From 4418d3fe69c76c927c16efd5101eec1029d02cff Mon Sep 17 00:00:00 2001 From: Codevena Date: Fri, 12 Jun 2026 07:59:53 +0100 Subject: [PATCH] release: v0.5.0 (version bump, fresh SHA256SUMS, changelog) - Bump VERSION/headers/banner/DEFAULT_REF and README install pins 0.4.0 -> 0.5.0. - Recompute SHA256SUMS for the current fixbuddy.sh / fixbuddy-wizard.sh (the old sums were stale, from before the audit fixes and new features). - Add CHANGELOG.md documenting the 0.5.0 release. Prepares the v0.5.0 tag/release for Marketplace publication. The install.sh ref + README pins point at v0.5.0, which the tag (pushed after merge) provides. --- CHANGELOG.md | 52 ++++++++++++++++++++++++++++++++++++++++++++++ README.md | 6 +++--- SHA256SUMS | 4 ++-- fixbuddy-wizard.sh | 4 ++-- fixbuddy.sh | 4 ++-- install.sh | 10 ++++----- 6 files changed, 66 insertions(+), 14 deletions(-) create mode 100644 CHANGELOG.md diff --git a/CHANGELOG.md b/CHANGELOG.md new file mode 100644 index 0000000..2f3c28e --- /dev/null +++ b/CHANGELOG.md @@ -0,0 +1,52 @@ +# Changelog + +All notable changes to fixbuddy are documented here. The format is based on +[Keep a Changelog](https://keepachangelog.com/), and this project aims to follow +[Semantic Versioning](https://semver.org/). + +## [0.5.0] - 2026-06-12 + +Security hardening from a full audit, plus five new features. No breaking changes +to existing flags. + +### Added +- **`--issue N`** (repeatable) — fix specific issues, fetched directly via + `gh issue view` (no 200-item list blind spot). Dedup filters and + `--label`/`--severity` still apply; non-actionable numbers warn distinctly. +- **`--check-cmd 'CMD'`** (repeatable) — a deterministic test gate that runs in + the project dir after the fix commit and before review. A non-zero exit is + treated like a review rejection (retried with the output as feedback, then + `fix:rejected` on exhaustion), so it also gates auto-merge. Output is capped. +- **Config files** — `~/.fixbuddy/config` then `./.fixbuddy.conf`, safe-parsed + with no `eval`/`source`; CLI flags override. The wizard offers to write one. +- **`--auto-merge`** flag — explicit counterpart to `--no-auto-merge`, so a + config `auto_merge = false` can be overridden from the CLI. +- **`fix:needs-human`** label — separates deterministic blockers (human needed) + from `fix:blocked` (crash/timeout, auto-requeues). +- **Ctrl-C/abort handling** — an interrupted run kills the in-flight agent, + cleans up the local branch, and resumes the issue on the next run. + +### Changed +- **`--dry-run` is now fully read-only** — it previously created labels and ran + the unstick scan before the dry-run check. It now mutates nothing and prints + the planned config (including `--check-cmd` strings) and respects `--max`. +- CI uses `actions/checkout@v5` (Node 24); `main` has branch protection. + +### Fixed (security & robustness) +- Auto-merge no longer falls back to an immediate squash that bypassed CI. +- Issue **titles** are sanitized and marked untrusted in agent prompts + (prompt-injection vector); `GH_TOKEN`/`GITHUB_TOKEN` are stripped from agent + environments; the review diff is wrapped in a sentinel block. +- Crash on stock macOS Bash 3.2 (empty array under `set -u`) fixed. +- BSD/macOS `sed` portability; numeric-option validation; fail-closed on `gh` + errors; base-branch auto-detect works in GitHub Actions; `gh auth setup-git` + so a custom `github-token` reaches `git push`. +- Reviewer feedback is no longer truncated to its first line; watchdog timeout + classification fixed; stale `fix:blocked`/`fix:rejected` labels are removed at + success endpoints. + +## [0.4.0] and earlier + +Predate this changelog. See the git history and the `v0.4.0` / `v0.3.2` tags. + +[0.5.0]: https://github.com/Codevena/fixbuddy/compare/v0.4.0...v0.5.0 diff --git a/README.md b/README.md index 67f051b..57d4c82 100644 --- a/README.md +++ b/README.md @@ -58,15 +58,15 @@ VERIFY -> FIX -> REVIEW -> PUSH/PR -> optional auto-merge Install with the one-liner (macOS and Linux, including WSL2): ```bash -curl -fsSL https://raw.githubusercontent.com/Codevena/fixbuddy/v0.4.0/install.sh | bash +curl -fsSL https://raw.githubusercontent.com/Codevena/fixbuddy/v0.5.0/install.sh | bash ``` -This downloads the pinned `v0.4.0` scripts into `~/.local/bin` (or `/usr/local/bin`), makes them executable, and prints a PATH hint if needed. Override the location with `| bash -s -- --prefix /custom/bin` or track the latest commit with `--ref main`. +This downloads the pinned `v0.5.0` scripts into `~/.local/bin` (or `/usr/local/bin`), makes them executable, and prints a PATH hint if needed. Override the location with `| bash -s -- --prefix /custom/bin` or track the latest commit with `--ref main`. **Prefer to read before you run?** The installer is short — inspect it first, then run it: ```bash -curl -fsSL https://raw.githubusercontent.com/Codevena/fixbuddy/v0.4.0/install.sh -o install.sh +curl -fsSL https://raw.githubusercontent.com/Codevena/fixbuddy/v0.5.0/install.sh -o install.sh less install.sh # read it bash install.sh # then run it ``` diff --git a/SHA256SUMS b/SHA256SUMS index b584f72..931d51f 100644 --- a/SHA256SUMS +++ b/SHA256SUMS @@ -1,2 +1,2 @@ -63162498d361d9d88efbbf0879b04406a89378729b65fd49d0389c26f196f781 fixbuddy.sh -b2218aaea15a45175ec45efca99a4174e80e41312676fce3540c6740ec8b6e51 fixbuddy-wizard.sh +288eda7831f6b3bd7078417e46ac8270a7f8b0175a288748cf9f3bac55c23cb8 fixbuddy.sh +d6868daf05471c46ab969fe50b441af004d6622f664c529912da82d91665ac73 fixbuddy-wizard.sh diff --git a/fixbuddy-wizard.sh b/fixbuddy-wizard.sh index 61ef350..354a354 100755 --- a/fixbuddy-wizard.sh +++ b/fixbuddy-wizard.sh @@ -1,5 +1,5 @@ #!/usr/bin/env bash -# fixbuddy-wizard.sh v0.4.0 — beginner-friendly launcher for fixbuddy.sh +# fixbuddy-wizard.sh v0.5.0 — beginner-friendly launcher for fixbuddy.sh # # Walks a user through the required flags via interactive prompts, validates # prerequisites, shows a preview of the exact command, and then exec's fixbuddy.sh. @@ -32,7 +32,7 @@ printf "%s" "${MAG}${BOLD}" cat <<'EOF' ╔═══════════════════════════════════════════════════╗ - ║ fixbuddy wizard v0.4.0 ║ + ║ fixbuddy wizard v0.5.0 ║ ║ Turn GitHub issues into reviewed PRs ║ ╚═══════════════════════════════════════════════════╝ EOF diff --git a/fixbuddy.sh b/fixbuddy.sh index a0d619d..7bd5a2b 100755 --- a/fixbuddy.sh +++ b/fixbuddy.sh @@ -1,5 +1,5 @@ #!/usr/bin/env bash -# fixbuddy v0.4.0 — two-agent pipeline for autonomous issue fixing +# fixbuddy v0.5.0 — two-agent pipeline for autonomous issue fixing # # Pipeline per issue: # 1. VERIFY (fix-agent) — is this real? → PROCEED / FALSE-POSITIVE / BLOCKED @@ -47,7 +47,7 @@ # config-provided label/check cannot be removed from the CLI. set -uo pipefail -VERSION="0.4.0" +VERSION="0.5.0" # -------- Defaults -------- REPO="" diff --git a/install.sh b/install.sh index 5392056..d02e77c 100755 --- a/install.sh +++ b/install.sh @@ -2,12 +2,12 @@ # install.sh — installer for fixbuddy (https://github.com/Codevena/fixbuddy) # # Quick install: -# curl -fsSL https://raw.githubusercontent.com/Codevena/fixbuddy/v0.4.0/install.sh | bash +# curl -fsSL https://raw.githubusercontent.com/Codevena/fixbuddy/v0.5.0/install.sh | bash # # Options (pass after the URL as: | bash -s -- ): # --prefix PATH Install into PATH instead of the auto-detected location # --ref TAG Install the fixbuddy scripts from a specific git ref. -# Default: v0.4.0. Use --ref main for the latest commit. +# Default: v0.5.0. Use --ref main for the latest commit. # -y, --yes Skip the sudo confirmation prompt # -h, --help Show this help and exit # @@ -16,7 +16,7 @@ set -euo pipefail REPO_SLUG="Codevena/fixbuddy" -DEFAULT_REF="v0.4.0" +DEFAULT_REF="v0.5.0" RAW_BASE="https://raw.githubusercontent.com/${REPO_SLUG}" SCRIPTS=(fixbuddy.sh fixbuddy-wizard.sh) @@ -40,11 +40,11 @@ usage() { cat >&2 <<'EOF' install.sh — installer for fixbuddy - curl -fsSL https://raw.githubusercontent.com/Codevena/fixbuddy/v0.4.0/install.sh | bash + curl -fsSL https://raw.githubusercontent.com/Codevena/fixbuddy/v0.5.0/install.sh | bash Options (pass as: | bash -s -- ): --prefix PATH Install into PATH instead of the auto-detected location - --ref TAG Install fixbuddy scripts from a specific git ref (default: v0.4.0; + --ref TAG Install fixbuddy scripts from a specific git ref (default: v0.5.0; use --ref main for the latest commit) -y, --yes Skip the sudo confirmation prompt -h, --help Show this help and exit