- Use debug.ReadBuildInfo() for version information (Go 1.18+ best practice)
- Extract version from module info and VCS settings (vcs.revision, vcs.time)
- Remove complex ldflags setup from Makefile and GitHub workflows
- Simplify build process while maintaining all version information
- Cleaner approach recommended by Go community
Thanks to Gopher Slack feedback for this improvement!
- Update CONTRIBUTING.md to require Go 1.25.5 or later
- Update README.md prerequisites
- Update GETTING-STARTED.md requirements
- Update Dockerfile examples to use golang:1.25-alpine
- Update issue templates to reflect supported Go versions
- Ensure consistency across all documentation files
All CI workflows already use go-version-file: go.mod so they
automatically pick up the correct version from go.mod.
- Add CONTRIBUTING.md with detailed contributor guidelines
- Create GitHub issue templates (bug reports, feature requests, device compatibility)
- Add pull request template with comprehensive checklist
- Create FEATURE_HISTORY.md documenting development evolution
- Streamline README.md to focus on overview and usage
- Improve documentation organization and clarity
The project now has proper contribution guidelines following GitHub best practices,
making it easier for new contributors to get started and maintain consistent
quality standards.
- Use dedicated collection directory to avoid naming conflicts
- Simplify file movement logic by using release-files directory
- Update artifact upload paths to match new structure
- Resolves mv errors when files have same names as directories
Add ls -la output for:
- Working directory before/after build
- Go build cache location and contents
- Go module cache contents
- Post-build state verification
Simple directory listings often reveal file permission issues,
cached artifacts, or leftover files that cause 'File exists' errors
better than complex debugging output.
- Clean build environment before building (remove existing files, clean cache)
- Add atomic checksum generation using temp directory
- Improve error handling with explicit build failure detection
- Add debugging output to diagnose 'File exists' errors
- Use basename in temp operations to avoid path issues
This should resolve the 'Cannot open: File exists' errors occurring
during the darwin/arm64 build process.
Use find -mindepth 2 to only move files from subdirectories, avoiding
the 'mv: cannot overwrite directory' error when flattening the artifact
directory structure. This ensures only the actual binary and checksum
files are moved, not the directories themselves.
Fixes the sha256sum failure in the Generate Checksums workflow step.
- Generate individual SHA256/SHA512 checksums for each binary in matrix jobs
- Maintain combined checksums.sha256/checksums.sha512 files for all binaries
- Upload both types to release assets for maximum user flexibility
- Update release notes with examples for both verification methods
- Filter binary lists to exclude checksum files from combined checksums
Users can now choose between:
- Combined checksums (checksums.sha256) with --ignore-missing flag
- Individual checksums (per-binary .sha256 files) for simpler verification
This provides the best of both approaches for different user preferences.
- Each build job uploads artifact with unique name (binary filename)
- Checksums job downloads all artifacts and flattens structure
- Use 'find . -type f' to only move files, avoiding directory conflicts
- Add debugging output to troubleshoot artifact structure
Fixes 'artifact with this name already exists' error that was
preventing multiple build jobs from uploading simultaneously.
- Upload all binaries to single 'binaries' artifact instead of separate artifacts
- Remove complex directory flattening logic that was causing mv errors
- Add better error handling and debugging output for checksum generation
- Simplify artifact download process
Fixes the 'mv: cannot overwrite directory' errors that were causing
the Generate Checksums step to fail during release builds.
- Remove push:tags trigger that duplicated release:published trigger
- Keep workflow_dispatch for manual releases
- Simplify conditional logic for release creation
- Fix tag name resolution for different event types
- Ensure single workflow run per release creation
Resolves double-triggering issue where GitHub web UI release
creation would trigger both push:tags and release:published events.
- Reference original API documentation source from Bose Corporation
- Link to official Bose SoundTouch End-of-Life page
- Clarify this is an independent implementation
- Add disclaimer about non-affiliation with Bose Corporation
- Provide both online and local documentation references
- Replace gosec with govulncheck (official Go vulnerability scanner)
- Add dedicated security.yml workflow with multiple tools:
- govulncheck: Official Go team vulnerability scanner
- Nancy: Sonatype dependency vulnerability scanner
- Staticcheck: Go static analysis with security checks
- Semgrep: Multi-language security scanner
- CodeQL: GitHub semantic security analysis
- Dependency Review: Automated dependency vulnerability checking
- Update golangci-lint config to temporarily disable gosec
- Add CodeQL configuration for enhanced Go security analysis
- Separate fast CI checks from comprehensive security scanning
- Schedule daily security scans at 2 AM UTC
- Integrate with GitHub Security tab via SARIF reports
- Remove securecodewarrior/github-action-gosec@master (repository not found)
- Install gosec directly using go install
- Run gosec ./... command directly instead of through action
- This provides the same security scanning functionality with better reliability
Fixes the security scan job failure due to missing third-party action.
- Use client.NewClientFromHost instead of non-existent client.New
- Use models.DeviceInfo instead of non-existent models.Info
- Use discovery.UnifiedDiscoveryService instead of non-existent discovery.Scanner
- Use config.DefaultConfig instead of non-existent config.NewConfig
- Add config package import for discovery service creation
This fixes the integration test failure where undefined symbols were being referenced.
- Remove exit 1 from status check to prevent workflow failure
- Add proper GitHub permissions (statuses: write, contents: read)
- Add error handling for commit status API calls
- Add detailed logging to show which specific CI jobs failed
- Ensure workflow completes successfully even when CI checks fail
Fixes the 403 HTTP error and improves debugging visibility.
- Remove Go version matrix from CI workflow
- Use go-version-file option to read from go.mod
- Update cache keys to use go.mod hash
- Ensure single source of truth for Go version
- Simplify maintenance by centralizing version management
- Add CI workflow with multi-version Go testing, linting, security scans
- Add automated release workflow triggered on tag push
- Include Dependabot for dependency management
- Add professional issue templates for bugs and features
- Configure golangci-lint with production-ready settings
- Update local release script to complement automation
- Support cross-platform builds for 7 platforms
- Automated release notes and checksum generation
Tobias Gesellchen
