feat(releaser): initial release v0.4.0

Complete GitFlow release automation tool for Conventional Commits workflows:

- Core pipeline: branch parsing, tag discovery, commit analysis, version bump
- Maven pom.xml read/write, git commit/tag, HTTPS push with token auth
- GitLab release creation via API with auto-generated release notes
- Configurable via .releaser.yml (tag_prefix, branch_pattern, commit_message, pom_path, gitlab)
- CLI flags: --dry-run, --no-push, --no-commit, --tag-only, --branch, --pom, --tag-prefix, --branch-pattern
- Dockerfile (multi-stage Alpine), .releaser.gitlab-ci.yml reusable template
- Gitea CI (vet + staticcheck + test + build) and release (5-platform cross-compilation) workflows
- Taskfile with build/test/cov/lint/fuzz/ci/docker tasks
- 96% test coverage with real in-memory git repos and fuzz tests for all parsers

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

internal/glclient/glclient.go

@@ -0,0 +1,103 @@
+package glclient
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"net/url"
+	"strings"
+	"time"
+)
+
+// Client is a minimal GitLab API client covering only the Releases endpoint.
+type Client struct {
+	baseURL    string
+	token      string
+	projectID  string // numeric ID or URL-encoded namespace/project
+	httpClient *http.Client
+}
+
+// New creates a Client. baseURL is the GitLab instance root (e.g. "https://gitlab.example.com").
+// project can be a numeric ID ("123") or a namespace/project path ("group/myapp").
+func New(baseURL, token, project string) *Client {
+	return &Client{
+		baseURL:   strings.TrimRight(baseURL, "/"),
+		token:     token,
+		projectID: encodeProjectPath(project),
+		httpClient: &http.Client{
+			Timeout: 30 * time.Second,
+		},
+	}
+}
+
+// endpoint builds a full API URL for the given resource under the project.
+// Uses url.URL{Path, RawPath} to preserve %2F encoding in the project path —
+// url.Parse would silently decode %2F back to / in the Path field.
+func (c *Client) endpoint(resource string) string {
+	rawPath := fmt.Sprintf("/api/v4/projects/%s/%s", c.projectID, resource)
+	u, err := url.Parse(c.baseURL)
+	if err != nil {
+		return c.baseURL + rawPath // fallback, handles only simple cases
+	}
+	u.Path = strings.ReplaceAll(rawPath, "%2F", "/")
+	u.RawPath = rawPath
+	return u.String()
+}
+
+// encodeProjectPath URL-encodes a GitLab project identifier for use in an API path.
+// Numeric IDs ("123") pass through unchanged.
+// Path-style IDs ("group/project") have each segment encoded and slashes replaced with %2F,
+// because url.PathEscape does not encode / (it is a valid path separator).
+func encodeProjectPath(project string) string {
+	parts := strings.Split(project, "/")
+	for i, p := range parts {
+		parts[i] = url.PathEscape(p)
+	}
+	return strings.Join(parts, "%2F")
+}
+
+type createReleaseRequest struct {
+	Name        string `json:"name"`
+	TagName     string `json:"tag_name"`
+	Description string `json:"description"`
+}
+
+// CreateRelease creates a GitLab release on an existing tag.
+// The tag must already be pushed to the remote before calling this.
+func (c *Client) CreateRelease(ctx context.Context, tagName, description string) error {
+	// json.Marshal never fails for a struct with only string fields
+	body, _ := json.Marshal(createReleaseRequest{
+		Name:        tagName,
+		TagName:     tagName,
+		Description: description,
+	})
+
+	endpoint := c.endpoint("releases")
+	req, err := http.NewRequestWithContext(ctx, http.MethodPost, endpoint, bytes.NewReader(body))
+	if err != nil {
+		return err
+	}
+	req.Header.Set("Content-Type", "application/json")
+	req.Header.Set("PRIVATE-TOKEN", c.token)
+
+	resp, err := c.httpClient.Do(req)
+	if err != nil {
+		return fmt.Errorf("GitLab API request failed: %w", err)
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode < 200 || resp.StatusCode >= 300 {
+		var errBody struct {
+			Message string `json:"message"`
+		}
+		json.NewDecoder(resp.Body).Decode(&errBody) //nolint:errcheck
+		if errBody.Message != "" {
+			return fmt.Errorf("GitLab API returned %d: %s", resp.StatusCode, errBody.Message)
+		}
+		return fmt.Errorf("GitLab API returned %d", resp.StatusCode)
+	}
+
+	return nil
+}

internal/glclient/glclient_test.go

@@ -0,0 +1,151 @@
+package glclient
+
+import (
+	"context"
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+)
+
+func TestCreateRelease(t *testing.T) {
+	var received createReleaseRequest
+	var gotToken string
+
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.Method != http.MethodPost {
+			t.Errorf("method = %s, want POST", r.Method)
+		}
+		gotToken = r.Header.Get("PRIVATE-TOKEN")
+		json.NewDecoder(r.Body).Decode(&received) //nolint:errcheck
+		w.WriteHeader(http.StatusCreated)
+		w.Write([]byte(`{}`)) //nolint:errcheck
+	}))
+	defer srv.Close()
+
+	client := New(srv.URL, "my-token", "123")
+	err := client.CreateRelease(context.Background(), "v1.2.4", "## v1.2.4\n\n### Bug Fixes\n- patch something")
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+
+	if gotToken != "my-token" {
+		t.Errorf("PRIVATE-TOKEN = %q, want %q", gotToken, "my-token")
+	}
+	if received.TagName != "v1.2.4" {
+		t.Errorf("tag_name = %q, want %q", received.TagName, "v1.2.4")
+	}
+	if received.Name != "v1.2.4" {
+		t.Errorf("name = %q, want %q", received.Name, "v1.2.4")
+	}
+	if received.Description == "" {
+		t.Error("description should not be empty")
+	}
+}
+
+func TestCreateReleaseAPIError(t *testing.T) {
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.WriteHeader(http.StatusUnprocessableEntity)
+		w.Write([]byte(`{"message":"Tag already has a release"}`)) //nolint:errcheck
+	}))
+	defer srv.Close()
+
+	client := New(srv.URL, "token", "42")
+	err := client.CreateRelease(context.Background(), "v1.2.4", "notes")
+	if err == nil {
+		t.Fatal("expected error for 422 response")
+	}
+	if err.Error() == "" {
+		t.Error("error message should not be empty")
+	}
+}
+
+func TestProjectPathEncoding(t *testing.T) {
+	var gotPath string
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		// EscapedPath returns RawPath when set, preserving %2F encoding.
+		// r.URL.Path is always decoded so we must not use it here.
+		gotPath = r.URL.EscapedPath()
+		w.WriteHeader(http.StatusCreated)
+		w.Write([]byte(`{}`)) //nolint:errcheck
+	}))
+	defer srv.Close()
+
+	client := New(srv.URL, "token", "group/my-app")
+	client.CreateRelease(context.Background(), "v1.0.0", "") //nolint:errcheck
+
+	// "group/my-app" must be URL-encoded as "group%2Fmy-app"
+	if gotPath != "/api/v4/projects/group%2Fmy-app/releases" {
+		t.Errorf("path = %q, want /api/v4/projects/group%%2Fmy-app/releases", gotPath)
+	}
+}
+
+func TestEndpointFallback(t *testing.T) {
+	// "://" is an invalid URL that url.Parse will reject,
+	// exercising the fallback branch in endpoint().
+	c := New("://invalid", "token", "123")
+	got := c.endpoint("releases")
+	want := "://invalid/api/v4/projects/123/releases"
+	if got != want {
+		t.Errorf("endpoint fallback = %q, want %q", got, want)
+	}
+}
+
+func TestCreateReleaseStatusNoMessage(t *testing.T) {
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.WriteHeader(http.StatusInternalServerError)
+		w.Write([]byte(`not json`)) //nolint:errcheck
+	}))
+	defer srv.Close()
+
+	err := New(srv.URL, "token", "42").CreateRelease(context.Background(), "v1.0.0", "notes")
+	if err == nil {
+		t.Fatal("expected error for 500 response")
+	}
+	// Should contain just the status code, no message field
+	if !strings.Contains(err.Error(), "500") {
+		t.Errorf("error should mention status 500: %v", err)
+	}
+}
+
+func TestCreateReleaseInvalidURL(t *testing.T) {
+	// "://" is unparseable as a URL scheme, so endpoint() returns the raw fallback
+	// string and http.NewRequestWithContext fails when it tries to parse it.
+	c := New("://", "token", "42")
+	err := c.CreateRelease(context.Background(), "v1.0.0", "notes")
+	if err == nil {
+		t.Fatal("expected error for client with invalid base URL")
+	}
+}
+
+func TestCreateReleaseNetworkError(t *testing.T) {
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {}))
+	srv.Close() // close immediately so the request fails at TCP level
+
+	err := New(srv.URL, "token", "42").CreateRelease(context.Background(), "v1.0.0", "notes")
+	if err == nil {
+		t.Fatal("expected network error after server is closed")
+	}
+}
+
+// FuzzEncodeProjectPath verifies that the encoder never panics and never emits
+// a raw slash when the input contains one.
+func FuzzEncodeProjectPath(f *testing.F) {
+	f.Add("group/project")
+	f.Add("123")
+	f.Add("")
+	f.Add("group/subgroup/project")
+	f.Add("a/b/c/d")
+	f.Add("/leading/slash")
+	f.Add("trailing/slash/")
+	f.Add(strings.Repeat("a/", 50))
+
+	f.Fuzz(func(t *testing.T, project string) {
+		result := encodeProjectPath(project)
+		// A slash in the input must NOT appear as a literal slash in the result
+		if strings.Contains(project, "/") && strings.Contains(result, "/") {
+			t.Errorf("encodeProjectPath(%q) = %q: contains unencoded slash", project, result)
+		}
+	})
+}