builders package
• Add layout grouping and app file mode
• Support file- and dir-per-application layouts
• Implement OCI artifact separation in layout system
• Implement GitOps bootstrap and refactor demo system to data-driven architecture
• Implement comprehensive Kubernetes printer wrappers in io module
• Modernize error handling with custom error types and standardization
• Implement professional Cobra CLI with comprehensive command structure
• Implement comprehensive structured error handling system
• Add shorthand flags for common CLI options across all commands
• Complete kurel package system design documentation
• Implement package loader with hybrid error handling
• Implement variable resolver with cycle detection
• Implement patch processor with dependency resolution
• Implement schema generation and validation for launcher
• Complete Phase 4 - schema generation and validation
• Complete Phase 5 - output builder and local extensions
• Implement Phase 6 - CLI command integration
• Implement Phase 7 - comprehensive integration tests
• Implement GVK-based ApplicationConfig generator system
• Implement GVK-based versioning for stack module structs
• Implement GVK-based versioning for stack module structs
• Add comprehensive Makefile and CI/CD pipeline
• Complete KurelPackage generator implementation
• Enable Kubernetes schema inclusion in kurel CLI
• Implement fluent builder pattern Phase 1
• Implement comprehensive interval validation for GitOps configurations
• Add Go version management tools
• Add fast precommit target for git hooks
• Add PodDisruptionBudget builder
• Add HorizontalPodAutoscaler builder
• Add combined-output mode to kure patch
• Add –diff option to kure patch

Build

• Update Go to 1.24.12 to fix govulncheck vulnerabilities
• Automate changelog generation with git-cliff

CI

• Add GitHub Action to refresh Go proxy on main branch commits
• Enforce Go version consistency in PR checks
• Remove Qodana workflow due to licensing issues
• Fix security scan action to use official gosec action
• Remove gosec security scan (CodeQL provides coverage)

Changed

• Loop over YAML prints
• Split appsets module
• Export ApplyPatch
• Register k8s schemes on demand
• Move pkg/layout to pkg/stack/layout for better organization
• Move pkg/fluxcd to pkg/k8s/fluxcd for better organization
• Yaml dir naming and proper marshalling
• Modernize errors package to follow Go best practices
• Modernize patch module with clean syntax and comprehensive tooling
• Rename cmd/patch to cmd/kure for better CLI naming
• Promote patch command from subcommand to top-level command
• Rename .patch files to .kpatch to avoid conflicts with diff patches
• Eliminate circular references in Node and Bundle structures
• Centralize validation logic across Kubernetes builders
• Standardize error handling to use KureError consistently
• Standardize function naming conventions across codebase
• Multi-CLI architecture and package naming standardization
• Implement clean workflow interface architecture
• Implement launcher base types with shared libraries
• Implement shared internal/gvk infrastructure
• Apply go fmt formatting to codebase
• Simplify Claude settings with symlink and expanded permissions
• Reorganize task files with numbered prefixes
• Migrate to GoReleaser v2 workflow
• Consolidate Makefile targets and enhance dev workflow
• Standardize validation patterns across packages
• Consolidate 4 GitHub workflows into 2 (ci.yml + release.yml)
• Consolidate 4 GitHub workflows into 2 (ci.yml + release.yml)
• Improve pkg/kubernetes testability and coverage

Dependencies

• Align k8s.io/cli-runtime to v0.33.2 to match replace directive
• Bump tj-actions/changed-files
• Bump github.com/external-secrets/external-secrets
• Bump sigs.k8s.io/kustomize/api from 0.20.0 to 0.21.0
• Bump sigs.k8s.io/yaml from 1.5.0 to 1.6.0
• Implement centralized dependency version management
• Document blocked dependency updates for Go 1.25
• Bump github.com/spf13/cobra in the go-safe group
• Bump github.com/cert-manager/cert-manager
• Update versions.yaml for cert-manager 1.16.5

Documentation

• Add project README
• Mention base resources and expose constructor
• Expand kio package documentation
• Expand kio documentation
• Expand fluxcd package overview
• Correct Flux auto-generated kustomization details
• Update README to reflect current repository state
• Add comprehensive architectural documentation
• Add comprehensive architectural documentation for generators
• Add comprehensive UX design document and recommendations
• Update project status and document remaining features
• Add comprehensive plugin architecture design
• Update CLAUDE.md with current project priorities and status
• Update CLAUDE.md with current project status and accurate metrics
• Update user documentation with current project state
• Add detailed explanation of CEL Validation Enhancement task
• Add comprehensive repository review and task management system
• Update task statuses after upstream rebase
• Add comprehensive puzl-cloud/kubesdk review with kure comparison
• Add task #1 for CEL validation enhancement
• Add workflow guidelines to tasks.md
• Remove references to non-existent demo-internals make target
• Add HPA and PDB builder tasks for downstream OAM support
• Add the downstream operator integration documentation
• Add tasks README and update task 03 status
• Add quickstart guide
• Expand README with end-to-end examples
• Mark high-priority tasks 1-5, 23, 24 as completed
• Mark task #8 as completed
• Add comprehensive GoDoc documentation
• Mark task #10 as completed
• Mark task #6 as completed
• Mark tasks #7, #9, #11, #12 as completed

Fixed

• Separate helper group comments
• Add missing unstructured import to patch CLI
• Correct type usage in generators package tests
• Resolve all layout module test failures
• Ensure all manifest directories have kustomization.yaml for GitOps compliance
• Resolve test failures in launcher module
• Resolve CLI test output capture issues
• Resolve all failing tests and improve TOML patch support
• Correct appworkload test to match ServiceConfig structure
• Update demo and kure commands to use new GVK-based ApplicationWrapper
• Resolve intermittent test failures in cmd/demo package
• Resolve stdout capture synchronization in demo tests
• Configure golangci-lint compatibility and resolve linting issues
• Correct YAML structure in CI workflow
• Add goimports to make fmt for CI/local parity
• Add GOPATH/bin to PATH in lint and fmt targets
• Upgrade Go to 1.24.11 to resolve security vulnerabilities
• Make max_depth_exceeded test deterministic
• Fix CVE in mapstructure and add workflow permissions
• Resolve repo issues across docs, CI, validation, and caching
• Propagate –strict flag to validator in kurel validate
• Update K8s compatibility matrix to test supported versions
• Remove K8s 0.33 from CI compatibility matrix
• Align mise.toml Go version with CI workflows
• Lower coverage threshold to 70% to match current main coverage
• Improve dependabot wildcard pattern matching in validation
• Block FluxCD major version updates in dependabot

Maintenance

• Log errors via log package
• Update Claude settings - always save to .claude/settings.json
• Go fmt
• Standardize Go version and improve workflow organization
• Align repo with the downstream scaffold and platform standards
• Enhance dependabot configuration
• Migrate tasks to GitHub issues
• Bump the actions group across 1 directory with 7 updates

Testing

• Check errors
• Add runCluster coverage
• Add comprehensive test coverage for all packages
• Add comprehensive test coverage for FluxHelm internal package
• Skip demo integration tests in short mode
• Skip demo tests when examples directory is missing
• Fix data race in TestMainFunction
• Skip max_depth_exceeded test due to resolver bugs
• Add integration tests for stack generation workflows
• Add fuzz tests for patch parser
• Add Kubernetes version matrix to CI
• Add tests to improve coverage and fix Go version
• Add Phase 1 coverage for simple getters/setters
• Add Phase 2 parsing tests, reach 70.5% coverage
• Add Phase 3 validation tests, reach 100% validation coverage
• Add Phase 4 stack domain model tests
• Add Phase 5 layout integrator tests
• Add wrapper function tests, reach 94.8% gvk coverage
• Add setter function tests for internal packages
• Add comprehensive IO table and printer tests
• Add comprehensive appworkload internal tests