Release SOW v0.6.1: Go 1.27.3 and dependency refresh

.github/workflows/ci.yml

@@ -27,10 +27,10 @@ jobs:
     timeout-minutes: 20
     steps:
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Set up Go
-        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version-file: go.mod
           cache-dependency-path: go.sum
@@ -65,9 +65,9 @@ jobs:
         run: make test-perf-contract
 
       - name: Check GoReleaser configuration
-        uses: goreleaser/goreleaser-action@f06c13b6b1a9625abc9e6e439d9c05a8f2190e94 # v7.2.3
+        uses: goreleaser/goreleaser-action@a4f02ab5355a589de60d917a659ce617ed19b3de # v7.3.0
         with:
-          version: "v2.18.2"
+          version: "v2.18.3"
           args: check
 
   test:
@@ -76,10 +76,10 @@ jobs:
     timeout-minutes: 50
     steps:
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Set up Go
-        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version-file: go.mod
           cache-dependency-path: go.sum
@@ -96,10 +96,10 @@ jobs:
     timeout-minutes: 60
     steps:
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Set up Go
-        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version-file: go.mod
           cache-dependency-path: go.sum
@@ -113,10 +113,10 @@ jobs:
     timeout-minutes: 40
     steps:
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Set up Go
-        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version-file: go.mod
           cache-dependency-path: go.sum
@@ -130,23 +130,24 @@ jobs:
     timeout-minutes: 20
     steps:
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
 
       - name: Set up Go
-        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version-file: go.mod
           cache-dependency-path: go.sum
 
+      - name: Read snapshot version
+        run: echo "SOW_VERSION=$(make --no-print-directory version)" >> "$GITHUB_ENV"
+
       - name: Build snapshot with GoReleaser
-        uses: goreleaser/goreleaser-action@f06c13b6b1a9625abc9e6e439d9c05a8f2190e94 # v7.2.3
+        uses: goreleaser/goreleaser-action@a4f02ab5355a589de60d917a659ce617ed19b3de # v7.3.0
         with:
-          version: "v2.18.2"
+          version: "v2.18.3"
           args: release --snapshot --clean --skip=publish
-        env:
-          SOW_VERSION: 0.6.0
 
       - name: Install package inspection tools
         run: |

.github/workflows/integration.yml

@@ -21,10 +21,10 @@ jobs:
     timeout-minutes: 25
     steps:
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Set up Go
-        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version-file: go.mod
           cache-dependency-path: go.sum
@@ -53,10 +53,10 @@ jobs:
     timeout-minutes: 15
     steps:
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Set up Go
-        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version-file: go.mod
           cache-dependency-path: go.sum

.github/workflows/release.yml

@@ -19,12 +19,12 @@ jobs:
     timeout-minutes: 20
     steps:
       - name: Checkout tag
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
 
       - name: Set up Go
-        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version-file: go.mod
           cache-dependency-path: go.sum
@@ -49,9 +49,9 @@ jobs:
         run: make notices-check
 
       - name: Create Draft GitHub Release
-        uses: goreleaser/goreleaser-action@f06c13b6b1a9625abc9e6e439d9c05a8f2190e94 # v7.2.3
+        uses: goreleaser/goreleaser-action@a4f02ab5355a589de60d917a659ce617ed19b3de # v7.3.0
         with:
-          version: "v2.18.2"
+          version: "v2.18.3"
           args: release --clean
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

CHANGELOG.md

@@ -4,6 +4,22 @@ All notable changes to SOW are recorded here.
 
 ## Unreleased
 
+## 0.6.1 - 2026-10-22
+
+- Require Go 1.27.3 and refresh runtime and test dependencies, including the
+  AWS SDK, ProtonMail OpenPGP, compression, SQLite, and Debian package libraries.
+  Retain the bounded, parser-only RPM compatibility patch.
+- Move YAML parsing to the maintained `go.yaml.in/yaml/v3` v3.0.5 module while
+  retaining the existing configuration format.
+- Report the offending path or armor type when log export, RPM metadata,
+  signature, and workspace validation reject invalid input, instead of displaying
+  a Go formatting error caused by wrapping a nil error.
+- Update pinned CI Actions, GoReleaser, deadcode, and govulncheck. Read the CI
+  snapshot version from the Makefile so package builds follow the release version.
+
+This release keeps schema v13 and the existing CLI and public repository layout.
+Workspaces already on v0.5.0 or v0.6.0 do not require a schema migration.
+
 ## 0.6.0 - 2026-10-17
 
 - Bind metadata and payload authentication to stable file-descriptor identity,

Makefile

@@ -4,9 +4,9 @@ SHELL := /bin/bash
 
 GO ?= go
 GORELEASER ?= goreleaser
-DEADCODE_VERSION ?= v0.49.0
-GOVULNCHECK_VERSION ?= v1.7.0
-VERSION ?= 0.6.0
+DEADCODE_VERSION ?= v0.52.0
+GOVULNCHECK_VERSION ?= v1.9.0
+VERSION ?= 0.6.1
 TEST_TIMEOUT ?= 60m
 CORE_TEST_TIMEOUT ?= 20m
 RACE_TIMEOUT ?= 45m

README.md

@@ -148,7 +148,7 @@ and RPM leaf export are specified in [Commands](https://sow.pgsty.com/docs/comma
 
 ## Build
 
-Building from source requires Go 1.27.2 or newer; repository signing additionally requires
+Building from source requires Go 1.27.3 or newer; repository signing additionally requires
 a usable GPG installation and key.
 
 ```bash