From 62131e7501097d0771ca52be44e4dc5d4fcac3a5 Mon Sep 17 00:00:00 2001 From: gsadmin Date: Fri, 31 Jul 2026 16:46:20 -0400 Subject: [PATCH] Promote the changelog notes into each version, and correct route ordering Update-Changelog inserted the version heading above the notes, so the section the release workflow extracts contained only the build line while the actual notes stayed under "Unreleased". Every release published an empty changelog. It now promotes whatever sits under Unreleased into the version section and leaves a fresh empty Unreleased above it, with the provenance line italicised and last so it does not read as another entry in whichever section the notes ended on. Re-running the same version remains a no-op, and a build with nothing to say still produces a section. SignCertificateByCa now prefers /api/v1/cert-manager over the older /api/v1/pki route. RetrieveCertificate and GetCertificateBundle deliberately keep the older route first, which is the opposite of what it looks like. The /api/v1/pki route resolves a certificate by serial number, which is what callers supply; the cert-manager route takes a certificate ID and passes it through as getCert({ id }), so it cannot answer a serial. Both remain registered so either identifier resolves - which is what lets the metadata path look a certificate up by ID - and a comment now records why reordering them would break serial lookups. Co-Authored-By: Claude Opus 5 --- build.ps1 | 39 ++++++++++++++++--- .../Endpoints/InfisicalEndpointRegistry.cs | 9 ++++- 2 files changed, 41 insertions(+), 7 deletions(-) diff --git a/build.ps1 b/build.ps1 index d0b2edb..b560d8c 100644 --- a/build.ps1 +++ b/build.ps1 @@ -178,6 +178,15 @@ function Write-Manifest { } function Update-Changelog { + <# + Promotes whatever sits under "## Unreleased" into a section for this version, leaving a fresh empty + "## Unreleased" above it. + + The release workflow builds its release body by extracting the section whose heading matches the version + it just produced. Inserting the version heading above the notes - as this previously did - left that + section containing only the build line while the actual notes stayed under "Unreleased", so every + release published an empty changelog. + #> param([string]$Version, [string]$CommitHash) if (-not $ChangelogFile.Exists) { return } @@ -185,11 +194,31 @@ function Update-Changelog { $existing = Get-Content -LiteralPath $ChangelogFile.FullName -Raw if ($existing -match [Regex]::Escape($marker)) { return } - $insertion = "## $Version`r`n`r`n- Build produced from commit $CommitHash.`r`n`r`n" - $unreleasedRegex = [regex]::new('(?m)^## Unreleased\r?$') - if (-not $unreleasedRegex.IsMatch($existing)) { return } - $updated = $unreleasedRegex.Replace($existing, "## Unreleased`r`n`r`n$insertion## Unreleased (carried forward)", 1) - [System.IO.File]::WriteAllText($ChangelogFile.FullName, $updated, [System.Text.UTF8Encoding]::new($false)) + $unreleasedRegex = [regex]::new('(?m)^## Unreleased[^\r\n]*\r?$') + $unreleasedMatch = $unreleasedRegex.Match($existing) + if (-not $unreleasedMatch.Success) { return } + + # Everything from just after the Unreleased heading to the next "## " heading is this version's notes. + $bodyStart = $unreleasedMatch.Index + $unreleasedMatch.Length + $nextHeading = [regex]::new('(?m)^## ').Match($existing, $bodyStart) + $bodyEnd = if ($nextHeading.Success) { $nextHeading.Index } else { $existing.Length } + + $notes = $existing.Substring($bodyStart, $bodyEnd - $bodyStart).Trim() + + # Italicised and last so it reads as provenance rather than as another entry in whichever section the + # notes happened to end on. + $buildLine = "_Build produced from commit $CommitHash._" + $versionBody = if ([string]::IsNullOrWhiteSpace($notes)) { $buildLine } else { "$notes`r`n`r`n$buildLine" } + + $rebuilt = New-Object System.Text.StringBuilder + [void]$rebuilt.Append($existing.Substring(0, $unreleasedMatch.Index)) + [void]$rebuilt.Append("## Unreleased`r`n`r`n") + [void]$rebuilt.Append("## $Version`r`n`r`n") + [void]$rebuilt.Append($versionBody) + [void]$rebuilt.Append("`r`n`r`n") + [void]$rebuilt.Append($existing.Substring($bodyEnd)) + + [System.IO.File]::WriteAllText($ChangelogFile.FullName, $rebuilt.ToString(), [System.Text.UTF8Encoding]::new($false)) } diff --git a/src/PSInfisicalAPI/Endpoints/InfisicalEndpointRegistry.cs b/src/PSInfisicalAPI/Endpoints/InfisicalEndpointRegistry.cs index fb35c90..714c16b 100644 --- a/src/PSInfisicalAPI/Endpoints/InfisicalEndpointRegistry.cs +++ b/src/PSInfisicalAPI/Endpoints/InfisicalEndpointRegistry.cs @@ -668,6 +668,11 @@ namespace PSInfisicalAPI.Endpoints RequiresAuthorization = true }); + // RetrieveCertificate and GetCertificateBundle deliberately lead with the older /api/v1/pki route: + // it resolves a certificate by SERIAL NUMBER, which is what callers supply. The newer + // /api/v1/cert-manager route takes a certificate ID and passes it straight through as + // getCert({ id }), so it cannot answer a serial. Both are registered so either identifier resolves; + // reordering these two would send every serial lookup to the route that cannot serve it. Add(map, new InfisicalEndpointDefinition { Name = InfisicalEndpointNames.RetrieveCertificate, @@ -747,7 +752,7 @@ namespace PSInfisicalAPI.Endpoints Resource = "Pki", Version = "v1", Method = "POST", - Template = "/api/v1/pki/ca/{caId}/sign-certificate", + Template = "/api/v1/cert-manager/ca/{caId}/sign-certificate", RequiresAuthorization = true, ContainsSecretMaterialInResponse = true }); @@ -758,7 +763,7 @@ namespace PSInfisicalAPI.Endpoints Resource = "Pki", Version = "v1", Method = "POST", - Template = "/api/v1/cert-manager/ca/{caId}/sign-certificate", + Template = "/api/v1/pki/ca/{caId}/sign-certificate", RequiresAuthorization = true, ContainsSecretMaterialInResponse = true });