build(deps): bump actions/setup-go from 6 to 7

Bumps [actions/setup-go](https://github.com/actions/setup-go) from 6 to 7. - [Release notes](https://github.com/actions/setup-go/releases) - [Commits](https://github.com/actions/setup-go/compare/v6...v7) --- updated-dependencies: - dependency-name: actions/setup-go dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
docs: session handoff after v0.4.0 release
2026-07-22 14:14:21 +00:00 · 2026-06-09 10:34:13 -05:00
4 changed files with 36 additions and 45 deletions
@@ -25,7 +25,7 @@ jobs:
      - uses: actions/checkout@v6

      - name: Set up Go
-        uses: actions/setup-go@v6
+        uses: actions/setup-go@v7
        with:
          go-version: "1.26"
          cache: true
@@ -82,7 +82,7 @@ jobs:
      - uses: actions/checkout@v6

      - name: Set up Go
-        uses: actions/setup-go@v6
+        uses: actions/setup-go@v7
        with:
          go-version: "1.26"
          cache: true
@@ -105,7 +105,7 @@ jobs:
      - uses: actions/checkout@v6

      - name: Set up Go
-        uses: actions/setup-go@v6
+        uses: actions/setup-go@v7
        with:
          go-version: "1.26"
          cache: true
@@ -22,7 +22,7 @@ jobs:
          fetch-depth: 0

      - name: Set up Go
-        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
          go-version: "1.26.4"
          cache: true
@@ -3,30 +3,27 @@
 **Last Updated:** 2026-06-09

 ## Current Status
-Releasing **v0.4.0**. All six feature/bugfix branches were integrated into `develop`
-(six `--no-ff` merges, conflicts resolved, combined gate green: gofmt/vet/lint, race
-tests, 100% coverage). CHANGELOG finalized as `[0.4.0] - 2026-06-09`. Promoting
-`develop` → `main` and tagging `v0.4.0` to trigger the GoReleaser `Release` workflow.
+**v0.4.0 is RELEASED and verified.** Nothing in progress. Clean stopping point.
+Resume on `develop` (default branch). Working tree clean.

-## What shipped in v0.4.0 (issues closed)
- #35 audit reporting overhaul (`--summary`, `--group-by`, `--sort`, `--depth`, `--only`, per-group risk + breakdowns, attributable violations, findings parity) + self-config exclusion + policy-aware group risk.
- #29 init full TUI wizard + live previews + persisted `include`.
- #31 resolve: stop guessing SPDX ids for ambiguous aliases.
- #34 remove no-op `--quiet`/`--verbose` flags.
- #33 refuse to clobber a symlinked LICENSE.
- #30 confine header detection to contiguous comment lines.
+## What Was Done (this session)
+- Shipped six issues into v0.4.0: #35 (audit reporting overhaul + self-config exclusion + policy-aware group risk), #29 (init full TUI wizard), #31 (resolve: stop guessing SPDX ids), #34 (remove no-op --quiet/--verbose), #33 (refuse symlinked LICENSE), #30 (confine header detection).
+- Bug fixes #30/#31/#33/#34 were built by parallel worktree-isolated agents (TDD + full gate + PR each).
+- Integrated all six PRs into `develop` (six --no-ff merges, conflicts resolved), combined gate green (100% coverage), promoted `develop` -> `main`, tagged **v0.4.0**.
+- Release workflow succeeded: GitHub Release v0.4.0 (6 assets: checksums + darwin/linux arm64+amd64 + windows amd64), Homebrew cask bumped on `KofTwentyTwo/homebrew-tap`.
+- Authored `RELEASES.md` (full release runbook); added pointer from `RELEASING.md`.

-## Release process
-Documented end-to-end in `RELEASES.md` (full runbook) and `RELEASING.md` (short ref).
-Tag `vX.Y.Z` on `main` triggers `goreleaser release --clean`: GitHub Release + Homebrew
-cask (`KofTwentyTwo/homebrew-tap`). Verify with `gh release view` and
-`brew install --cask KofTwentyTwo/tap/license-tool && license-tool version`.
+## Branch State
+- `develop` and `main` both at v0.4.0 content; `main` tagged `v0.4.0`. `develop` is one doc commit (this handoff) ahead of `main` after it lands.
+- Six merged local `feature/GH-*` branches remain and can be pruned (`git branch -d ...`); their remotes can be deleted too.

-## Open Threads / follow-ups
- [ ] Deferred LOW items: #41/#30 block-comment de-stacking; #39/#34 `isWriteRefusal` typed-sentinel refactor and the still-dead `model.ResolveOptions.Verbose` field.
- [ ] #32 (include `**`) was fixed on GH-29.
+## Pending / Next Session
+- [ ] Prune merged feature branches (local + remote) if desired.
+- [ ] Verify install on a clean machine: `brew update && brew install --cask KofTwentyTwo/tap/license-tool && license-tool version` (should print v0.4.0).
+- [ ] Deferred LOW follow-ups (own issues if pursued): block-comment de-stacking in detect (#30 scope); `isWriteRefusal` typed-sentinel refactor + remove dead `model.ResolveOptions.Verbose` (#34 scope).
+- [ ] No open issues/PRs outstanding from this work.

 ## Key Reference
- Default branch `develop`; production `main`; tags `vX.Y.Z` on `main` publish via GoReleaser.
- Gate: `gofmt -l .`; `go vet ./...`; `golangci-lint run`; `go test ./... -race -coverpkg=./internal/...,./cmd/... -covermode=atomic -coverprofile=cover.out`; `go run github.com/vladopajic/go-test-coverage/v2@v2.18.8 --config=.testcoverage.yml`. (Do not pipe `go build`/`go test` to `tail` — it masks the exit code.)
- Repo: GitHub `KofTwentyTwo/license-tool`; commits reference issues, no AI attribution.
+- Repo: GitHub `KofTwentyTwo/license-tool`. Default branch `develop`; production `main`; tag `vX.Y.Z` on `main` publishes via GoReleaser. Commits reference issues, no AI attribution.
+- Release runbook: `RELEASES.md`. Gate: `gofmt -l .`; `go vet ./...`; `golangci-lint run`; `go test ./... -race -coverpkg=./internal/...,./cmd/... -covermode=atomic -coverprofile=cover.out`; `go run github.com/vladopajic/go-test-coverage/v2@v2.18.8 --config=.testcoverage.yml`.
+- Gotcha: never pipe `go build`/`go test` to `tail` in a `&&` chain — it masks the exit code (bit me during merge integration). The Go filetype uses BLOCK comments (`/* */`), not `//`.
@@ -1,21 +1,15 @@
-# TODO: GH-29 Init TUI Wizard
+# TODO

-## Definition
- [x] Define full feature specification and MVP boundaries.
- [x] Update issue #29 with implementation plan once finalized.
+## Shipped in v0.4.0 (2026-06-09)
+- [x] #35 audit reporting overhaul + self-config exclusion + policy-aware group risk
+- [x] #29 init full TUI wizard + live previews + persisted `include`
+- [x] #31 resolve: stop guessing SPDX ids for ambiguous aliases
+- [x] #34 remove no-op `--quiet`/`--verbose` flags
+- [x] #33 refuse to clobber a symlinked LICENSE
+- [x] #30 confine header detection to contiguous comment lines

-## Implementation
- [x] Persist `include` patterns in `.license-tool.yaml`.
- [x] Add init wizard sample-language catalog and C fallback.
- [x] Add live preview rendering for example source files.
- [x] Replace interactive `init` form with full-screen TUI.
- [x] Preserve deterministic non-TTY `init` behavior.
- [x] Update README/DEVELOPERS documentation.
-
-## Verification
- [x] `gofmt -l .`
- [x] `go vet ./...`
- [x] `golangci-lint run`
- [x] `go test ./... -race -coverpkg=./internal/...,./cmd/... -covermode=atomic -coverprofile=cover.out`
- [x] `go run github.com/vladopajic/go-test-coverage/v2@v2.18.8 --config=.testcoverage.yml`
- [x] `go build ./...`
+## Follow-ups (not yet ticketed)
+- [ ] Prune merged `feature/GH-*` branches (local + remote).
+- [ ] Detect: de-stack multi-block `/* */` headers (deferred from #30; would need care to avoid over-detection).
+- [ ] cmd/applier: replace `isWriteRefusal` substring matching with a typed sentinel error (deferred from #34 to avoid colliding with #33).
+- [ ] model: remove the dead `ResolveOptions.Verbose` field (deferred from #34).