September 3, 2026

The old signer was minted for a forge this pipeline stopped publishing to, and a key that opens a host has no business vouching for a release.

The upload glob took only redflag-* files, so checksums, installer and snippet never left the matrix job, and the merge indexed a bare array and discarded the manifest.

c0a717a took .env.bootstrap.example with it and left three signposts pointing at the gap, one of them the third line a stranger ever runs.

Nothing in CI builds this file, so the from-source install path is the one place a toolchain floor can move without anyone noticing until a stranger tries it.

A .0 release is not a floor, it is an unhealed one — and setup-go reads this line, so eighteen stdlib advisories arrived with 1.26.0.

GO-2026-6354 and GO-2026-6355 deadlock an SSH connection from a malicious peer and are reachable in the server through go-git.

Neither the release nor the publish job has ever executed, so jq's presence in the runner image is unproven while both depend on it.

A commit that deletes a private address still carries it on the minus side of its own diff, so the history scan flags the repair as well as the leak.

The GitTags adapter listed an internal forge among its three example remotes; the public one demonstrates the same arbitrary-remote shape without naming private infrastructure.

The Windows configuration notice printed a private LAN address as the example server, so every public binary shipped an unreachable host as its instruction.

upload-artifact v4 aborts with GHESNotSupportedError against a non-github.com server, so the web job died on every tag since v0.2.8.2 and build and publish were skipped.

The commit that added the absolute buildDir and the one that removes it both carry it in their diffs, so the history scan flags them forever.

mode_t is u16 on macOS and a variadic argument promotes to at least c_uint, so aarch64-apple-darwin failed E0617 while every Linux target built clean.

The tracked buildDir was an absolute path into a worktree that no longer exists, so the setting was already dead.