chore(release): v0.2.0

CHANGELOG.md

@@ -5,6 +5,40 @@ All notable changes to OComment will be documented here. The project follows
 
 ## Unreleased
 
+## [0.2.0](https://github.com/P4suta/OComment/compare/v0.1.0...v0.2.0) - 2026-09-25
+
+### Added
+
+- [**breaking**] decide what a comment says, and write the half a machine can settle ([#64](https://github.com/P4suta/OComment/pull/64))
+- read Go's module files ([#52](https://github.com/P4suta/OComment/pull/52))
+- say which binary answered, and why a cached gate is not one ([#47](https://github.com/P4suta/OComment/pull/47))
+- make `--explain` answer under the report it is asked of ([#44](https://github.com/P4suta/OComment/pull/44))
+- make a report too large to read into one to navigate ([#43](https://github.com/P4suta/OComment/pull/43))
+- [**breaking**] report the decisions a run asks for, not the lines it found ([#42](https://github.com/P4suta/OComment/pull/42))
+- [**breaking**] make the deletion tool decide by what a comment promises, and answer the agent writing it ([#30](https://github.com/P4suta/OComment/pull/30))
+
+### Fixed
+
+- keep mise task headers as directives, and keep the suite off an inherited GIT_DIR ([#68](https://github.com/P4suta/OComment/pull/68))
+- *(go)* require //go: and //line to begin at the comment marker ([#62](https://github.com/P4suta/OComment/pull/62))
+- a `#` inside a pattern is not a comment ([#54](https://github.com/P4suta/OComment/pull/54))
+- a gate that is off says so ([#51](https://github.com/P4suta/OComment/pull/51))
+- say which one — which reader answered, which comment a finding is ([#48](https://github.com/P4suta/OComment/pull/48))
+- when the policy is stricter than the kind, say so instead of guessing ([#46](https://github.com/P4suta/OComment/pull/46))
+- give a profile's reader the classification every other reader runs ([#41](https://github.com/P4suta/OComment/pull/41))
+- read what a `<style>` says it holds, and stop claiming it says nothing ([#37](https://github.com/P4suta/OComment/pull/37))
+- read what a `<script>` says it holds before reading it as JavaScript ([#36](https://github.com/P4suta/OComment/pull/36))
+- stop --force-invalid removing the code under an unterminated comment ([#35](https://github.com/P4suta/OComment/pull/35))
+- count the files the walk never reached ([#33](https://github.com/P4suta/OComment/pull/33))
+- ask whether a scan failed, rather than naming the severity that means it ([#45](https://github.com/P4suta/OComment/pull/45))
+- ask every language what its toolchain reads, not just the load-bearing tier ([#38](https://github.com/P4suta/OComment/pull/38))
+
+### Other
+
+- [**breaking**] make the task runner code, and let the compiler refuse a variant nobody classified ([#32](https://github.com/P4suta/OComment/pull/32))
+- automate preparation and publish only product crates ([#17](https://github.com/P4suta/OComment/pull/17))
+- name every field of every verdict, so a new one cannot go unsaid ([#40](https://github.com/P4suta/OComment/pull/40))
+
 ### Added
 
 - A second axis: what a comment *says*, as well as whether it stays.

README.md

@@ -31,7 +31,7 @@ ocomment fix src
 printf '%s\n' 'let x = 1; // remove' | ocomment strip --language rust
 ```
 
-Or install nothing: `docker run --rm -v "$PWD:/src" ghcr.io/p4suta/ocomment:0.1.0 check` runs the same CLI from the [container image](docs/docker.md).
+Or install nothing: `docker run --rm -v "$PWD:/src" ghcr.io/p4suta/ocomment:0.2.0 check` runs the same CLI from the [container image](docs/docker.md).
 
 A command that names no path checks the current directory, so running it from a subdirectory checks that subdirectory; a bare `ocomment` run from the repository root already checks the whole repository, under the ordinary walk limits — `cd "$(git rev-parse --show-toplevel)"` gets there from anywhere inside it.
 Naming a path explicitly (`ocomment .`, `ocomment src`) is a request rather than a default, so it bypasses the hidden-file and size limits, as [configuration](docs/configuration.md) describes.
@@ -161,7 +161,7 @@ The hooks are `language: system`, so install the CLI first, then point a `.pre-c
 ```yaml
 repos:
   - repo: https://github.com/P4suta/OComment
-    rev: v0.1.0
+    rev: v0.2.0
     hooks:
       - id: ocomment-check
 ```
@@ -173,7 +173,7 @@ repos:
 It downloads the release archive for the runner, verifies its SHA-256 and its build-provenance attestation, and annotates the pull request:
 
 ```yaml
-      - uses: P4suta/OComment@v0.1.0
+      - uses: P4suta/OComment@v0.2.0
         with:
           paths: src tests
 ```

docs/ci.md

@@ -23,7 +23,7 @@ Until then, a missing `ocomment` fails the hook with a "command not found" error
 ```yaml
 repos:
   - repo: https://github.com/P4suta/OComment
-    rev: v0.1.0
+    rev: v0.2.0
     hooks:
       - id: ocomment-check
 ```
@@ -36,7 +36,7 @@ To let the hook write what a machine can settle, add `ocomment-tidy` in front of
 ```yaml
 repos:
   - repo: https://github.com/P4suta/OComment
-    rev: v0.1.0
+    rev: v0.2.0
     hooks:
       - id: ocomment-tidy
       - id: ocomment-check
@@ -52,7 +52,7 @@ It applies the removals too, including the comments above that were worth keepin
 ```yaml
 repos:
   - repo: https://github.com/P4suta/OComment
-    rev: v0.1.0
+    rev: v0.2.0
     hooks:
       - id: ocomment-fix
       - id: ocomment-check
@@ -156,7 +156,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v7
-      - uses: P4suta/OComment@v0.1.0
+      - uses: P4suta/OComment@v0.2.0
         with:
           paths: src tests
 ```
@@ -172,7 +172,7 @@ jobs:
       security-events: write # NOTE: Upload the SARIF file to code scanning.
     steps:
       - uses: actions/checkout@v7
-      - uses: P4suta/OComment@v0.1.0
+      - uses: P4suta/OComment@v0.2.0
         with:
           format: sarif
           upload-sarif: "true"
@@ -214,7 +214,7 @@ The SARIF is uploaded under the `ocomment` category, so it does not collide with
 
 ```yaml
       - id: comments
-        uses: P4suta/OComment@v0.1.0
+        uses: P4suta/OComment@v0.2.0
         with:
           fail-on-findings: "false"
       - if: steps.comments.outputs.exit-code == '1'
@@ -258,7 +258,7 @@ This is how the repository's own `action-smoke` job tests the action against a f
 
 ### Pinning
 
-Version tags are immutable under the repository's release-tag ruleset, so `P4suta/OComment@v0.1.0` is a stable reference and there is no moving `v0` tag to follow.
+Version tags are immutable under the repository's release-tag ruleset, so `P4suta/OComment@v0.2.0` is a stable reference and there is no moving `v0` tag to follow.
 Pin to a full version, or to a commit SHA with a version comment if your policy requires it.
 
 ## Keeping the protected directives honest
@@ -363,16 +363,16 @@ if _, err := os.ReadFile(binary); err != nil {
 ```
 
 Read the binary rather than recording `ocomment --version`.
-Two builds can answer `ocomment 0.1.0` and disagree about the same file — one from a release,
+Two builds can answer `ocomment 0.2.0` and disagree about the same file — one from a release,
 one from a working tree — and a version string cannot tell them apart.
 `ocomment doctor` says which one answered:
 
 ```console
 $ ocomment doctor
-ocomment 0.1.0
+ocomment 0.2.0
 binary: /usr/local/bin/ocomment (sha256:19010bf16aa8983d95a7f6d83b8aae9854369961ecd8dc1edff12c8a40a7208b)
 ``` This is
-not hypothetical: it is how the licence bug that `[policy] mode` fixed was reported as a failing gate in one shell and a passing one in another, on the same machine, on the same day, with `mise exec` and a bare `PATH` resolving to different `0.1.0`s.
+not hypothetical: it is how the licence bug that `[policy] mode` fixed was reported as a failing gate in one shell and a passing one in another, on the same machine, on the same day, with `mise exec` and a bare `PATH` resolving to different `0.2.0`s.
 
 The same hole is not Go's.
 Any runner that caches on declared inputs has it: a Cargo build script needs `cargo:rerun-if-changed` for a tool it shells out to,

docs/docker.md

@@ -4,7 +4,7 @@ Every release publishes a multi-architecture image to the GitHub Container
 Registry:
 
 ```sh
-docker run --rm -v "$PWD:/src" ghcr.io/p4suta/ocomment:0.1.0 check
+docker run --rm -v "$PWD:/src" ghcr.io/p4suta/ocomment:0.2.0 check
 ```
 
 `linux/amd64` and `linux/arm64` are built, and both carry the exact binary the matching `ocomment-<arch>-unknown-linux-musl.tar.gz` release archive contains — the release workflow pushes the artifacts it already built and smoke tested rather than compiling the tag a second time.
@@ -17,9 +17,9 @@ The entrypoint is the binary itself,
 which is why arguments are written as if `ocomment` were on the command line:
 
 ```sh
-docker run --rm -v "$PWD:/src" ghcr.io/p4suta/ocomment:0.1.0 --version
-docker run --rm -v "$PWD:/src" ghcr.io/p4suta/ocomment:0.1.0 diff src >fix.patch
-docker run --rm -v "$PWD:/src" ghcr.io/p4suta/ocomment:0.1.0 check --format sarif
+docker run --rm -v "$PWD:/src" ghcr.io/p4suta/ocomment:0.2.0 --version
+docker run --rm -v "$PWD:/src" ghcr.io/p4suta/ocomment:0.2.0 diff src >fix.patch
+docker run --rm -v "$PWD:/src" ghcr.io/p4suta/ocomment:0.2.0 check --format sarif
 ```
 
 The working directory is `/src` and the default command is `check`, so a bare run checks whatever was mounted there.
@@ -31,14 +31,14 @@ The container runs as uid 65532, which owns nothing on the host, so `fix` needs
 
 ```sh
 docker run --rm -u "$(id -u):$(id -g)" -v "$PWD:/src" \
-  ghcr.io/p4suta/ocomment:0.1.0 fix src
+  ghcr.io/p4suta/ocomment:0.2.0 fix src
 ```
 
 `fix` writes each file through a temporary file beside it, so the process needs write permission on the containing directory as well as the file.
 For a read-only command, mounting read-only makes that explicit and costs nothing:
 
 ```sh
-docker run --rm -v "$PWD:/src:ro" ghcr.io/p4suta/ocomment:0.1.0 check
+docker run --rm -v "$PWD:/src:ro" ghcr.io/p4suta/ocomment:0.2.0 check
 ```
 
 `fix --interactive` needs a terminal on both standard input and standard output, so add `-it` when you want it.
@@ -55,7 +55,7 @@ A plugin already vendored into the mounted tree loads normally, because that is
 `ocomment doctor` lists every one of these:
 
 ```console
-$ docker run --rm -v "$PWD:/src:ro" ghcr.io/p4suta/ocomment:0.1.0 doctor
+$ docker run --rm -v "$PWD:/src:ro" ghcr.io/p4suta/ocomment:0.2.0 doctor
 ...
 git: not found (needed for --staged)
 curl: not found (needed for https:// plugin sources)
@@ -66,7 +66,7 @@ cosign: not found (needed for --identity verification)
 
 ## Tags
 
-`0.1.0` pins one release.
+`0.2.0` pins one release.
 `0.1` follows the patch releases of that minor series, and `latest` follows the newest release.
 Pin the full version in CI,
 or pin the digest when the image must never move at all:
@@ -80,7 +80,7 @@ docker run --rm -v "$PWD:/src" ghcr.io/p4suta/ocomment@sha256:… check
 The image is signed keylessly with Sigstore and carries a build-provenance attestation, both bound to the release workflow of this repository:
 
 ```sh
-cosign verify ghcr.io/p4suta/ocomment:0.1.0 \
+cosign verify ghcr.io/p4suta/ocomment:0.2.0 \
   --certificate-oidc-issuer https://token.actions.githubusercontent.com \
   --certificate-identity-regexp '^https://github\.com/P4suta/OComment/\.github/workflows/release\.yml@refs/tags/v[0-9]+\.[0-9]+\.[0-9]+$'
 ```
@@ -91,10 +91,10 @@ A looser identity — anything matching `.*`, say — would accept a signature f
 The provenance attestation is verified with either the GitHub CLI or cosign:
 
 ```sh
-gh attestation verify oci://ghcr.io/p4suta/ocomment:0.1.0 --repo P4suta/OComment
+gh attestation verify oci://ghcr.io/p4suta/ocomment:0.2.0 --repo P4suta/OComment
 ```
 
-The image is also published with an SPDX SBOM and SLSA provenance attached by buildx, which `docker buildx imagetools inspect ghcr.io/p4suta/ocomment:0.1.0` lists.
+The image is also published with an SPDX SBOM and SLSA provenance attached by buildx, which `docker buildx imagetools inspect ghcr.io/p4suta/ocomment:0.2.0` lists.
 
 ## Building it yourself
 

docs/installation.md

@@ -3,7 +3,7 @@
 Every channel below installs the same binary for the same release.
 Pick one;
 they do not need each other.
-Examples pin `0.1.0` — use the version you want,
+Examples pin `0.2.0` — use the version you want,
 and prefer a full pin over a moving tag wherever a workflow or a tap will resolve it later.
 
 ## From crates.io
@@ -41,7 +41,7 @@ Each archive unpacks into an `ocomment-<target>/` directory holding the binary,
 both licences, the README, the `ocomment.1` manual page, and completion scripts for Bash, Zsh, fish, PowerShell, and Elvish.
 
 ```sh
-gh release download v0.1.0 --repo P4suta/OComment \
+gh release download v0.2.0 --repo P4suta/OComment \
   --pattern 'ocomment-x86_64-unknown-linux-gnu.tar.gz*'
 tar -xzf ocomment-x86_64-unknown-linux-gnu.tar.gz
 install -m 0755 ocomment-x86_64-unknown-linux-gnu/ocomment ~/.local/bin/ocomment
@@ -69,7 +69,7 @@ Once those exist, the same generated files are what gets submitted to them, and
 ## Container image
 
 ```sh
-docker run --rm -v "$PWD:/src" ghcr.io/p4suta/ocomment:0.1.0 check
+docker run --rm -v "$PWD:/src" ghcr.io/p4suta/ocomment:0.2.0 check
 ```
 
 The image is `scratch` plus one statically linked musl binary, built from the exact archives of the same release rather than from a second compilation.
@@ -78,7 +78,7 @@ The image is `scratch` plus one statically linked musl binary, built from the ex
 ## GitHub Actions
 
 ```yaml
-      - uses: P4suta/OComment@v0.1.0
+      - uses: P4suta/OComment@v0.2.0
         with:
           paths: src tests
 ```
@@ -91,7 +91,7 @@ The composite action downloads the release archive for the runner, verifies its
 ```yaml
 repos:
   - repo: https://github.com/P4suta/OComment
-    rev: v0.1.0
+    rev: v0.2.0
     hooks:
       - id: ocomment-check
 ```

docs/ocomment.1

@@ -1,6 +1,6 @@
 .ie \n(.g .ds Aq \(aq
 .el .ds Aq '
-.TH OCOMMENT 1  "ocomment 0.1.0" "User Commands"
+.TH OCOMMENT 1  "ocomment 0.2.0" "User Commands"
 .SH NAME
 ocomment \- Check and remove source\-code comments safely
 .SH SYNOPSIS
@@ -660,7 +660,7 @@ Which host\*(Aqs hook protocol is spoken on standard input and output
 claude\-code: Claude Code\*(Aqs `PreToolUse` and `PostToolUse` hooks
 .RE
 .SH VERSION
-v0.1.0
+v0.2.0
 .SH EXIT STATUS
 .TP
 .B 0

docs/verify.md

@@ -12,13 +12,13 @@ They answer different questions, so it is worth knowing which one you are relyin
 A digest alone proves nothing about origin: whoever could replace the archive could replace the digest beside it.
 The signature and the attestation are what tie the file to `P4suta/OComment` and to the tag it claims to come from.
 
-Examples pin `0.1.0` — use the version you want, and change it in every line of a command: the tag inside a signing identity is part of what the check proves,
+Examples pin `0.2.0` — use the version you want, and change it in every line of a command: the tag inside a signing identity is part of what the check proves,
 not a detail of the example.
 
 ## Download
 
 ```sh
-gh release download v0.1.0 --repo P4suta/OComment \
+gh release download v0.2.0 --repo P4suta/OComment \
   --pattern 'ocomment-x86_64-unknown-linux-gnu.tar.gz*' \
   --pattern 'SHA256SUMS*'
 ```
@@ -52,7 +52,7 @@ The composite GitHub Action runs this same verification on the runner before it
 cosign verify-blob \
   --bundle ocomment-x86_64-unknown-linux-gnu.tar.gz.sigstore.json \
   --certificate-identity \
-    'https://github.com/P4suta/OComment/.github/workflows/release.yml@refs/tags/v0.1.0' \
+    'https://github.com/P4suta/OComment/.github/workflows/release.yml@refs/tags/v0.2.0' \
   --certificate-oidc-issuer https://token.actions.githubusercontent.com \
   ocomment-x86_64-unknown-linux-gnu.tar.gz
 ```
@@ -75,12 +75,12 @@ The same command verifies any other signed asset of the release by name: the SPD
 ## Verify the container image
 
 ```sh
-cosign verify ghcr.io/p4suta/ocomment:0.1.0 \
+cosign verify ghcr.io/p4suta/ocomment:0.2.0 \
   --certificate-identity-regexp \
     '^https://github\.com/P4suta/OComment/\.github/workflows/release\.yml@refs/tags/v[0-9]+\.[0-9]+\.[0-9]+$' \
   --certificate-oidc-issuer https://token.actions.githubusercontent.com
 
-gh attestation verify oci://ghcr.io/p4suta/ocomment:0.1.0 --repo P4suta/OComment
+gh attestation verify oci://ghcr.io/p4suta/ocomment:0.2.0 --repo P4suta/OComment
 ```
 
 The image carries the same musl binary the matching release archive contains,

release-extras/ocomment.1

@@ -1,6 +1,6 @@
 .ie \n(.g .ds Aq \(aq
 .el .ds Aq '
-.TH OCOMMENT 1  "ocomment 0.1.0" "User Commands"
+.TH OCOMMENT 1  "ocomment 0.2.0" "User Commands"
 .SH NAME
 ocomment \- Check and remove source\-code comments safely
 .SH SYNOPSIS
@@ -660,7 +660,7 @@ Which host\*(Aqs hook protocol is spoken on standard input and output
 claude\-code: Claude Code\*(Aqs `PreToolUse` and `PostToolUse` hooks
 .RE
 .SH VERSION
-v0.1.0
+v0.2.0
 .SH EXIT STATUS
 .TP
 .B 0

rust/Cargo.toml

@@ -3,7 +3,7 @@ resolver = "2"
 members = ["ocomment-core", "ocomment", "ocomment-plugin-sdk", "xtask"]
 
 [workspace.package]
-version = "0.1.0"
+version = "0.2.0"
 edition = "2024"
 rust-version = "1.88"
 license = "MIT OR Apache-2.0"