netresearch/typo3-ci-workflows

This repository releases itself (#210, #213).

Ten tags between v1.4.0 and v1.8.2 carried no Release object, so releases/latest answered v1.3.4 from 2026-08-04. The cause was not a withheld decision: every workflow here that mentions tags: is a workflow_call reusable for consumers, and the only push trigger was self-ci on branches. release.yml is a path this repository offers, not one it took.

self-release.yml now fires on a signed tag push and runs the same chain the skill repos run: verify the tag is annotated and signed, build, checksum, Cosign sign-blob, SLSA attest, publish -- all in one job before the assets become public, so no window exists in which unattested artefacts are downloadable. The release notes are the annotated tag message, read with %(contents:body) so the SSH signature block stays out of them. The release is created with gh release create, not a third-party action.

The README gained a "Releasing This Repository" section, because the release path being knowledge nobody had written down is part of how the gap survived ten tags.

Read this before assuming the archives changed: they did not. git archive applies .gitattributes, whose export-ignore strips .github/, docs/, scripts/ and README.md -- and this release touches nothing else. The Composer payload in typo3-ci-workflows-v1.9.0.tar.gz is byte-identical to the one v1.8.2 would have produced, verified by extracting both and diffing.

That is deliberate rather than an oversight. The archive is the half worth attesting: uses: ...@main is resolved by GitHub from the git ref and never downloaded, while the runner IS installed, so a consumer can now check the copy in their .Build/vendor/netresearch/typo3-ci-workflows/ against a signed checksum. What this tag ships is the release path itself, and the first run of it.

Consumers referencing the workflows with @main are unaffected. Nothing about what a workflow does has changed -- only what a tag produces.

What's Changed

• fix(runner): find a functional config at Build/phpunit.functional.xml by @CybotTM in #208
• fix(runner): take the Playwright image tag from the consumer's lockfile by @CybotTM in #207

Full Changelog: v1.8.1...v1.8.2

What's Changed

• fix(fuzz): select the suite that was detected, not the one that was configured by @CybotTM in #200
• fix(runtests): take the web directory from composer.json instead of assuming .Build/Web by @CybotTM in #201
• fix(fuzz): report no fuzz suite instead of failing the preflight by @CybotTM in #202
• test(fuzz): run the preflight block and check its exit code by @CybotTM in #203
• fix(runner): pass the extension's php-cs-fixer config to cgl by @CybotTM in #205

Full Changelog: v1.8.0...v1.8.1

What's Changed

• fix(ci): fail a test job that has nothing to run, instead of reporting success by @CybotTM in #193
• feat(runtests): say which config was taken, and which ones were ignored by @CybotTM in #192
• feat(runtests): mark the runner's own container instead of guessing at /.dockerenv by @CybotTM in #194
• ci: retry the actionlint download instead of losing the lint job to it by @CybotTM in #195
• feat(extended-testing): take testsuite names and the Infection config from inputs by @CybotTM in #196
• feat(fuzz): run the fuzz suite when one exists, instead of only when asked by @CybotTM in #198
• feat(runtests): let an extension name the PHP image it needs by @CybotTM in #199

Full Changelog: v1.7.2...v1.8.0

What's Changed

• fix(runtests): read the conf before deriving from it, and shard the same suite the serial run does by @CybotTM in #187

Full Changelog: v1.7.1...v1.7.2

What's Changed

• fix(runtests): restore the values v1.7.0 dropped, and guard the class by @CybotTM in #184

Full Changelog: v1.7.0...v1.7.1

What's Changed

• feat(runtests): find what the extension already declares by @CybotTM in #183

Full Changelog: v1.6.0...v1.7.0

What's Changed

• feat(runtests): the suites the remaining forks still need by @CybotTM in #182

Full Changelog: v1.5.1...v1.6.0

What's Changed

• fix(runtests): stop asking for what the extension already declares by @CybotTM in #181

Full Changelog: v1.5.0...v1.5.1

What's Changed

• fix(ci): run test jobs with zend.assertions=1 by @CybotTM in #159
• Expose one stable check name so a merge queue can be gated by @CybotTM in #160
• feat(ci): add cgl-php-version input for the Code Style job by @CybotTM in #161
• Drop nosemgrep-suppressed findings before SARIF upload by @CybotTM in #163
• chore(deps): update github/codeql-action action to v4.37.6 by @renovate[bot] in #162
• chore(deps): update step-security/harden-runner action to v2.20.1 by @renovate[bot] in #164
• chore(deps): update actions/attest-build-provenance action to v4.2.2 by @renovate[bot] in #166
• fix(security): survive an unreachable advisory source without muting the audit by @CybotTM in #167
• feat(changelog): add opt-in changelog fragments, org-wide by @CybotTM in #165
• feat(ci): opt-in repo-checks job so callers need no workflow of their own by @CybotTM in #168
• chore(deps): update github/codeql-action action to v4.37.7 by @renovate[bot] in #170
• chore(deps): update step-security/harden-runner action to v2.21.0 by @renovate[bot] in #171
• feat(release): make-latest input so backport releases stop claiming Latest by @CybotTM in #176
• fix(ci): health-check the DB service with whichever client the image ships by @CybotTM in #174
• fix(e2e): cache Playwright browsers and bound the browser-install step by @CybotTM in #175
• fix(ci): retry composer over transient transport failures by @CybotTM in #177
• feat(runtests): ship the runner extensions actually use, as a composer bin by @CybotTM in #180

Full Changelog: v1.4.0...v1.5.0

Added

• v1.1 German translation.
• v1.1 Italian translation.
• v1.1 Simplified Chinese translation.
• v1.1 Persian translation.
• v1.1 Polish translation.
• v1.1 Slovenian translation.
• v1.1 Traditional Chinese translation.
• v1.1 Spanish translation.
• v1.1 Brazilian Portuguese translation.
• v1.1 Czech translation.
• v1.1 Romanian translation.
• v1.1 Swedish translation.
• v1.1 Ukrainian translation.
• v1.1 Korean translation.
• v1.1 Indonesian translation.

Fixed

• Improve French translation.
• Improve Dutch translation.

Added

• v1.1 Arabic translation.
• v1.1 French translation.
• v1.1 Dutch translation.
• v1.1 Russian translation.
• v1.1 Japanese translation.
• v1.1 Norwegian Bokmål translation.
• v1.1 "Inconsistent Changes" Turkish translation.
• Default to most recent versions available for each languages.
• Display count of available translations (26 to date!).
• Centralize all links into /data/links.json so they can be updated easily.

Fixed

• Improve French translation.
• Improve id-ID translation.
• Improve Persian translation.
• Improve Russian translation.
• Improve Swedish title.
• Improve zh-CN translation.
• Improve French translation.
• Improve zh-TW translation.
• Improve Spanish (es-ES) transltion.
• Foldout menu in Dutch translation.
• Missing periods at the end of each change.
• Fix missing logo in 1.1 pages.
• Display notice when translation isn't for most recent version.
• Various broken links, page versions, and indentations.

Changed

• Upgrade dependencies: Ruby 3.2.1, Middleman, etc.

Removed

• Unused normalize.css file.
• Identical links assigned in each translation file.
• Duplicate index file for the english version.

Added

• Danish translation.
• Georgian translation from.
• Changelog inconsistency section in Bad Practices.

Fixed

• Italian translation.
• Indonesian translation.

Added

• New visual identity by [@tylerfortune8].
• Version navigation.
• Links to latest released version in previous versions.
• "Why keep a changelog?" section.
• "Who needs a changelog?" section.
• "How do I make a changelog?" section.
• "Frequently Asked Questions" section.
• New "Guiding Principles" sub-section to "How do I make a changelog?".
• Simplified and Traditional Chinese translations from [@tianshuo].
• German translation from [@mpbzh] & [@Art4].
• Italian translation from [@azkidenz].
• Swedish translation from [@magol].
• Turkish translation from [@emreerkan].
• French translation from [@zapashcanon].
• Brazilian Portuguese translation from [@Webysther].
• Polish translation from [@amielucha] & [@m-aciek].
• Russian translation from [@aishek].
• Czech translation from [@h4vry].
• Slovak translation from [@jkostolansky].
• Korean translation from [@pierceh89].
• Croatian translation from [@porx].
• Persian translation from [@Hameds].
• Ukrainian translation from [@osadchyi-s].

Changed

• Start using "changelog" over "change log" since it's the common usage.
• Start versioning based on the current English version at 0.3.0 to help translation authors keep things up-to-date.
• Rewrite "What makes unicorns cry?" section.
• Rewrite "Ignoring Deprecations" sub-section to clarify the ideal scenario.
• Improve "Commit log diffs" sub-section to further argument against them.
• Merge "Why can’t people just use a git log diff?" with "Commit log diffs".
• Fix typos in Simplified Chinese and Traditional Chinese translations.
• Fix typos in Brazilian Portuguese translation.
• Fix typos in Turkish translation.
• Fix typos in Czech translation.
• Fix typos in Swedish translation.
• Improve phrasing in French translation.
• Fix phrasing and spelling in German translation.

Removed

• Section about "changelog" vs "CHANGELOG".