Bump version to 0.5.0

.github/workflows/dotslash-config.json

@@ -1,28 +1,33 @@
 {
-    "outputs": {
-      "pks": {
-        "platforms": {
-          "macos-x86_64": {
-            "regex": "^pks-mac",
-            "path": "pks",
-            "format": "tar.gz"
-          },
-          "macos-aarch64": {
-            "regex": "^pks-mac",
-            "path": "pks",
-            "format": "tar.gz"
-          },
-          "linux-x86_64": {
-            "regex": "^x86_64-unknown-linux",
-            "path": "pks",
-            "format": "tar.gz"
-          },
-          "linux-aarch64": {
-            "regex": "^aarch64-unknown-linux",
-            "path": "pks",
-            "format": "tar.gz"
-          }
+  "outputs": {
+    "pks": {
+      "platforms": {
+        "macos-aarch64": {
+          "name": "pks-aarch64-apple-darwin.tar.xz",
+          "path": "pks-aarch64-apple-darwin/pks",
+          "format": "tar.xz"
+        },
+        "macos-x86_64": {
+          "name": "pks-x86_64-apple-darwin.tar.xz",
+          "path": "pks-x86_64-apple-darwin/pks",
+          "format": "tar.xz"
+        },
+        "linux-aarch64": {
+          "name": "pks-aarch64-unknown-linux-gnu.tar.xz",
+          "path": "pks-aarch64-unknown-linux-gnu/pks",
+          "format": "tar.xz"
+        },
+        "linux-x86_64": {
+          "name": "pks-x86_64-unknown-linux-gnu.tar.xz",
+          "path": "pks-x86_64-unknown-linux-gnu/pks",
+          "format": "tar.xz"
+        },
+        "windows-x86_64": {
+          "name": "pks-x86_64-pc-windows-msvc.zip",
+          "path": "pks.exe",
+          "format": "zip"
         }
       }
     }
-  }
+  }
+}

.github/workflows/publish-dotslash.yml

@@ -0,0 +1,35 @@
+# Adds a DotSlash `pks` file to each GitHub Release. release.yml (generated by
+# dist) calls this after the release is published, via `post-announce-jobs` in
+# dist-workspace.toml. It can't be a separate `on: release` workflow: dist
+# creates the release with GITHUB_TOKEN, and events from GITHUB_TOKEN don't
+# trigger other workflows.
+#
+# The action uploads without --clobber, so re-running this job after the `pks`
+# asset is on the release fails. Delete it first:
+#   gh release delete-asset <tag> pks --yes
+name: Publish DotSlash file
+
+on:
+  workflow_call:
+    inputs:
+      plan:
+        required: true
+        type: string
+
+permissions: {}
+
+jobs:
+  publish-dotslash:
+    name: Generate and upload the DotSlash file
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write # `gh release upload` adds the DotSlash file to the release
+    steps:
+      # Reads .github/workflows/dotslash-config.json through the API at the
+      # released commit, so there's no checkout.
+      - uses: facebook/dotslash-publish-release@9c9ec027515c34db9282a09a25a9cab5880b2c52 # v2
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        with:
+          config: .github/workflows/dotslash-config.json
+          tag: ${{ fromJson(inputs.plan).announcement_tag }}

.github/workflows/release.yml

@@ -302,3 +302,14 @@ jobs:
         with:
           persist-credentials: false
           submodules: recursive
+
+  custom-publish-dotslash:
+    needs:
+      - plan
+      - announce
+    uses: ./.github/workflows/publish-dotslash.yml
+    with:
+      plan: ${{ needs.plan.outputs.val }}
+    secrets: inherit
+    permissions:
+      "contents": "write"

.github/zizmor.yml

@@ -31,3 +31,13 @@ rules:
       # This repo configures no custom container runners, so matrix.container is
       # always null and no image is ever pulled.
       - release.yml
+  secrets-inherit:
+    ignore:
+      # dist calls every custom job (`post-announce-jobs` in dist-workspace.toml)
+      # with `secrets: inherit`. The only one is publish-dotslash.yml in this
+      # repo, which uses nothing but GITHUB_TOKEN.
+      - release.yml
+  self-repository:
+    ignore:
+      # dist calls custom jobs as `./.github/workflows/<name>.yml`.
+      - release.yml

CHANGELOG.md

@@ -1,12 +1,6 @@
 # Changelog
 
-<!-- Whoever cuts the next release: retitle `## Unreleased` below to the version
-     being tagged. `.github/workflows/release.yml` builds the GitHub Release body
-     from cargo-dist's `announcement_github_body`, which matches a heading against
-     the tag, so an entry left under `## Unreleased` silently misses the release
-     notes. Pre-1.0, the breaking change below wants 0.5.0 rather than 0.4.x. -->
-
-## Unreleased
+## 0.5.0
 
 ### Breaking Changes
 
@@ -67,6 +61,44 @@ files are grandfathering:
 pks check --ignore-recorded-violations
 ```
 
+### Fixes
+
+#### Recorded violations in strict packs match their `package_todo.yml` entries
+
+`package_todo.yml` has no field for `strict`, so a recorded violation in a pack
+with a strict checker never matched its entry. `check` reported it as a new
+violation and reported its todo entry as stale. Neither happens now, and
+`--ignore-recorded-violations` no longer prints a spurious stale-todo line for
+those entries.
+
+#### Removed stray debug output from the privacy checker
+
+A leftover `dbg!` wrote two lines to stderr for every reference checked against
+a pack's `private_constants`, in release builds too.
+
+### Performance
+
+#### `pks check` compiles the inflector's regexes once
+
+Constant-name inflection compiled its regexes on every call, roughly 50k times
+per run on a large codebase. They're now compiled once, which cut total CPU time
+for `pks check` by about 45% on a large application.
+
+### Distribution
+
+#### Releases are built by cargo-dist
+
+This is the first release built by cargo-dist. Each release now publishes
+`pks-<target>.tar.xz` archives for macOS and Linux, a `.zip` for Windows, and
+`pks-installer.sh` and `pks-installer.ps1` installer scripts. The old asset names
+(`pks-mac.tar.gz`, `x86_64-unknown-linux-gnu.tar.gz` and
+`aarch64-unknown-linux-gnu.tar.gz`) are no longer published, so anything that
+downloads release assets by name needs updating.
+
+The dotslash `pks` file is still published under the same name. It now points
+at the new archives, and it covers Windows as well as macOS and Linux. See
+[INSTALLATION.md](https://github.com/rubyatscale/pks/blob/v0.5.0/INSTALLATION.md).
+
 ### Internal
 
 #### Replaced `serde_yaml` with `yaml_serde`

Cargo.toml

@@ -2,7 +2,7 @@
 
 [package]
 name = "pks"
-version = "0.4.0"
+version = "0.5.0"
 edition = "2021"
 description = "Welcome! Please see https://github.com/rubyatscale/pks for more information!"
 license = "MIT"

INSTALLATION.md

@@ -1,12 +1,34 @@
 # Installation
-## Option 1:
-- Install [dotslash](https://dotslash-cli.com/docs/installation/)
-- Download the latest packs release dotslash `pks` file. Example: https://github.com/rubyatscale/pks/releases/tag/v0.2.21/pks
-- Save the `pks` file to your ruby project's bin/ directory. You'll then have a `bin/pks` file in your project.
-- Use `bin/pks` to execute the CLI.
 
-## Option 2:
+## Option 1: dotslash
+
+- Install [dotslash](https://dotslash-cli.com/docs/installation/).
+- Download the `pks` DotSlash file from a release, for example https://github.com/rubyatscale/pks/releases/latest/download/pks, and save it to your Ruby project's `bin/` directory.
+- Run `bin/pks`.
+
+The file pins that release's binaries by hash, so everyone working on the project runs the same version. It covers macOS, Linux (x86_64 and aarch64), and Windows (x86_64).
+
+## Option 2: Prebuilt binary
+
+From v0.5.0, every release publishes prebuilt binaries for macOS, Linux, and Windows, along with installer scripts that put `pks` in `$CARGO_HOME/bin` (usually `~/.cargo/bin`).
+
+macOS and Linux:
+
+```sh
+curl --proto '=https' --tlsv1.2 -LsSf https://github.com/rubyatscale/pks/releases/latest/download/pks-installer.sh | sh
+```
+
+Windows (PowerShell):
+
+```powershell
+powershell -ExecutionPolicy Bypass -c "irm https://github.com/rubyatscale/pks/releases/latest/download/pks-installer.ps1 | iex"
+```
+
+To pin a version, replace `latest/download` with `download/v0.5.0` (or whichever version you want). You can also download a `pks-<target>.tar.xz` archive, or the `.zip` on Windows, straight from the [releases page](https://github.com/rubyatscale/pks/releases).
+
+## Option 3: Build from source
+
 - Install Rust: https://www.rust-lang.org/tools/install
-  - Note: If `which cargo` returns a path, skip this step!
-  - TLDR: `curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh`, and you're done!
-- `cargo install pks` (it's like `gem install`)
+- `cargo install --git https://github.com/rubyatscale/pks`
+
+Note that `cargo install pks` installs the crates.io `pks` crate, which is the original [alexevanczuk/packs](https://github.com/alexevanczuk/packs) at 0.2.40, not this repository.

dist-workspace.toml

@@ -24,6 +24,11 @@ install-path = "CARGO_HOME"
 install-updater = false
 # Link build artifacts to the process which created it
 github-attestations = true
+# Add a DotSlash `pks` file to each release once it's published
+post-announce-jobs = ["./publish-dotslash"]
+
+[dist.github-custom-job-permissions]
+"publish-dotslash" = { contents = "write" }
 
 # Pin the GitHub Actions that dist generates into release.yml to exact commits
 # rather than floating tags, so a compromised or retagged upstream release can't