[qlty-releases]

Automated release preparation for v2.5.0.

Review (and edit, if needed) the changelog entry below, then
merge this pull request. Merging does not tag or publish anything.

To publish, a maintainer tags the merged commit on main and pushes
the tag. The Release workflow verifies the tag and publishes the
GitHub release from it:

git fetch origin main
git tag -s v2.5.0 origin/main -m "v2.5.0"
git push origin v2.5.0

Then point the major tag at the new release:

git tag -f v2 v2.5.0
git push --force origin v2

Draft release notes

Improved

• The Qlty CLI must now pass its attestation check before it runs. If no attestation matches the downloaded CLI, or the check rejects it, the step fails, including in the coverage action with skip-errors: true. Pinning cli-version to a release older than 0.555.0, which have no attestation, now fails; remove cli-version or set a current release (Treat a missing attestation as a verification failure #212)
• When the attestation check cannot finish because GitHub or Sigstore is unavailable, the coverage action follows skip-errors: with skip-errors: true it logs the error and passes the step without running the CLI. The install and fmt actions fail (Let skip-errors cover an attestation check that cannot finish #216)
• The attestation check needs GitHub CLI (gh) 2.67.0 or later. Without a usable gh, as on many self-hosted runners and container: jobs, the actions log a warning that the run is unverified and continue (Treat a missing attestation as a verification failure #212)
• The attestation lookup always goes to github.com, even when GH_HOST points at GitHub Enterprise; in that case set github-token to a github.com token (Treat a missing attestation as a verification failure #212)

[qltysh]

Coverage Impact

This PR will not change total coverage.

🚦 See full report on Qlty Cloud »

🛟 Help

• Diff Coverage: Coverage for added or modified lines of code (excludes deleted files). Learn more.

• Total Coverage: Coverage for the whole repository, calculated as the sum of all File Coverage. Learn more.

• File Coverage: Covered Lines divided by Covered Lines plus Missed Lines. (Excludes non-executable lines including blank lines and comments.)

  • Indirect Changes: Changes to File Coverage for files that were not modified in this PR. Learn more.