Use find -mindepth 2 to only move files from subdirectories, avoiding
the 'mv: cannot overwrite directory' error when flattening the artifact
directory structure. This ensures only the actual binary and checksum
files are moved, not the directories themselves.
Fixes the sha256sum failure in the Generate Checksums workflow step.
- Generate individual SHA256/SHA512 checksums for each binary in matrix jobs
- Maintain combined checksums.sha256/checksums.sha512 files for all binaries
- Upload both types to release assets for maximum user flexibility
- Update release notes with examples for both verification methods
- Filter binary lists to exclude checksum files from combined checksums
Users can now choose between:
- Combined checksums (checksums.sha256) with --ignore-missing flag
- Individual checksums (per-binary .sha256 files) for simpler verification
This provides the best of both approaches for different user preferences.
- Each build job uploads artifact with unique name (binary filename)
- Checksums job downloads all artifacts and flattens structure
- Use 'find . -type f' to only move files, avoiding directory conflicts
- Add debugging output to troubleshoot artifact structure
Fixes 'artifact with this name already exists' error that was
preventing multiple build jobs from uploading simultaneously.
- Upload all binaries to single 'binaries' artifact instead of separate artifacts
- Remove complex directory flattening logic that was causing mv errors
- Add better error handling and debugging output for checksum generation
- Simplify artifact download process
Fixes the 'mv: cannot overwrite directory' errors that were causing
the Generate Checksums step to fail during release builds.
- Remove push:tags trigger that duplicated release:published trigger
- Keep workflow_dispatch for manual releases
- Simplify conditional logic for release creation
- Fix tag name resolution for different event types
- Ensure single workflow run per release creation
Resolves double-triggering issue where GitHub web UI release
creation would trigger both push:tags and release:published events.
- Reference original API documentation source from Bose Corporation
- Link to official Bose SoundTouch End-of-Life page
- Clarify this is an independent implementation
- Add disclaimer about non-affiliation with Bose Corporation
- Provide both online and local documentation references
- Replace gosec with govulncheck (official Go vulnerability scanner)
- Add dedicated security.yml workflow with multiple tools:
- govulncheck: Official Go team vulnerability scanner
- Nancy: Sonatype dependency vulnerability scanner
- Staticcheck: Go static analysis with security checks
- Semgrep: Multi-language security scanner
- CodeQL: GitHub semantic security analysis
- Dependency Review: Automated dependency vulnerability checking
- Update golangci-lint config to temporarily disable gosec
- Add CodeQL configuration for enhanced Go security analysis
- Separate fast CI checks from comprehensive security scanning
- Schedule daily security scans at 2 AM UTC
- Integrate with GitHub Security tab via SARIF reports
- Remove securecodewarrior/github-action-gosec@master (repository not found)
- Install gosec directly using go install
- Run gosec ./... command directly instead of through action
- This provides the same security scanning functionality with better reliability
Fixes the security scan job failure due to missing third-party action.
- Use client.NewClientFromHost instead of non-existent client.New
- Use models.DeviceInfo instead of non-existent models.Info
- Use discovery.UnifiedDiscoveryService instead of non-existent discovery.Scanner
- Use config.DefaultConfig instead of non-existent config.NewConfig
- Add config package import for discovery service creation
This fixes the integration test failure where undefined symbols were being referenced.
- Remove exit 1 from status check to prevent workflow failure
- Add proper GitHub permissions (statuses: write, contents: read)
- Add error handling for commit status API calls
- Add detailed logging to show which specific CI jobs failed
- Ensure workflow completes successfully even when CI checks fail
Fixes the 403 HTTP error and improves debugging visibility.
- Remove Go version matrix from CI workflow
- Use go-version-file option to read from go.mod
- Update cache keys to use go.mod hash
- Ensure single source of truth for Go version
- Simplify maintenance by centralizing version management
- Add CI workflow with multi-version Go testing, linting, security scans
- Add automated release workflow triggered on tag push
- Include Dependabot for dependency management
- Add professional issue templates for bugs and features
- Configure golangci-lint with production-ready settings
- Update local release script to complement automation
- Support cross-platform builds for 7 platforms
- Automated release notes and checksum generation
Tobias Gesellchen
