Milestones
List view
The first pass from an audit of the shipped 0.6.3. Every issue here was found by driving the released binaries, the release archive and the composite action, and reproduced against 0.6.3 before it was written down; nothing was inferred from reading source alone. The theme is the gap between what a run says and what it did. A cost table that prices 742 commits where --write makes 722; a chart header reporting December's total under March's grid; an action step that gates on one GraphQL query and publishes another; --png that names a path and writes nothing; --track --save --format json that hands a parser two lines of prose at exit 0; an empty CHANGELOG section that publishes the crate and then fails the release. Most of them are silent — exit 0, empty stderr — which is why 38 issues of history contains none of them. The bar for closing one: a test that would have failed before the fix, in the layer the behaviour lives in (this repository has five test files and a documented three-layer policy that names two of them, which is itself one of these issues), and any documented figure regenerated from the command above it rather than retyped. Several of these change output a machine may read, which is why they belong in one minor bump rather than trickling out across patch releases. One decision the milestone should make once rather than per-issue: unsafe_code = "forbid" (Cargo.toml:55, advertised in SECURITY.md as posture) blocks the one-line fix for both the signal-restore and the broken-pipe issues. The answer — a narrow documented exception, a signal-handling dependency that registers safely, or writing stdout through a handle that swallows BrokenPipe — should be the same for both. Explicitly out of scope. The escape-sequence handling of .art header fields, which is exploitable and inside SECURITY.md's declared scope, so it goes to a private advisory rather than this tracker and is not listed here. Making --png mean something for a preview, a template list or a tracking report — this milestone only refuses the combination, deliberately keeping that door open. #73, the release-triggered binary workflows, which is its own open issue and makes the CHANGELOG one worse rather than duplicating it. Deferred. End-to-end coverage of action/action.yml beyond the single fail-on case named in its issue: nothing in this repository executes the composite action's ~300 lines of bash today, and building that harness is a larger piece of work than any issue here. Whether the placement belongs in the tracking report header or only in named action outputs is settled inside its own issue, not before the milestone starts.
No due date•0/18 issues closed