Prepare v0.3.0 (#132)

Comment commands address the adopter's own App. v0.2.0's fixed prefix
fixed the multi-tenant bug and gave up GitHub's autocomplete, which only
offers accounts with repository access and is the whole reason a handle
beats a prefix.

Also fixes the release check itself: it matched the Go version pin as a
fixed string, so gofmt realigning that constant made it fail on this very
release. A check a formatter can invalidate is worse than none.

Author: charlesgreen

.github/workflows/simplycubed.yml

@@ -48,7 +48,7 @@ on:
         type: string
       version:
         description: SimplyCubed CLI tag to install.
-        default: v0.2.0
+        default: v0.3.0
         required: false
         type: string
     secrets:

CHANGELOG.md

@@ -3,6 +3,51 @@
 All notable changes are recorded here and summarized again in the matching
 GitHub release notes for each tag.
 
+## v0.3.0
+
+**Comment commands address your own App.** v0.2.0 replaced `@simplycubed-code`
+with `/simplycubed`, which fixed the multi-tenant bug and gave up the only thing
+that makes a handle worth having. GitHub offers accounts **with repository
+access** in its autocomplete, so a real mention completes after someone types
+`@a` without them knowing the bot's name. A prefix that is not an account cannot
+do that, and typing `/` opens GitHub's own menu, which is a fixed set of five
+built-ins and matches nothing.
+
+**Breaking.** `.github/simplycubed.yml` gains a required `appName:`,
+`simplycubed init` requires `--app-name`, and the comment prefix changes again.
+Re-run `simplycubed init --workflow --app-name <your-app>` to regenerate both
+files.
+
+- **`appName:` is the source of truth**, and the parser, help text,
+  unknown-command reply, and wrong-surface replies all render from it. The agent
+  can no longer tell anyone to mention a different account. It accepts
+  `acme-code`, `@acme-code`, or `acme-code[bot]`, because all three are how
+  people write the same App.
+- **The workflow trigger stays a literal**, written by `init` from that same
+  value. A workflow decides whether to start before any code runs, so matching
+  loosely there would mint a token, check out, install Go, install the CLI and
+  start a sandbox — roughly thirty seconds — every time someone mentioned a
+  colleague, to then do nothing.
+- **`preflight` fails when the two disagree.** The handle necessarily lives in
+  two files and the App can push only one of them, since it holds no `workflows`
+  permission by design. Drift is silent in the worst way: comments stop working
+  with no error anywhere. The check names both values and says to re-run `init`.
+- **`--app-name` is required at first install**, with an error that explains the
+  name is yours rather than merely demanding a flag. Re-running `init` without
+  it keeps whatever the config already says, so upgrading cannot silently change
+  the handle a team already types.
+- The install commands in the README and `docs/setup.md` show `<release-tag>`
+  with a link to Releases, and `scripts/verify-release.sh` now also pins the
+  README's "Current release" banner. v0.2.0 shipped with that banner still
+  announcing v0.1.9, because it was prose rather than a checked pin.
+- **`scripts/verify-release.sh` no longer breaks on formatting.** It matched the
+  Go version pin as a fixed string, so gofmt realigning that constant made the
+  check fail on the very release it was meant to guard. It now matches with a
+  regex that tolerates the alignment.
+- The README leads with what the product is. It opened with a dry run, ten lines
+  before the overview, and carried three consecutive install sections that all
+  pointed at `docs/setup.md`.
+
 ## v0.2.0
 
 **This release makes the product installable by someone who is not us.** Every

README.md

@@ -4,7 +4,7 @@
 
 SimplyCubed Code is an autonomous coding agent you install into your own GitHub. Your team files an issue, the agent prepares a pull request in your repository, and one of your reviewers decides whether it ships.
 
-> Beta. Current release: `v0.2.0`. Product overview: [simplycubed.com/code](https://simplycubed.com/code?utm_source=github&utm_medium=readme&utm_campaign=code). See [Status](#status).
+> Beta. Current release: `v0.3.0`. Product overview: [simplycubed.com/code](https://simplycubed.com/code?utm_source=github&utm_medium=readme&utm_campaign=code). See [Status](#status).
 
 ## Product overview
 
@@ -36,7 +36,7 @@ go install github.com/simplycubed/code/cmd/simplycubed@<release-tag>
 simplycubed version
 ```
 
-With `v0.2.0`, that prints `0.2.0`. Pre-1.0 releases follow semver with the
+With `v0.3.0`, that prints `0.3.0`. Pre-1.0 releases follow semver with the
 usual caveat: minor versions may still change behavior. Pin the tag you have
 validated rather than floating on `@latest`.
 
@@ -227,7 +227,7 @@ The GitHub App identity is your own App's `[bot]` account. That bot is the singl
 
 ## Status
 
-Beta, and honest about it. Two loops run end to end via the CLI on the Codex-on-Azure engine: issue to pull request, and fix-on-request (a human requests changes, the fixer addresses them and pushes back). `v0.2.0` is the latest release and you should still expect rough edges.
+Beta, and honest about it. Two loops run end to end via the CLI on the Codex-on-Azure engine: issue to pull request, and fix-on-request (a human requests changes, the fixer addresses them and pushes back). `v0.3.0` is the latest release and you should still expect rough edges.
 
 Roadmap, roughly in order:
 

cmd/simplycubed/main.go

@@ -150,7 +150,7 @@ gate:
 `
 
 const (
-	latestKnownWorkflowTag     = "v0.2.0"
+	latestKnownWorkflowTag     = "v0.3.0"
 	callerWorkflowTagToken     = "__SIMPLYCUBED_TAG__"
 	callerWorkflowAppNameToken = "__SIMPLYCUBED_APP_NAME__"
 )

docs/setup.md

@@ -30,7 +30,7 @@ go install github.com/simplycubed/code/cmd/simplycubed@<release-tag>
 simplycubed version
 ```
 
-With `v0.2.0`, `simplycubed version` prints `0.2.0`.
+With `v0.3.0`, `simplycubed version` prints `0.3.0`.
 
 2. In the target repository, generate the setup files and labels:
 

docs/templates/simplycubed-caller.yml

@@ -11,7 +11,7 @@ on:
 jobs:
   run:
     if: ${{ github.event_name == 'issues' && github.event.label.name == 'sc:go' }}
-    uses: simplycubed/code/.github/workflows/simplycubed.yml@v0.2.0
+    uses: simplycubed/code/.github/workflows/simplycubed.yml@v0.3.0
     with:
       ref: ${{ github.event.issue.number }}
       github-app-client-id: ${{ vars.SIMPLYCUBED_GH_APP_CLIENT_ID }}
@@ -27,7 +27,7 @@ jobs:
     if: >-
       github.event_name == 'pull_request_review' &&
       contains(fromJSON('["OWNER","MEMBER","COLLABORATOR"]'), github.event.review.author_association)
-    uses: simplycubed/code/.github/workflows/simplycubed.yml@v0.2.0
+    uses: simplycubed/code/.github/workflows/simplycubed.yml@v0.3.0
     with:
       ref: ${{ github.event.pull_request.number }}
       github-app-client-id: ${{ vars.SIMPLYCUBED_GH_APP_CLIENT_ID }}
@@ -50,7 +50,7 @@ jobs:
       github.event.comment.user.type != 'Bot' &&
       startsWith(github.event.comment.body, '@your-app-name') &&
       contains(fromJSON('["OWNER","MEMBER","COLLABORATOR"]'), github.event.comment.author_association)
-    uses: simplycubed/code/.github/workflows/simplycubed.yml@v0.2.0
+    uses: simplycubed/code/.github/workflows/simplycubed.yml@v0.3.0
     with:
       ref: ${{ github.event.issue.number }}
       github-app-client-id: ${{ vars.SIMPLYCUBED_GH_APP_CLIENT_ID }}

scripts/verify-release.sh

@@ -30,14 +30,18 @@ fi
 # <release-tag> with a link to Releases, so they are not pinned here.
 fail=0
 for pin in \
-  "cmd/simplycubed/main.go:latestKnownWorkflowTag = \"${version}\"" \
+  "cmd/simplycubed/main.go:latestKnownWorkflowTag[[:space:]]*= \"${version}\"" \
   "docs/templates/simplycubed-caller.yml:simplycubed.yml@${version}" \
   ".github/workflows/simplycubed.yml:default: ${version}" \
   "README.md:Current release: \`${version}\`"
 do
   file="${pin%%:*}"
   needle="${pin#*:}"
-  if ! grep -qF "${needle}" "${file}"; then
+  # Extended regex, not a fixed string: the Go pin is a constant whose alignment
+  # gofmt controls, so adding another constant to the same block silently broke
+  # an exact match. A release check that a formatter can invalidate is worse
+  # than none, because it fails on the one change it was meant to guard.
+  if ! grep -qE "${needle}" "${file}"; then
     echo "${file} does not pin ${version} (expected to find: ${needle})" >&2
     fail=1
   fi