The create subcommand generated .up.sql files with INSERT INTO
_migrations as the FIRST statement, before the actual DDL. If the
DDL fails, the migration is incorrectly marked as applied. Move the
INSERT to be the LAST statement, matching how .down.sql already puts
DELETE FROM _migrations last.
Also fix the automatic fixup logic to append (not prepend) missing
INSERT statements to existing .up.sql files.
Fixes#86
Go 1.23+ changed Windows target naming so x86_64 builds now carry a
micro-architecture suffix (e.g. _v2). Update the goreleaser YAML
generator and monorel's own .goreleaser.yaml to match:
- Remove windows from defaultGoos/almostAllGoos; emit a dedicated
<name>-windows build entry per binary. Windows is kept in a separate
build because it does not support ARM v6/v7, so it cannot share the
same goarch matrix as non-Windows builds.
- Add defaultWindowsGoarch [amd64, arm64] and almostAllWindowsGoarch
[386, amd64, arm64] for the Windows-specific architecture lists.
- Promote defaultGoamd64 from [v1, v2] to [v1, v2, v3, v4] so the
full amd64 micro-architecture matrix is always generated.
- Update the archive name_template to include
{{ if .Amd64 }}_{{ .Amd64 }}{{ end }} after x86_64.
- Include both <name> and <name>-windows in archive ids.
- Regenerate tools/monorel/.goreleaser.yaml and
cmd/sql-migrate/.goreleaser.yaml with the new format.
Adds `sql-migrate sync` which outputs a shell script that refreshes
the local migrations.log from the DB by running _migrations.sql.
Uses `|| true` so a fresh DB with no _migrations table yields an
empty log (all migrations pending) rather than an error.
Usage:
sql-migrate -d ./db/migrations sync | sh
sql-migrate -d ./db/migrations up | sh
Guards against the v1.2.4 bug (fixed in c32acd5) where Authenticate
held a.mux via defer for its full duration, then called
loadAndVerifyToken which also tries to acquire a.mux — deadlock on
every token auth request.
TestAuthenticateTokenNoDeadlock exercises both the bare-token
("", token) and named-username ("api", token) forms with a 1s
timeout, so a regression fails fast rather than hanging the suite.
Distinguishes the two validator constructors by signature:
- NewIDTokenValidator(iss, aud, azp []string) — allowlist semantics
- NewAccessTokenValidator(iss, aud []string, requiredScopes ...string) — requirement semantics
Variadic scopes read naturally at the call site:
NewAccessTokenValidator(issuers, audiences, "openid", "profile")
Three-state semantics preserved:
no args → scope not checked
[]string{}... → scope must be present (any value)
"openid", ... → scope must contain all listed values
Also removes the old gracePeriod parameter from both constructors
(was 0 at all call sites; set GracePeriod on the struct directly
if a non-default value is needed).
Adds TestCov_NewAccessTokenValidator_Scopes covering all three cases.
Default matrix (conservative, CGO_ENABLED=0):
goos: darwin freebsd js linux netbsd openbsd wasip1 windows
goarch: amd64 arm arm64 mips64le mipsle ppc64le riscv64 wasm
goarm: 6 7 (always included when arm is in goarch)
--almost-all widens to esoteric goos (aix dragonfly illumos plan9
solaris), adds 386/loong64/mips/mips64/ppc64/s390x to goarch, and
emits goamd64: v1 v2 v3 v4.
--ios generates an active iOS build entry (CGO_ENABLED=1, arm64)
instead of the default commented stub.
--android-ndk generates an active Android NDK build entry
(CGO_ENABLED=1, arm64) instead of the default commented stub.
Both --ios and --android-ndk are available on init and release.
The existing -A flag (include hidden dirs) is unchanged.
When a module has more than one binary, the shared build options (env,
ldflags, goos) are defined once via a YAML anchor on the first build and
merged into the rest with <<: *build_defaults. Single-binary modules use
plain fields with no anchor overhead.
- id: gsheet2csv - id: gsheet2csv
binary: gsheet2csv binary: gsheet2csv
env: → <<: &build_defaults
- CGO_ENABLED=0 env:
goos: - CGO_ENABLED=0
- aix goos:
- ... - aix
- id: gsheet2env - ...
binary: gsheet2env - id: gsheet2env
env: binary: gsheet2env
- CGO_ENABLED=0 <<: *build_defaults
goos: ...
The commented-out ios stubs follow the same pattern using a separate
build_defaults_ios anchor so they remain consistent when uncommented.
Also extracts defaultGoos to a package-level var to avoid repetition.
Replace linux/windows/darwin with the full CGO_ENABLED=0 goos list:
aix, darwin, dragonfly, freebsd, illumos, js, linux, netbsd, openbsd,
plan9, solaris, wasip1, windows
Add commented-out stanzas for each binary for platforms that require extra
tooling:
- iOS (CGO_ENABLED=1, Xcode toolchain required)
- Android (CGO_ENABLED=0 arm64-only; NDK required for full CGO builds)
Archive formats unchanged (tar.gz + tar.zst / zip + tar.gz for Windows).
release subcommand:
- Replace yamlLooksCorrect with yamlIsCompatible: file is considered OK if
{{ .ProjectName }} is absent AND at least one binary's VERSION string is
present. Extra hand-edited binaries (like fixtures) no longer trigger a
rewrite.
- Before overwriting an existing file, prompt the user [Y/n]. --yes does
not skip this prompt; --force does. If stdin is not a terminal and
--force is not set, the command errors rather than silently clobbering.
init subcommand: unchanged — still uses the strict yamlLooksCorrect check
(all binaries must be present, ldflags must include main.version).
gh release create now always uses --draft --prerelease so artifacts can be
uploaded before the release becomes visible. A final "Finalise release
visibility" step then runs gh release edit to remove whichever flags should
not remain:
--draft=false unless --draft flag given (keep as draft)
--prerelease=false unless --prerelease flag given OR the tag has a
pre-release suffix (-pre3, .dirty, etc.)
Flag meaning change:
--draft = keep release in draft state after uploading (don't publish)
--prerelease = keep release marked pre-release even for clean vX.Y.Z tags
The gh release create flags are now explicit and always emitted:
--draft / --draft=false
--prerelease / --prerelease=false
Publish step (gh release edit --draft=false) logic:
--draft --prerelease : NO (stays as draft pre-release)
--draft only : YES (draft needs publishing)
--prerelease only : NO (published immediately as pre-release)
neither : NO (published immediately)
The step prompt adapts: "create draft pre-release / draft / pre-release /
GitHub release <tag>" depending on the flag combination.
Replace printModuleScript (which emitted a bash script to stdout) with an
interactive step runner for the release subcommand:
- Each step shows the command(s) it will run, then prompts [Y/n]
- --dry-run: show steps without prompting or running (replaces old default)
- --yes: run all steps without prompting (happy-path automation)
New types/functions:
releaseStep — title, prompt, display lines, skip flag, run func
printModuleHeader — extracted header/info block (always shown)
buildModuleSteps — constructs the ordered step list for one module
runSteps — executes steps per dryRun/yes flags
execIn — runs a command streaming to the terminal
execInEnv — like execIn with extra environment variables
Goreleaser archive globs are expanded at step-run time (after goreleaser
has built the dist/ directory) rather than being passed as shell globs.
The gh release create --notes flag receives the notes string directly
instead of via a shell variable.
When an existing .goreleaser.yaml passes yamlLooksCorrect() and needs no
update, both init and release now print:
found config ./cmd/tcpfwd/.goreleaser.yaml with monorepo support
Path is shown relative to cwd (via cwdRelPath helper).
