chore(deps): update dependency farcloser/limen to v0.10.0

.aqua/aqua-checksums.json

@@ -46,33 +46,33 @@
       "algorithm": "sha256"
     },
     {
-      "id": "github_release/github.com/farcloser/limen/v0.9.0/limen_0.9.0_darwin_arm64.tar.gz",
-      "checksum": "BB92510A0019EE03BC520C58528EE828D108BD9D15279FA26F5BE99E23D53FCE",
+      "id": "github_release/github.com/farcloser/limen/v0.10.0/limen_0.10.0_darwin_arm64.tar.gz",
+      "checksum": "EEF33683C8EE70E11F7A1E602ED27B9CB026E2C1E88891B1F1B0DFF80C7B5C8A",
       "algorithm": "sha256"
     },
     {
-      "id": "github_release/github.com/farcloser/limen/v0.9.0/limen_0.9.0_linux_amd64.tar.gz",
-      "checksum": "7828CCC8019C6E7E582A16E9D29BB9A00F8F00F73A7B95005597129121AFCB1B",
+      "id": "github_release/github.com/farcloser/limen/v0.10.0/limen_0.10.0_linux_amd64.tar.gz",
+      "checksum": "0BF69AE78A44F0FF49742931E94A3D662290E7F67AA596853233AD188EEC61A6",
       "algorithm": "sha256"
     },
     {
-      "id": "github_release/github.com/farcloser/limen/v0.9.0/limen_0.9.0_linux_arm64.tar.gz",
-      "checksum": "845F202D468F23ED2FF4D8BA7E2B3328F98B40AD555B5C651F223F568065C9B7",
+      "id": "github_release/github.com/farcloser/limen/v0.10.0/limen_0.10.0_linux_arm64.tar.gz",
+      "checksum": "3F95240C2FA46D6B81C19D0195E82EA82F916CC265DE505E872B8728AD255CF3",
       "algorithm": "sha256"
     },
     {
-      "id": "github_release/github.com/farcloser/limen/v0.9.0/limen_0.9.0_windows_amd64.tar.gz",
-      "checksum": "250B810AC310B3A4083BB589BDB694512FB4CBD2E172B8DE000AAD698DDEB99C",
+      "id": "github_release/github.com/farcloser/limen/v0.10.0/limen_0.10.0_windows_amd64.tar.gz",
+      "checksum": "72F9F50B79D419AC42D995E4C2310EF47B7E34EF58469237008A21C61A5BA55F",
       "algorithm": "sha256"
     },
     {
-      "id": "github_release/github.com/farcloser/limen/v0.9.0/limen_0.9.0_windows_arm64.tar.gz",
-      "checksum": "2DA4558D67D975137800E35005374A3523F79F2D70D19A9FFAC47B75E73A9874",
+      "id": "github_release/github.com/farcloser/limen/v0.10.0/limen_0.10.0_windows_arm64.tar.gz",
+      "checksum": "C10C30E8FA2EEF3C76F8B8BA87DFEF24E5253D81AD2EF4056465CC207AC9B903",
       "algorithm": "sha256"
     },
     {
-      "id": "github_release/github.com/farcloser/ossein/v0.3.0/ossein_0.3.0_darwin_arm64.tar.gz",
-      "checksum": "3272F1D1117C2D4F2A8FD484963B0CE8979199D047D0FFA1D110838AB1C16E5F",
+      "id": "github_release/github.com/farcloser/ossein/v0.3.1/ossein_0.3.1_darwin_arm64.tar.gz",
+      "checksum": "82BF65F53CF064625FD09BA92E4BD91D1ADDF5DDDC1E791ABDA7F0281767DDDC",
       "algorithm": "sha256"
     },
     {
@@ -101,13 +101,13 @@
       "algorithm": "sha256"
     },
     {
-      "id": "github_release/github.com/git-for-windows/git/v2.56.0.windows.1/Git-2.56.0-64-bit.tar.bz2",
-      "checksum": "FDF531FB5C003FFF0FED1B3EF282134C9186518F284C2E10860214CE127A973B",
+      "id": "github_release/github.com/git-for-windows/git/v2.56.0.windows.2/Git-2.56.0.2-64-bit.tar.bz2",
+      "checksum": "16CA394BDB94B372267D79E1E10B68763674F73E03E0648202A7971A8A730A84",
       "algorithm": "sha256"
     },
     {
-      "id": "github_release/github.com/git-for-windows/git/v2.56.0.windows.1/Git-2.56.0-arm64.tar.bz2",
-      "checksum": "C86AEB1AFE43D2D5AFC27C4586A10795A3E28E4DDF03CDD944DFB248526BAE3D",
+      "id": "github_release/github.com/git-for-windows/git/v2.56.0.windows.2/Git-2.56.0.2-arm64.tar.bz2",
+      "checksum": "221865B66F4E6CE8F86837ACD777C4580E23DE8BF526E99DDA274C2544CAB7A0",
       "algorithm": "sha256"
     },
     {
@@ -136,28 +136,28 @@
       "algorithm": "sha256"
     },
     {
-      "id": "github_release/github.com/goreleaser/goreleaser/v2.18.2/goreleaser_Darwin_all.tar.gz",
-      "checksum": "4BFD26942AA0F78E275CAD3E49144A7C5CE2E8A34F7D0E9D34C718125766BA12",
+      "id": "github_release/github.com/goreleaser/goreleaser/v2.18.3/goreleaser_Darwin_all.tar.gz",
+      "checksum": "156F425536D40CE282B79C637CA00EB943792DE6AD1E2482A4B21CC4B5421F4F",
       "algorithm": "sha256"
     },
     {
-      "id": "github_release/github.com/goreleaser/goreleaser/v2.18.2/goreleaser_Linux_arm64.tar.gz",
-      "checksum": "A71681B29194F08F057A68CFCAA5C6B15D907A83A2622C51900C4FAFF828F322",
+      "id": "github_release/github.com/goreleaser/goreleaser/v2.18.3/goreleaser_Linux_arm64.tar.gz",
+      "checksum": "FA7011A7F8DE3B504326B8552CF21C708ED3089519B01D372DA32EF4E8D298D7",
       "algorithm": "sha256"
     },
     {
-      "id": "github_release/github.com/goreleaser/goreleaser/v2.18.2/goreleaser_Linux_x86_64.tar.gz",
-      "checksum": "0A96EDC9D9BC594E4A41CC4D59467C182062910AB24D9D1F6DD7B667D32606D3",
+      "id": "github_release/github.com/goreleaser/goreleaser/v2.18.3/goreleaser_Linux_x86_64.tar.gz",
+      "checksum": "B8DEE4728BCA1ABA0D71A832A17CD0A3799F75372878E7FFA36AEF2343BCE0BC",
       "algorithm": "sha256"
     },
     {
-      "id": "github_release/github.com/goreleaser/goreleaser/v2.18.2/goreleaser_Windows_arm64.zip",
-      "checksum": "D2AEBC59BEE96078C1F529160F170E02FFC96FD5D31B5E33EEF66CDD7256F602",
+      "id": "github_release/github.com/goreleaser/goreleaser/v2.18.3/goreleaser_Windows_arm64.zip",
+      "checksum": "371DA2DDDAC0C19C729A74D26305C2D168CFF50728EBE14B581FE5B7C5D98B59",
       "algorithm": "sha256"
     },
     {
-      "id": "github_release/github.com/goreleaser/goreleaser/v2.18.2/goreleaser_Windows_x86_64.zip",
-      "checksum": "DE61A8E7A064ABB14210B16C942FACD299643D83341C5CD293F19155A7C8B95F",
+      "id": "github_release/github.com/goreleaser/goreleaser/v2.18.3/goreleaser_Windows_x86_64.zip",
+      "checksum": "5E7455DF2ACCBFE69416CF9CCBC6AEFE9ABD2543525D5D6DA24426D827AA8171",
       "algorithm": "sha256"
     },
     {
@@ -301,28 +301,28 @@
       "algorithm": "sha256"
     },
     {
-      "id": "http/golang.org/dl/go1.27.1.darwin-arm64.tar.gz",
-      "checksum": "EE215D57E0EC269C60CC9CECA68E6BDA321BA9EE5AFE24F4B0988703C2D87D12",
+      "id": "http/golang.org/dl/go1.27.2.darwin-arm64.tar.gz",
+      "checksum": "76812B213B1B2302C978D28FA52FA92D541704B9E7D9D5DB8002C50E4018C4C5",
       "algorithm": "sha256"
     },
     {
-      "id": "http/golang.org/dl/go1.27.1.linux-amd64.tar.gz",
-      "checksum": "63D339F0DA5AB53635A56F2490A7984DFE12DFCFF22AD749F63EDAF590168445",
+      "id": "http/golang.org/dl/go1.27.2.linux-amd64.tar.gz",
+      "checksum": "ECBADB99091A3F46E31F5F934B068B1864EAFA7995211B39EADDF76996045FE5",
       "algorithm": "sha256"
     },
     {
-      "id": "http/golang.org/dl/go1.27.1.linux-arm64.tar.gz",
-      "checksum": "3450B45A3F9EE8568792736A5C5E70A1F2E9B36C35A8F74958C03E51D7D92BEC",
+      "id": "http/golang.org/dl/go1.27.2.linux-arm64.tar.gz",
+      "checksum": "94F3E30B8E374BC285E7DADC11E0865726B9BC6E85B841CCCEAABC0214C6B7C8",
       "algorithm": "sha256"
     },
     {
-      "id": "http/golang.org/dl/go1.27.1.windows-amd64.zip",
-      "checksum": "A3911B5E0E1B1053F25ED0675F4C1C6AAD1E2BFCF253DF2B9BE4CAABD2EDD95D",
+      "id": "http/golang.org/dl/go1.27.2.windows-amd64.zip",
+      "checksum": "1314008898BD40DF77AF4B014F777F08873DBDFBCD3D92308728EE03304FE04F",
       "algorithm": "sha256"
     },
     {
-      "id": "http/golang.org/dl/go1.27.1.windows-arm64.zip",
-      "checksum": "13B69B87BB0E83F96BC68560A8CACE7F0343B1E03469F1110EA18D17E3234069",
+      "id": "http/golang.org/dl/go1.27.2.windows-arm64.zip",
+      "checksum": "5C4B294F23B558619AE8A4AA94D023E3BCA03F52C8398BB41B9026002B0013DE",
       "algorithm": "sha256"
     },
     {

.aqua/aqua.yaml

@@ -18,6 +18,7 @@ registries:
 
 packages:
   # --- farcloser tools (local registry; standard once registered upstream) ---
-  - name: farcloser/limen@v0.9.0 # renovate: depName=farcloser/limen
+  - name: farcloser/limen@v0.10.0 # renovate: depName=farcloser/limen
     registry: local
+  - name: golang/go@go1.27.2
   - import: ../.limen/aqua.yaml

.github/actions/setup-aqua/action.yaml

@@ -18,7 +18,7 @@ runs:
         AQUA_INSTALLER_VERSION: v4.0.2
         AQUA_INSTALLER_SHA256: 98b883756cdd0a6807a8c7623404bfc3bc169275ad9064dc23a6e24ad398f43d
         # renovate: depName=aquaproj/aqua
-        AQUA_VERSION: v2.63.0
+        AQUA_VERSION: v2.64.0
       run: |
         # Pin the root explicitly: aqua's Windows build defaults it to
         # %LOCALAPPDATA%, the installer and the .justfile compute ~/.local/share,

.github/release.yml

@@ -0,0 +1,22 @@
+# DO NOT EDIT MANUALLY: content-pinned by limen, reset on drift.
+#
+# How GitHub groups a release's notes, which are the titles of the pull
+# requests merged since the previous tag (goreleaser's `use: github-native`).
+# A pull request lands in the FIRST category it matches, so the catch-all
+# must exclude what a later category claims.
+changelog:
+  categories:
+    - title: Breaking changes
+      labels:
+        - breaking
+    - title: Changes
+      labels:
+        - '*'
+      exclude:
+        labels:
+          - dependencies
+        authors:
+          - renovate[bot]
+    - title: Dependencies
+      labels:
+        - '*'

.github/workflows/limen-verify.yaml

@@ -160,7 +160,7 @@ jobs:
       # A crasher is a bug with a reproducer attached; the log names the
       # target, the input file is what reproduces it locally. Uploaded only
       # on failure, and only if any was written.
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         if: failure()
         with:
           name: fuzz-crashers

.limen/aqua-registry.yaml

@@ -301,14 +301,16 @@ packages:
   # git-bash.
   # Linked straight to usr/bin, never through bin/bash.exe, whose PATH
   # prepending would let Git's own curl shadow the pin. The runtime is x86_64
-  # even in the arm64 tarball. The release tag is vX.Y.Z.windows.N, the asset
-  # name carries X.Y.Z only. Upstream lists each asset's SHA-256 in the release
-  # notes: check the recorded checksums against that table at every bump.
+  # even in the arm64 tarball. The release tag is vX.Y.Z.windows.N; the asset
+  # name carries X.Y.Z for the first build and X.Y.Z.N for a rebuild
+  # (v2.56.0.windows.2 ships Git-2.56.0.2-64-bit.tar.bz2). Upstream lists each
+  # asset's SHA-256 in the release notes: check the recorded checksums against
+  # that table at every bump.
   - type: github_release
     repo_owner: git-for-windows
     repo_name: git
     description: Git for Windows, for its MSYS2 GNU coreutils
-    asset: Git-{{ regexReplaceAll "\\.windows\\.[0-9]+$" (trimV .Version) "" }}-{{.Arch}}.tar.bz2
+    asset: Git-{{ regexReplaceAll "\\.windows\\.([0-9]+)$" (regexReplaceAll "\\.windows\\.1$" (trimV .Version) "") ".${1}" }}-{{.Arch}}.tar.bz2
     format: tar.bz2
     replacements:
       amd64: 64-bit

.limen/aqua.yaml

@@ -18,25 +18,27 @@ packages:
   # The registry entries say why, and how each is verified.
   - name: uutils/coreutils@0.12.0
     registry: local
-  - name: git-for-windows/git@v2.56.0.windows.1
+  - name: git-for-windows/git@v2.56.0.windows.2
     registry: local
-  # --- toolchain + binary-release tools (standard registry, aqua-verified) ---
-  - name: golang/go@go1.27.1
+  # --- binary-release tools (standard registry, aqua-verified) ---
+  # Not here: golang/go. The Go toolchain is each repository's own pin, in its
+  # .aqua/aqua.yaml above the import (seeded once by `limen fix`, Renovate's
+  # afterwards): a standard-library fix must not wait for a limen release.
   - name: casey/just@1.58.0
   - name: koalaman/shellcheck@v0.11.0
   - name: google/yamlfmt@v0.21.0
   - name: lycheeverse/lychee@lychee-v0.24.2
-  - name: goreleaser/goreleaser@v2.18.2
+  - name: goreleaser/goreleaser@v2.18.3
   - name: sigstore/cosign@v3.1.3
   - name: gotestyourself/gotestsum@v1.13.0
   - name: jqlang/jq@jq-1.8.2
   - name: cli/cli@v2.102.0
   # --- spec tooling (local registry; see .limen/aqua-registry.yaml) ---
-  - name: quint-co/quint@v0.33.0 # renovate: depName=quint-co/quint
+  - name: quint-co/quint@v0.33.0
     registry: local
   - name: forkcloser/curl@v8.22.0
     registry: local
   # darwin/arm64 only. Its `docker` link shadows the machine's Docker on the
   # hermetic PATH there; aqua skips the package everywhere else.
-  - name: farcloser/ossein@v0.3.0
+  - name: farcloser/ossein@v0.3.1
     registry: local

.limen/just/lint-go.just

@@ -160,7 +160,12 @@ nilaway: (_banner "lint go" "nilaway") (_go-tool "nilaway" "go.uber.org/nilaway/
 # their location under GOROOT, reading its default from its own build. _go-tool
 # compiles it with the pinned toolchain, so the two agree by construction; the
 # explicit value keeps that true even when a project overrides GOROOT.
-licenses: (_banner "lint go" "licenses") (_go-tool "go-licenses" "github.com/google/go-licenses/v2") (_per-platform 'GOROOT="$(go env GOROOT)" build/tools/go-licenses check --include_tests $(${LIMEN_LINT_GO_BIN:-limen-lint-go} flags licenses) ./...')
+#
+# The module's own path is ignored by the lane: the lane judges the dependency
+# graph, the repository's own LICENSE is the `license` rule's, and go-licenses
+# classifies a license by its text, so the Closed-source notice limen writes
+# failed every package of such a module.
+licenses: (_banner "lint go" "licenses") (_go-tool "go-licenses" "github.com/google/go-licenses/v2") (_per-platform 'GOROOT="$(go env GOROOT)" build/tools/go-licenses check --include_tests --ignore "$(go list -m)" $(${LIMEN_LINT_GO_BIN:-limen-lint-go} flags licenses) ./...')
 
 # Unreachable functions, by whole-program call-graph analysis (deeper than the
 # per-package `unused` linter in golangci). -test keeps library-only repos

.limen/just/lint.just

@@ -10,7 +10,7 @@ set quiet
 # Shared private _banner recipe (see lib.just).
 import 'lib.just'
 
-default: limen just aqua links yaml shell dockerfile commits
+default: limen just aqua yaml shell dockerfile commits
 
 # Go linters live in their own submodule: `just do lint go` runs them all,
 # `just do lint go <recipe>` (e.g. `just do lint go mod`) runs one.
@@ -172,49 +172,6 @@ shell: (_banner "lint" "shell")
     # in reality, so those hits can only be false positives of the masking.
     [ ${#recipes[@]} -eq 0 ] || shellcheck --rcfile .limen/.shellcheckrc --exclude=SC1010,SC2050,SC2078,SC2157,SC2194 "${recipes[@]}"
 
-# Check documentation links with lychee (respects .gitignore, skips hidden files).
-links: (_banner "lint" "links")
-    #!/usr/bin/env bash
-    set -euo pipefail
-    # Canonical exclusions (and their rationale) live in .limen/lychee.toml; a
-    # repository adds its own in a root .lint-links.toml. Both must be passed
-    # explicitly — any --config disables lychee's ./lychee.toml auto-discovery —
-    # and lychee merges them, concatenating the exclude lists.
-    args=(--config .limen/lychee.toml)
-    if [ -f .lint-links.toml ]; then
-        args+=(--config .lint-links.toml)
-    fi
-    # WORKAROUND, lychee through 0.24.2 (lychee-lib/src/retry.rs): a rejected
-    # status is judged retryable only when it is 429, so a 5xx is never
-    # retried whatever max_retries says, and one GitHub 503 blip fails the
-    # lane. Server errors alone get a second pass, re-checked once a minute
-    # later; any other failure is a finding at once. Drop this when lychee
-    # retries 5xx itself.
-    scratch=$(mktemp -d "${TMPDIR:-/tmp}/lint-links.XXXXXX")
-    trap 'rm -rf "$scratch"' EXIT
-    report="$scratch/report.json"
-    status=0
-    lychee --no-progress "${args[@]}" --format json --output "$report" . || status=$?
-    if [ "$status" = 0 ]; then
-        jq -r '"\(.total) links: \(.successful) ok, \(.excludes) excluded, \(.redirects) redirected"' "$report"
-        exit 0
-    fi
-    # 2 is "links failed"; anything else (a config or input error) is final.
-    [ "$status" = 2 ] || exit "$status"
-    jq -r '(.error_map, .timeout_map) | to_entries[] | .key as $file | .value[]
-        | "[\(.status.code // "timeout")] \(.url) (\($file):\(.span.line // 0)) | \(.status.text)"' "$report"
-    servers=$(jq '[.error_map[][] | select(.status.code != null and .status.code >= 500 and .status.code < 600)] | length' "$report")
-    failures=$(jq '[.error_map[][], .timeout_map[][]] | length' "$report")
-    if [ "$servers" = 0 ] || [ "$servers" != "$failures" ]; then
-        exit 2
-    fi
-    # The links go back in as a document: a URL given as an input is a page to
-    # read links out of, not a link to check.
-    jq -r '[.error_map[][] | .url] | unique[] | "<\(.)>"' "$report" > "$scratch/recheck.md"
-    echo "only server errors, which lychee does not retry: re-checking $(wc -l < "$scratch/recheck.md" | tr -d ' ') link(s) once, in 60s" >&2
-    sleep 60
-    lychee --no-progress "${args[@]}" "$scratch/recheck.md"
-
 # Validate commit hygiene — DCO sign-off, subject length, dangling whitespace —
 # over a commit range (default: everything ahead of the upstream default branch;
 # pass one explicitly otherwise, e.g. `just do lint commits v1.0.0..HEAD`).

.limen/just/release.just

@@ -8,7 +8,8 @@
 # import's settings would apply to the whole importing module.
 
 # Lanes: `vX.Y.Z` cuts the signed tag and pushes (CI builds, signs keyless,
-# publishes); `--local <key> vX.Y.Z` is the fully local, key-based lane and the
+# publishes; without a .release-go.yaml, the recipe creates the release page
+# itself); `--local <key> vX.Y.Z` is the fully local, key-based lane and the
 # sole publisher; `--local --dry-run` is an unsigned snapshot; `--ci` is the
 # workflow half. usage() below and book/recipes.md have the details.
 #
@@ -29,7 +30,7 @@ release *args:
         fi
     }
     usage() {
-        echo "usage: just do release <tag>                                               # signed tag + push; CI builds, signs (keyless), publishes" >&2
+        echo "usage: just do release <tag>                                               # signed tag + push; CI builds, signs (keyless), publishes (no .release-go.yaml: the release page, with notes)" >&2
         echo "       just do release --local <cosign-key> <tag> [--cosign-password-stdin] # fully local, key-based cosign" >&2
         echo "       just do release --local --dry-run                                   # local unsigned snapshot into build/release/" >&2
         echo "       just do release --ci                                                # workflow half of the default lane (GitHub Actions only)" >&2
@@ -229,7 +230,28 @@ release *args:
             if has_goreleaser; then
                 echo "tag $tag pushed — the release workflow builds, signs, and publishes from here."
             else
-                echo "tag $tag pushed — no .release-go.yaml, so the signed tag is the release: nothing to build or publish."
+                # No artifacts to build, but every tag has a release page,
+                # with GitHub's notes from the merged pull requests (grouped
+                # by .github/release.yml): the laptop makes it, through the
+                # pinned gh and the human's own auth, on the repository the
+                # tag went to (gh would otherwise pick between origin and
+                # upstream by its own rules). --verify-tag refuses a tag that
+                # has not reached origin. GitHub starts the notes at the last
+                # PUBLISHED release, so a repository whose earlier tags had no
+                # page gets every pull request since inception unless the
+                # previous tag is named. A retry finds the page and leaves it.
+                repo="$(git remote get-url origin)"
+                if gh release view "$tag" -R "$repo" >/dev/null 2>&1; then
+                    echo "tag $tag pushed — its release page already exists (a retry): nothing to build or publish."
+                else
+                    opts=(--verify-tag --generate-notes)
+                    if previous="$(git describe --tags --match "v*" --abbrev=0 "$tag^" 2>/dev/null)"; then
+                        opts+=(--notes-start-tag "$previous")
+                    fi
+                    case "$tag" in *-*) opts+=(--prerelease) ;; esac
+                    gh release create "$tag" -R "$repo" "${opts[@]}"
+                    echo "tag $tag pushed and its release page created — no .release-go.yaml, so nothing else to build or publish."
+                fi
             fi
             ;;
     esac