feat(notify): release v1.8.0 — Slack/Teams/Google Chat/Telegram/webhook notifications

- Add internal/notify package: best-effort release notifications to Slack, Microsoft Teams, Google Chat, Telegram, and a generic JSON webhook; every target is independently opt-in and a failed notification never fails the release
- Add notify config section (slack_webhook_url, teams_webhook_url, google_chat_webhook_url, telegram_bot_token/telegram_chat_id, webhook_url) with matching env var fallbacks; 100% coverage plus FuzzMessagePayloads
- Wire notification sending into run() — fires after tag+push (including --no-release), skipped on --no-push/--no-commit since nothing was published yet
- Document the notify section in README, Hugo docs, and .releaser.yml template; update CLAUDE.md architecture/fuzzing tables
- Also commit the Apache License 2.0 docs-site footer link (docs/hugo.toml geekdocContentLicense), left uncommitted from a prior change

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

.gitea/workflows/docs.yml

@@ -0,0 +1,67 @@
+name: docs
+
+on:
+  push:
+    branches:
+      - main
+    paths:
+      - 'docs/**'
+      - '.gitea/workflows/docs.yml'
+
+vars:
+  HUGO_VERSION: "0.128.2"
+  GEEKDOC_VERSION: "v4.1.1"
+
+jobs:
+  deploy:
+    name: Build and deploy docs
+    runs-on: ubuntu-latest
+    container:
+      image: alpine:latest
+
+    steps:
+      - name: Install tools
+        run: apk add --no-cache curl git tar
+
+      - name: Checkout
+        env:
+          TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          SERVER_URL: ${{ github.server_url }}
+          REPO: ${{ github.repository }}
+        run: |
+          git clone --depth 1 \
+            "$(echo "$SERVER_URL" | sed "s|https://|https://oauth2:${TOKEN}@|")/${REPO}.git" .
+
+      - name: Install Hugo
+        env:
+          HUGO_VERSION: ${{ vars.HUGO_VERSION }}
+        run: |
+          curl -sSL "https://github.com/gohugoio/hugo/releases/download/v${HUGO_VERSION}/hugo_${HUGO_VERSION}_Linux-64bit.tar.gz" \
+            | tar xz -C /usr/local/bin hugo
+
+      - name: Download Geekdoc theme
+        env:
+          GEEKDOC_VERSION: ${{ vars.GEEKDOC_VERSION }}
+        run: |
+          mkdir -p docs/themes/geekdoc
+          curl -sSL "https://github.com/thegeeklab/hugo-geekdoc/releases/download/${GEEKDOC_VERSION}/hugo-geekdoc.tar.gz" \
+            | tar xz -C docs/themes/geekdoc
+
+      - name: Build
+        run: hugo --source docs --destination public --minify
+
+      - name: Deploy to pages branch
+        env:
+          TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          SERVER_URL: ${{ github.server_url }}
+          REPO: ${{ github.repository }}
+        run: |
+          cd docs/public
+          git init
+          git config user.email "ci@git.k3nny.fr"
+          git config user.name "Gitea CI"
+          git add .
+          git commit -m "deploy docs $(date +%Y-%m-%dT%H:%M:%SZ)"
+          git push --force \
+            "$(echo "$SERVER_URL" | sed "s|https://|https://oauth2:${TOKEN}@|")/${REPO}.git" \
+            HEAD:gh-pages

.gitignore

@@ -1,8 +1,15 @@
 # build output
 /bin/
-releaser-*
+/releaser-*
 
 # test coverage
 coverage.out
 coverage.html
 
+# docs build artifacts (downloaded at build time)
+/docs/themes/
+/docs/public/
+
+# Task runner cache
+/.task/
+

.releaser.yml

@@ -50,6 +50,27 @@ git:
   #   - "packages/frontend/package.json"
   #   - "packages/backend/package.json"
 
+# python:
+  # Single pyproject.toml path (opt-in — no default).
+  # Reads [project].version (PEP 621) first, then [tool.poetry].version.
+  # pyproject_toml: "pyproject.toml"
+
+  # Multiple pyproject.toml paths for monorepos (overrides pyproject_toml).
+  # pyproject_tomls:
+  #   - "pyproject.toml"
+  #   - "packages/cli/pyproject.toml"
+
+# gradle:
+  # Single build.gradle or build.gradle.kts path (opt-in — no default).
+  # Both Groovy DSL (single-quoted) and Kotlin DSL (double-quoted) are supported.
+  # build_file: "build.gradle"
+
+  # Multiple build files for multi-module projects (overrides build_file).
+  # build_files:
+  #   - "build.gradle"
+  #   - "module-a/build.gradle"
+  #   - "module-b/build.gradle"
+
 gitlab:
   # GitLab instance URL. Falls back to the CI_SERVER_URL environment variable.
   # url: "https://gitlab.example.com"

CHANGELOG.md

@@ -3,6 +3,89 @@
 All notable changes to this project will be documented in this file.
 Format: [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
+## [1.8.0] - 2026-07-12
+
+### Added
+
+- **Release notifications** — new `internal/notify` package; best-effort notification on release to Slack, Microsoft Teams, Google Chat, Telegram, and/or a generic JSON webhook; every target is independently opt-in and a failed notification never fails the release
+- **`notify` config section** — `slack_webhook_url`, `teams_webhook_url`, `google_chat_webhook_url`, `telegram_bot_token` + `telegram_chat_id`, `webhook_url`; each also configurable via env var (`SLACK_WEBHOOK_URL`, `TEAMS_WEBHOOK_URL`, `GOOGLE_CHAT_WEBHOOK_URL`, `TELEGRAM_BOT_TOKEN`, `TELEGRAM_CHAT_ID`, `RELEASER_WEBHOOK_URL`)
+- **`FuzzMessagePayloads`** in `internal/notify` — 100% per-package statement coverage maintained across all 15 packages
+
+## [1.7.1] - 2026-07-12
+
+### Added
+
+- **Apache License 2.0** — `LICENSE` file added, Copyright 2026 K3nnyfr (alex@k3nny.fr); linked from a new `## License` section in README.md
+
+### Fixed
+
+- **`task docs:build` stale output** — Hugo build now passes `--cleanDestinationDir` so removed/renamed files don't linger in `docs/public`
+
+### Changed
+
+- **`.gitignore`** — `/.task/` (Task runner's local checksum cache) is now ignored
+
+## [1.7.0] - 2026-07-12
+
+### Added
+
+- **Python `pyproject.toml` support** — new `internal/pyproject` package; reads `[project].version` (PEP 621) first, then `[tool.poetry].version` (Poetry); original formatting preserved on write; `regexp.QuoteMeta` ensures safety with dot-containing version strings
+- **`python.pyproject_toml` / `python.pyproject_tomls` config** — opt-in, no default; `pyproject_tomls` list overrides `pyproject_toml` for monorepos; follows the established multi-value pattern (Maven, Node, Gradle)
+- **`--pyproject <path>` flag** — overrides `python.pyproject_toml` and clears `pyproject_tomls`; shown in verbose config table as `python.paths`
+- **`FuzzReadVersion` / `FuzzWriteVersion`** in `internal/pyproject` — 100% per-package statement coverage maintained across all 14 packages
+
+## [1.6.3] - 2026-07-11
+
+### Added
+
+- **Logo** — `docs/static/images/releaser-logo-1024.png` (1024×1024) set as Geekdoc site header logo via `geekdocLogo`; 128×128 version added to README above the release badge
+
+### Fixed
+
+- **`.gitignore` over-matching** — `releaser-*` was catching files inside `docs/static/images/`; anchored to `/releaser-*` so only root-level release binaries are excluded
+
+### Changed
+
+- **`docs/hugo.toml` `baseURL`** — set to `https://releaser.k3nny.fr/` (was `"/"`)
+
+## [1.6.2] - 2026-07-11
+
+### Changed
+
+- **`task ci` now runs `go tool staticcheck ./...`** — runs between `go vet` and `go test`; matches the step already present in the Gitea CI workflow
+
+### Fixed
+
+- **SA4006 in `TestLatestTagTagsIterFails`** — `err` from `gogit.PlainOpen` was assigned then immediately overwritten without being read; added the missing `if err != nil { t.Fatalf(...) }` check
+
+## [1.6.1] - 2026-07-11
+
+### Fixed
+
+- **CI root-permission failures** — four tests that used `os.Chmod` to force error paths were failing in Docker CI (which runs as root, where chmod has no enforcement effect); each now skips with `os.Getuid() == 0`; the gitutil test had broken skip logic that only fired if `Chmod` itself errored — replaced with the same upfront UID check
+
+## [1.6.0] - 2026-07-11
+
+### Added
+
+- **Gradle support** — new `internal/gradle` package; reads and writes the version assignment in `build.gradle` (Groovy DSL, single-quoted) and `build.gradle.kts` (Kotlin DSL, double-quoted); original quote style preserved on write; `regexp.QuoteMeta` ensures version strings with dots or special chars are safe
+- **`gradle.build_file` / `gradle.build_files` config** — opt-in, no default; `build_files` list overrides `build_file` for multi-module projects; follows the same multi-value pattern as `maven.pom_paths` and `node.package_jsons`
+- **`--gradle <path>` flag** — overrides `gradle.build_file` from config and clears `gradle.build_files`; mirrored in verbose config table as `gradle.paths`
+- **`FuzzReadVersion` / `FuzzWriteVersion`** in `internal/gradle` — 100% per-package statement coverage maintained across all 13 packages
+
+## [1.5.1] - 2026-07-11
+
+### Added
+
+- **Documentation site** — Hugo + Geekdoc theme; content covers installation, CLI reference, configuration, CI integration, and changelog; deployed to `gh-pages` via Gitea CI on push to `main`
+- **`docs:setup` / `docs:serve` / `docs:build` Taskfile tasks** — `docs:setup` downloads the Geekdoc theme bundle (idempotent); `docs:serve` runs Hugo with live reload; `docs:build` produces a minified static site
+- **`FuzzUpdate`** in `internal/changelog` — fuzzes arbitrary existing file content paired with a commit message, covering the `\n## [` insertion logic and idempotency guard
+- **`FuzzWriteVersion`** in `internal/node` — mirrors `FuzzReplaceProjectVersion` in `internal/maven`; fuzzes arbitrary JSON content with arbitrary old/new version strings
+
+### Changed
+
+- **CLAUDE.md** — new "Fuzzing" section: authoritative table of which packages require fuzz tests and why, list of exempt packages with rationale, seed corpus guidelines
+
 ## [1.5.0] - 2026-07-11
 
 ### Added

CLAUDE.md

@@ -0,0 +1,113 @@
+# CLAUDE.md — project guidelines for releaser
+
+## Overview
+
+`releaser` is a single-binary Go tool for GitFlow-based release automation. It targets Conventional Commits, versioned release branches (`release/X.Y`), and GitLab / GitHub release creation.
+
+## Architecture
+
+```
+cmd/main.go          — CLI entrypoint (cobra), run() pipeline, verbose output
+internal/branch/     — branch name parser → major/minor
+internal/changelog/  — CHANGELOG.md writer
+internal/commits/    — Conventional Commits parser (non-strict)
+internal/config/     — .releaser.yml loader + env var overlay + source tracking
+internal/ghclient/   — minimal GitHub Releases API client
+internal/gitutil/    — go-git helpers: tag discovery, commit walker, push
+internal/glclient/   — minimal GitLab Releases API client
+internal/gradle/     — build.gradle / build.gradle.kts version reader/writer
+internal/maven/      — pom.xml version reader/writer
+internal/node/       — package.json version reader/writer
+internal/notes/      — release notes body generator
+internal/notify/     — Slack / Teams / Google Chat / Telegram / webhook release notifications
+internal/pyproject/  — pyproject.toml version reader/writer
+internal/version/    — semver next-version calculator
+```
+
+## Code conventions
+
+- **No third-party test frameworks** — stdlib `testing` only.
+- **No interfaces for mocking** — inject function variables (`var absPath = filepath.Abs`) to test error paths.
+- **No comments explaining what** — only comments explaining *why* (hidden constraints, invariants, non-obvious workarounds).
+- **No error handling for impossible paths** — trust internal invariants; only validate at system boundaries.
+- **No abstractions ahead of need** — three similar lines beats a premature helper.
+
+## Test coverage
+
+**100% per-package statement coverage is required** across all packages. Run:
+
+```bash
+go test ./... -cover
+```
+
+Every package must show `coverage: 100.0% of statements`.
+
+Strategies used in this project:
+- **Error path injection**: override `var absPath`, `var gitAllCommits`, etc. to return injected errors.
+- **Filesystem tricks**: `os.Mkdir` where a file is expected (invisible to go-git dirty check; fails os.WriteFile/os.ReadFile); `os.Chmod(..., 0444)` to make files read-only.
+- **Null byte paths**: `"path\x00name"` causes `os.Stat` to return `EINVAL` (not `ErrNotExist`), useful for testing stat-error paths that differ from file-not-found.
+- **In-memory git repos**: use go-git `PlainInit` + local bare remote for push tests.
+- **Direct function calls**: call unexported helpers (e.g. `printVerboseConfig`) directly with crafted inputs to cover branches that are dead via normal CLI flow.
+
+## Fuzzing
+
+**Every package that parses free-form text or reads/writes arbitrary file content must have at least one fuzz test.** Run the full seed corpus with:
+
+```bash
+go test -run='^Fuzz' ./...
+```
+
+All seed cases must pass. The table below is authoritative — keep it in sync when adding packages or parsers:
+
+| Package | Fuzz target(s) | Why |
+|---------|---------------|-----|
+| `internal/branch` | `FuzzParse` | parses branch name strings |
+| `internal/changelog` | `FuzzUpdate` | rewrites arbitrary existing file content |
+| `internal/commits` | `FuzzParse` | parses arbitrary commit message strings |
+| `internal/gradle` | `FuzzReadVersion`, `FuzzWriteVersion` | reads/rewrites arbitrary Gradle build file content |
+| `internal/pyproject` | `FuzzReadVersion`, `FuzzWriteVersion` | reads/rewrites arbitrary pyproject.toml content |
+| `internal/glclient` | `FuzzEncodeProjectPath` | encodes arbitrary project path strings |
+| `internal/maven` | `FuzzReadVersion`, `FuzzReplaceProjectVersion` | reads/rewrites arbitrary XML file content |
+| `internal/node` | `FuzzReadVersion`, `FuzzWriteVersion` | reads/rewrites arbitrary JSON file content |
+| `internal/notes` | `FuzzGenerate` | generates notes from arbitrary commit messages |
+| `internal/notify` | `FuzzMessagePayloads` | builds notification JSON payloads from arbitrary release notes |
+
+Packages **not** requiring fuzz tests (no free-form text parsing): `internal/config` (yaml.v3 handles parsing), `internal/ghclient` (HTTP client, no text parsing), `internal/gitutil` (git operations), `internal/version` (typed inputs only), `cmd` (CLI orchestration). When adding a new package, check whether it parses text or rewrites files — if yes, add a row above.
+
+Fuzz seed corpus guidelines:
+- Include a realistic happy-path input as the first seed.
+- Include empty string, binary/non-UTF-8 bytes (`"\x00\xff"`), and inputs that stress known branches (e.g. existing `## [version]` heading for changelog).
+- The fuzz body must never assert on return values — only verify no panic.
+
+## Documentation sync
+
+**Every change that adds, changes, or removes a feature, flag, or config key must update all of the following in the same commit:**
+
+- `README.md` — features list, usage examples, option tables, version badge
+- `CHANGELOG.md` — new dated `## [X.Y.Z]` entry (see `/release` skill for format)
+- `ROADMAP.md` — mark shipped items `✓`, add a "Shipped in vX.Y.Z" note, drop outdated caveats
+- Hugo docs under `docs/content/` (`installation.md`, `usage.md`, `configuration.md`, `ci-integration.md`, `changelog.md`) — whichever pages describe the changed behavior
+
+Treat these as one unit: a PR that changes CLI behavior or config but leaves any of the above stale is incomplete. `docs/content/changelog.md` only needs an entry for tagged (minor/major) releases, matching the pattern already in that file — patch-only releases are covered by the root `CHANGELOG.md` but not duplicated there.
+
+## Dependency rules
+
+- **No new external dependencies** unless absolutely necessary. The project deliberately avoids pulling in large ecosystems.
+- go-git (`github.com/go-git/go-git/v5`) for all git operations.
+- cobra for CLI parsing.
+- gopkg.in/yaml.v3 for config.
+
+## Config design
+
+- New config fields go in the appropriate `*Config` struct in `internal/config/config.go`.
+- `defaultSources()` must be updated to include every new key.
+- `LoadWithSources` overlay detection must cover every new field.
+- `printVerboseConfig` in `cmd/main.go` must show every new config value.
+
+## Multi-value config pattern
+
+When a config supports both a single value and multiple values (like `pom_path` / `pom_paths`):
+- Single field: `PomPath string`
+- Multi field: `PomPaths []string`
+- `EffectivePomPaths()` method: `PomPaths` wins if non-empty, else `PomPath` if set, else default.
+- `--pom` CLI flag clears `PomPaths` and sets `PomPath` only.

LICENSE

@@ -0,0 +1,202 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright 2026 K3nnyfr (alex@k3nny.fr)
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

README.md

@@ -1,9 +1,13 @@
 # releaser
 
-![release](https://img.shields.io/badge/release-v1.5.0-blue.svg)
+<img src="docs/static/images/releaser-logo-128.png" alt="releaser logo" width="128">
+
+![release](https://img.shields.io/badge/release-v1.8.0-blue.svg)
 
 A CI-friendly release automation tool for GitFlow workflows using Conventional Commits.
 
+**[Documentation](https://releaser.k3nny.fr)** · **[Repository](https://git.k3nny.fr/k3nny/releaser)**
+
 ## Problem
 
 Standard tools like `semantic-release` are designed for trunk-based development. In a GitFlow setup with versioned release branches (`release/1.1`, `release/1.2`), they either fail to respect the branch's version range or require brittle configuration.
@@ -23,7 +27,8 @@ release/1.2 branch
 2. **Tag discovery** — finds the latest tag matching `major.minor.*` on the current branch
 3. **Commit analysis** — parses Conventional Commits between last tag and HEAD
 4. **Version bump** — increments patch (the minor is owned by the branch)
-5. **Release** — updates `pom.xml`, commits, tags, creates GitLab or GitHub release
+5. **Release** — updates `pom.xml` / `package.json` / `build.gradle`, commits, tags, creates GitLab or GitHub release
+6. **Notify** — best-effort notification to Slack, Microsoft Teams, Google Chat, Telegram, and/or a generic webhook
 
 ## Version bump rules
 
@@ -115,6 +120,18 @@ node:                                                # opt-in — no default; om
   #   - "packages/frontend/package.json"
   #   - "packages/backend/package.json"
 
+gradle:                                              # opt-in — no default; omit to skip
+  # build_file: "build.gradle"                       # Groovy or Kotlin DSL; single path
+  # build_files:                                     # multi-module: list overrides build_file
+  #   - "build.gradle"
+  #   - "module-a/build.gradle"
+
+python:                                              # opt-in — no default; omit to skip
+  # pyproject_toml: "pyproject.toml"                 # PEP 621 [project] or [tool.poetry]
+  # pyproject_tomls:                                 # monorepo: list overrides pyproject_toml
+  #   - "pyproject.toml"
+  #   - "packages/cli/pyproject.toml"
+
 gitlab:
   url: "https://gitlab.example.com"                  # or env CI_SERVER_URL
   token: ""                                          # env GITLAB_TOKEN (never commit this)
@@ -123,6 +140,14 @@ gitlab:
 github:
   token: ""                                          # env GITHUB_TOKEN (never commit this)
   repo: ""                                           # "owner/repo" format
+
+notify:                                              # opt-in — every field independent; failures are warnings, not errors
+  # slack_webhook_url: ""                             # or env SLACK_WEBHOOK_URL
+  # teams_webhook_url: ""                             # or env TEAMS_WEBHOOK_URL
+  # google_chat_webhook_url: ""                       # or env GOOGLE_CHAT_WEBHOOK_URL
+  # telegram_bot_token: ""                            # or env TELEGRAM_BOT_TOKEN (both required)
+  # telegram_chat_id: ""                              # or env TELEGRAM_CHAT_ID
+  # webhook_url: ""                                   # generic {"version","notes"} JSON POST; or env RELEASER_WEBHOOK_URL
 ```
 
 ### Environment variables
@@ -134,8 +159,13 @@ github:
 | `CI_PROJECT_ID`    | GitLab project identifier (numeric) |
 | `CI_PROJECT_PATH`  | GitLab project identifier (fallback) |
 | `GITHUB_TOKEN`     | GitHub API auth                   |
+| `SLACK_WEBHOOK_URL` | Slack release notification       |
+| `TEAMS_WEBHOOK_URL` | Microsoft Teams release notification |
+| `GOOGLE_CHAT_WEBHOOK_URL` | Google Chat release notification |
+| `TELEGRAM_BOT_TOKEN` / `TELEGRAM_CHAT_ID` | Telegram release notification (both required) |
+| `RELEASER_WEBHOOK_URL` | Generic webhook release notification |
 
-When both `github.*` and `gitlab.*` are configured, GitHub takes precedence.
+When both `github.*` and `gitlab.*` are configured, GitHub takes precedence. All `notify.*` targets are independent — any combination may be configured at once, and a failed notification never fails the release.
 
 ## CI integration (GitLab CI example)
 
@@ -153,3 +183,7 @@ release:
     reports:
       dotenv: release.env          # exposes NEXT_VERSION to downstream jobs
 ```
+
+## License
+
+Apache License 2.0 — see [LICENSE](LICENSE).

ROADMAP.md

@@ -74,7 +74,7 @@
 - [x] ~~GitHub release support~~ — ✓ shipped v1.4.0 (`internal/ghclient`, `GITHUB_TOKEN` env, `github.token`/`github.repo` config; GitHub takes precedence over GitLab)
 - [x] ~~SSH agent push~~ — ✓ shipped v1.4.0 (go-git `gitssh.NewSSHAgentAuth` for `git@`/`ssh://` remotes)
 - [x] ~~Configurable bump rules~~ — ✓ shipped v1.4.0 (`git.releasable_types` config; filter which commit types trigger a release)
-- [ ] Documentation site
+- [x] ~~Documentation site~~ — ✓ shipped v1.5.1 (Hugo + Geekdoc; installation, CLI reference, configuration, CI integration pages; deployed via Gitea CI to `gh-pages`)
 
 ## v1.5 — Multi-module, Node.js, configurable bump rules ✅
 
@@ -85,6 +85,6 @@
 
 ## Future / backlog
 
-- Gradle support (`build.gradle` / `build.gradle.kts`)
-- Slack / Teams notification on release
-- Documentation site
+- ~~Gradle support (`build.gradle` / `build.gradle.kts`)~~ — ✓ shipped v1.6.0 (`internal/gradle`; Groovy + Kotlin DSL; multi-module via `gradle.build_files`; `--gradle` flag)
+- ~~Python `pyproject.toml` version bump (`[project].version` and `[tool.poetry].version`; single and multi-path like Maven's `pom_paths`)~~ — ✓ shipped v1.7.0 (`internal/pyproject`; PEP 621 + Poetry; `python.pyproject_tomls`; `--pyproject` flag)
+- ~~Slack / Teams notification on release~~ — ✓ shipped v1.8.0 (`internal/notify`; Slack, Microsoft Teams, Google Chat, Telegram, and generic webhook; each opt-in via `notify.*` config or env var; best-effort — never fails the release)

Taskfile.yml

@@ -4,6 +4,7 @@ vars:
   BIN: ./bin/releaser
   PKG: ./...
   FUZZ_TIME: 30s
+  GEEKDOC_VERSION: "v4.1.1"
 
 tasks:
   default:
@@ -76,7 +77,7 @@ tasks:
       - go test -run='^Fuzz' {{.PKG}}
 
   ci:
-    desc: Full CI pipeline — tidy check, vet, test
+    desc: Full CI pipeline — tidy check, vet, staticcheck, test
     cmds:
       - task: tidy
       - |
@@ -85,6 +86,7 @@ tasks:
           exit 1
         fi
       - task: lint
+      - go tool staticcheck ./...
       - task: test
 
   clean:
@@ -105,3 +107,23 @@ tasks:
       TAG: '{{.TAG | default "releaser:dev"}}'
     cmds:
       - docker run --rm {{.TAG}} {{.CLI_ARGS}}
+
+  docs:setup:
+    desc: Download Geekdoc theme into docs/themes/geekdoc/
+    cmds:
+      - mkdir -p docs/themes/geekdoc
+      - curl -sSL "https://github.com/thegeeklab/hugo-geekdoc/releases/download/{{.GEEKDOC_VERSION}}/hugo-geekdoc.tar.gz" | tar xz -C docs/themes/geekdoc
+    status:
+      - test -f docs/themes/geekdoc/theme.toml
+
+  docs:serve:
+    desc: Serve docs locally with live reload (requires hugo)
+    deps: [docs:setup]
+    cmds:
+      - hugo server --source docs
+
+  docs:build:
+    desc: Build docs to docs/public/ (requires hugo)
+    deps: [docs:setup]
+    cmds:
+      - hugo --source docs --destination public --cleanDestinationDir --minify

cmd/main.go

@@ -18,9 +18,12 @@ import (
 	"git.k3nny.fr/releaser/internal/ghclient"
 	"git.k3nny.fr/releaser/internal/gitutil"
 	"git.k3nny.fr/releaser/internal/glclient"
+	"git.k3nny.fr/releaser/internal/gradle"
 	"git.k3nny.fr/releaser/internal/maven"
+	"git.k3nny.fr/releaser/internal/pyproject"
 	"git.k3nny.fr/releaser/internal/node"
 	"git.k3nny.fr/releaser/internal/notes"
+	"git.k3nny.fr/releaser/internal/notify"
 	semver "git.k3nny.fr/releaser/internal/version"
 )
 
@@ -78,6 +81,28 @@ node:
   #   - "packages/frontend/package.json"
   #   - "packages/backend/package.json"
 
+gradle:
+  # Single build.gradle or build.gradle.kts path (opt-in — no default).
+  # Both Groovy DSL (single-quoted) and Kotlin DSL (double-quoted) are supported.
+  # build_file: "build.gradle"
+
+  # Multiple build files for multi-module projects (overrides build_file).
+  # build_files:
+  #   - "build.gradle"
+  #   - "module-a/build.gradle"
+  #   - "module-b/build.gradle"
+
+python:
+  # Single pyproject.toml path (opt-in — no default).
+  # Reads [project].version (PEP 621) first, then [tool.poetry].version.
+  # pyproject_toml: "pyproject.toml"
+
+  # Multiple pyproject.toml paths for monorepos (overrides pyproject_toml).
+  # pyproject_tomls:
+  #   - "pyproject.toml"
+  #   - "packages/cli/pyproject.toml"
+  #   - "packages/lib/pyproject.toml"
+
 gitlab:
   # GitLab instance URL. Falls back to the CI_SERVER_URL environment variable.
   # url: "https://gitlab.example.com"
@@ -98,6 +123,29 @@ github:
 
   # Repository in "owner/repo" format.
   # repo: ""
+
+notify:
+  # Every field below is opt-in. A target is only used when its required
+  # fields are set (via this file, or the matching environment variable).
+  # Notification failures never fail the release — they're logged as warnings.
+
+  # Slack incoming webhook URL. Falls back to SLACK_WEBHOOK_URL.
+  # slack_webhook_url: ""
+
+  # Microsoft Teams incoming webhook URL. Falls back to TEAMS_WEBHOOK_URL.
+  # teams_webhook_url: ""
+
+  # Google Chat incoming webhook URL. Falls back to GOOGLE_CHAT_WEBHOOK_URL.
+  # google_chat_webhook_url: ""
+
+  # Telegram bot token and chat ID — both required. Fall back to
+  # TELEGRAM_BOT_TOKEN and TELEGRAM_CHAT_ID.
+  # telegram_bot_token: ""
+  # telegram_chat_id: ""
+
+  # Generic webhook URL — POSTed a {"version": ..., "notes": ...} JSON body.
+  # Falls back to RELEASER_WEBHOOK_URL.
+  # webhook_url: ""
 `
 
 var (
@@ -149,6 +197,8 @@ func newRootCmd() *cobra.Command {
 		branchOverride  string
 		repoPath        string
 		pomOverride     string
+		gradleOverride     string
+		pyprojectOverride  string
 		changelogFile      string
 		tagPrefixFlag   string
 		tagPrefixSet    bool
@@ -171,6 +221,8 @@ func newRootCmd() *cobra.Command {
 				repoPath:       repoPath,
 				branchOverride: branchOverride,
 				pomOverride:    pomOverride,
+				gradleOverride:    gradleOverride,
+				pyprojectOverride: pyprojectOverride,
 				changelogFile:     changelogFile,
 				tagPrefixFlag:  tagPrefixFlag,
 				tagPrefixSet:   tagPrefixSet,
@@ -196,6 +248,8 @@ func newRootCmd() *cobra.Command {
 	root.Flags().StringVar(&branchOverride, "branch", "", "override branch name detection (required in detached HEAD)")
 	root.Flags().StringVar(&repoPath, "repo", ".", "path to git repository")
 	root.Flags().StringVar(&pomOverride, "pom", "", "override maven.pom_path from config")
+	root.Flags().StringVar(&gradleOverride, "gradle", "", "override gradle.build_file from config")
+	root.Flags().StringVar(&pyprojectOverride, "pyproject", "", "override python.pyproject_toml from config")
 	root.Flags().StringVar(&changelogFile, "changelog-file", "CHANGELOG.md", "path to changelog file relative to repo root")
 	root.Flags().StringVar(&tagPrefixFlag, "tag-prefix", "", "override git.tag_prefix from config")
 	root.Flags().StringVar(&patternFlag, "branch-pattern", "", "override git.branch_pattern from config")
@@ -220,6 +274,8 @@ type options struct {
 	repoPath        string
 	branchOverride  string
 	pomOverride     string
+	gradleOverride    string
+	pyprojectOverride string
 	changelogFile     string
 	tagPrefixFlag     string
 	tagPrefixSet    bool
@@ -233,6 +289,15 @@ type options struct {
 	releaseEnvFile  string
 }
 
+// maskedIfSet reports whether a secret-like config value is set, without
+// printing the value itself.
+func maskedIfSet(v string) string {
+	if v != "" {
+		return "(set)"
+	}
+	return "(not set)"
+}
+
 func printVerboseConfig(cfg config.Config, src config.Sources) {
 	logSection("configuration")
 	rows := []struct{ key, val string }{
@@ -273,21 +338,31 @@ func printVerboseConfig(cfg config.Config, src config.Sources) {
 			}
 			return strings.Join(paths, ", ")
 		}()},
+		{"gradle.paths", func() string {
+			paths := cfg.Gradle.EffectiveBuildFiles()
+			if len(paths) == 0 {
+				return "(not configured)"
+			}
+			return strings.Join(paths, ", ")
+		}()},
+		{"python.paths", func() string {
+			paths := cfg.Python.EffectivePaths()
+			if len(paths) == 0 {
+				return "(not configured)"
+			}
+			return strings.Join(paths, ", ")
+		}()},
 		{"gitlab.url", cfg.GitLab.URL},
-		{"gitlab.token", func() string {
-			if cfg.GitLab.Token != "" {
-				return "(set)"
-			}
-			return "(not set)"
-		}()},
+		{"gitlab.token", maskedIfSet(cfg.GitLab.Token)},
 		{"gitlab.project", cfg.GitLab.Project},
-		{"github.token", func() string {
-			if cfg.GitHub.Token != "" {
-				return "(set)"
-			}
-			return "(not set)"
-		}()},
+		{"github.token", maskedIfSet(cfg.GitHub.Token)},
 		{"github.repo", cfg.GitHub.Repo},
+		{"notify.slack_webhook_url", maskedIfSet(cfg.Notify.SlackWebhookURL)},
+		{"notify.teams_webhook_url", maskedIfSet(cfg.Notify.TeamsWebhookURL)},
+		{"notify.google_chat_webhook_url", maskedIfSet(cfg.Notify.GoogleChatWebhookURL)},
+		{"notify.telegram_bot_token", maskedIfSet(cfg.Notify.TelegramBotToken)},
+		{"notify.telegram_chat_id", maskedIfSet(cfg.Notify.TelegramChatID)},
+		{"notify.webhook_url", maskedIfSet(cfg.Notify.WebhookURL)},
 	}
 	for _, r := range rows {
 		source := src[r.key]
@@ -360,6 +435,16 @@ func run(o options) error {
 		cfg.Maven.PomPaths = nil
 		src["maven.pom_paths"] = "flag: --pom"
 	}
+	if o.gradleOverride != "" {
+		cfg.Gradle.BuildFile = o.gradleOverride
+		cfg.Gradle.BuildFiles = nil
+		src["gradle.build_files"] = "flag: --gradle"
+	}
+	if o.pyprojectOverride != "" {
+		cfg.Python.PyprojectTOML = o.pyprojectOverride
+		cfg.Python.PyprojectTOMLs = nil
+		src["python.pyproject_tomls"] = "flag: --pyproject"
+	}
 	if o.patternSet {
 		cfg.Git.BranchPattern = o.patternFlag
 		src["git.branch_pattern"] = "flag: --branch-pattern"
@@ -552,6 +637,34 @@ func run(o options) error {
 			filesToCommit = append(filesToCommit, relPkgPath)
 		}
 
+		// build.gradle / build.gradle.kts (opt-in via gradle.build_file / gradle.build_files)
+		for _, relGradlePath := range cfg.Gradle.EffectiveBuildFiles() {
+			gradlePath := filepath.Join(absRepo, relGradlePath)
+			currentGradleVersion, err := gradle.ReadVersion(gradlePath)
+			if err != nil {
+				return fmt.Errorf("read gradle version: %w", err)
+			}
+			if err := gradle.WriteVersion(gradlePath, currentGradleVersion, nextVersion); err != nil {
+				return fmt.Errorf("update gradle version: %w", err)
+			}
+			logDone("%s: %s → %s", relGradlePath, currentGradleVersion, nextVersion)
+			filesToCommit = append(filesToCommit, relGradlePath)
+		}
+
+		// pyproject.toml (opt-in via python.pyproject_toml / python.pyproject_tomls)
+		for _, relPyprojectPath := range cfg.Python.EffectivePaths() {
+			pyprojectPath := filepath.Join(absRepo, relPyprojectPath)
+			currentPyVersion, err := pyproject.ReadVersion(pyprojectPath)
+			if err != nil {
+				return fmt.Errorf("read pyproject version: %w", err)
+			}
+			if err := pyproject.WriteVersion(pyprojectPath, currentPyVersion, nextVersion); err != nil {
+				return fmt.Errorf("update pyproject version: %w", err)
+			}
+			logDone("%s: %s → %s", relPyprojectPath, currentPyVersion, nextVersion)
+			filesToCommit = append(filesToCommit, relPyprojectPath)
+		}
+
 		// CHANGELOG.md
 		changelogAbsPath := filepath.Join(absRepo, o.changelogFile)
 		if err := changelog.Update(changelogAbsPath, nextTag, nextVersion, messages); err != nil {
@@ -598,7 +711,10 @@ func run(o options) error {
 	}
 	logDone("pushed")
 
+	releaseNotes := notes.Generate(nextTag, messages)
+
 	if o.noRelease {
+		notifyRelease(cfg, nextTag, releaseNotes)
 		fmt.Printf("released %s\n", nextTag)
 		return nil
 	}
@@ -610,15 +726,31 @@ func run(o options) error {
 	}
 	if publisher == nil {
 		logWarn("no release provider configured — skipping release creation")
-		fmt.Printf("released %s\n", nextTag)
-		return nil
-	}
-
-	releaseNotes := notes.Generate(nextTag, messages)
+	} else {
 		if err := publisher.CreateRelease(context.Background(), nextTag, releaseNotes); err != nil {
 			return fmt.Errorf("create release: %w", err)
 		}
 		logDone("release created: %s", nextTag)
+	}
+
+	notifyRelease(cfg, nextTag, releaseNotes)
 	fmt.Printf("released %s\n", nextTag)
 	return nil
 }
+
+// notifyRelease sends best-effort release notifications to every configured
+// target. Failures are logged as warnings, not errors — the release itself
+// already succeeded by the time this runs.
+func notifyRelease(cfg config.Config, tagName, releaseNotes string) {
+	notifyCfg := notify.Config{
+		SlackWebhookURL:      cfg.Notify.SlackWebhookURL,
+		TeamsWebhookURL:      cfg.Notify.TeamsWebhookURL,
+		GoogleChatWebhookURL: cfg.Notify.GoogleChatWebhookURL,
+		TelegramBotToken:     cfg.Notify.TelegramBotToken,
+		TelegramChatID:       cfg.Notify.TelegramChatID,
+		WebhookURL:           cfg.Notify.WebhookURL,
+	}
+	for _, err := range notify.SendAll(context.Background(), notifyCfg, notify.Message{Version: tagName, Notes: releaseNotes}) {
+		logWarn("notification failed: %v", err)
+	}
+}

cmd/main_test.go

@@ -526,6 +526,118 @@ func TestRunWithGitLab(t *testing.T) {
 	}
 }
 
+func TestRunWithNotify(t *testing.T) {
+	var notified bool
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		notified = true
+		w.WriteHeader(http.StatusOK)
+	}))
+	defer srv.Close()
+
+	_, dir := setupRepoWithRemote(t)
+	addFile(t, dir, "x.go", "// fix")
+	repo, _ := gogit.PlainOpen(dir)
+	w, _ := repo.Worktree()
+	w.Add("x.go")
+	w.Commit("fix: patch something", &gogit.CommitOptions{Author: testSig()})
+
+	t.Setenv("SLACK_WEBHOOK_URL", srv.URL)
+
+	err := execCmd(t, "--branch", "release/1.2", "--repo", dir)
+	if err != nil {
+		t.Fatalf("release with notify: unexpected error: %v", err)
+	}
+	if !notified {
+		t.Error("expected Slack webhook to be called")
+	}
+}
+
+func TestRunNotifyFailureDoesNotFailRelease(t *testing.T) {
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.WriteHeader(http.StatusInternalServerError)
+	}))
+	defer srv.Close()
+
+	_, dir := setupRepoWithRemote(t)
+	addFile(t, dir, "x.go", "// fix")
+	repo, _ := gogit.PlainOpen(dir)
+	w, _ := repo.Worktree()
+	w.Add("x.go")
+	w.Commit("fix: patch something", &gogit.CommitOptions{Author: testSig()})
+
+	t.Setenv("SLACK_WEBHOOK_URL", srv.URL)
+
+	old := os.Stderr
+	r, wPipe, _ := os.Pipe()
+	os.Stderr = wPipe
+
+	err := execCmd(t, "--branch", "release/1.2", "--repo", dir)
+
+	wPipe.Close()
+	os.Stderr = old
+	rawBytes, _ := io.ReadAll(r)
+	output := string(rawBytes)
+
+	if err != nil {
+		t.Fatalf("a failed notification must not fail the release: %v", err)
+	}
+	if !strings.Contains(output, "notification failed") {
+		t.Errorf("expected a notification-failed warning, got:\n%s", output)
+	}
+}
+
+func TestRunNoReleaseStillNotifies(t *testing.T) {
+	var notified bool
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		notified = true
+		w.WriteHeader(http.StatusOK)
+	}))
+	defer srv.Close()
+
+	_, dir := setupRepoWithRemote(t)
+	addFile(t, dir, "x.go", "// fix")
+	repo, _ := gogit.PlainOpen(dir)
+	w, _ := repo.Worktree()
+	w.Add("x.go")
+	w.Commit("fix: patch something", &gogit.CommitOptions{Author: testSig()})
+
+	t.Setenv("SLACK_WEBHOOK_URL", srv.URL)
+
+	err := execCmd(t, "--no-release", "--branch", "release/1.2", "--repo", dir)
+	if err != nil {
+		t.Fatalf("--no-release: unexpected error: %v", err)
+	}
+	if !notified {
+		t.Error("expected Slack webhook to be called even with --no-release")
+	}
+}
+
+func TestRunNoPushSkipsNotify(t *testing.T) {
+	var notified bool
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		notified = true
+		w.WriteHeader(http.StatusOK)
+	}))
+	defer srv.Close()
+
+	_, dir := setupRepo(t)
+	addFile(t, dir, "x.go", "// fix")
+	repo, _ := gogit.PlainOpen(dir)
+	w, _ := repo.Worktree()
+	w.Add("x.go")
+	w.Commit("fix: patch something", &gogit.CommitOptions{Author: testSig()})
+
+	t.Setenv("SLACK_WEBHOOK_URL", srv.URL)
+
+	err := execCmd(t, "--no-push", "--branch", "release/1.2", "--repo", dir)
+	if err != nil {
+		t.Fatalf("--no-push: unexpected error: %v", err)
+	}
+	if notified {
+		t.Error("--no-push must not send notifications — nothing was published")
+	}
+}
+
 // ── main() tests via exitFn ───────────────────────────────────────────────────
 
 func TestMainSuccess(t *testing.T) {
@@ -852,6 +964,9 @@ func TestPrintVerboseConfigDirect(t *testing.T) {
 // ── initConfig coverage ───────────────────────────────────────────────────────
 
 func TestInitConfigWriteFails(t *testing.T) {
+	if os.Getuid() == 0 {
+		t.Skip("skipping: chmod restrictions do not apply when running as root")
+	}
 	dir := t.TempDir()
 	os.Chmod(dir, 0555)
 	defer os.Chmod(dir, 0755)
@@ -904,6 +1019,9 @@ func TestRunWorkingTreeCheckFails(t *testing.T) {
 }
 
 func TestRunLatestTagFails(t *testing.T) {
+	if os.Getuid() == 0 {
+		t.Skip("skipping: chmod restrictions do not apply when running as root")
+	}
 	_, dir := setupRepo(t)
 	addFile(t, dir, "x.go", "// fix")
 	repo, _ := gogit.PlainOpen(dir)
@@ -1094,6 +1212,8 @@ func TestPrintVerboseConfigBumpRulesAndNode(t *testing.T) {
 			BumpRules: config.BumpRulesConfig{Breaking: "minor", Feat: "minor", Fix: "minor"},
 		},
 		Node:   config.NodeConfig{PackageJSON: "package.json"},
+		Gradle: config.GradleConfig{BuildFile: "build.gradle"},
+		Python: config.PythonConfig{PyprojectTOML: "pyproject.toml"},
 	}
 	src := config.Sources{}
 
@@ -1112,6 +1232,12 @@ func TestPrintVerboseConfigBumpRulesAndNode(t *testing.T) {
 	if !strings.Contains(output, "package.json") {
 		t.Error("expected 'package.json' in output for node.paths")
 	}
+	if !strings.Contains(output, "build.gradle") {
+		t.Error("expected 'build.gradle' in output for gradle.paths")
+	}
+	if !strings.Contains(output, "pyproject.toml") {
+		t.Error("expected 'pyproject.toml' in output for python.paths")
+	}
 }
 
 // ── node package.json handling ────────────────────────────────────────────────
@@ -1200,3 +1326,254 @@ func TestRunNodeWriteVersionFails(t *testing.T) {
 		t.Fatal("expected error when package.json is read-only")
 	}
 }
+
+// ── gradle build file handling ────────────────────────────────────────────────
+
+func writeGradleFile(t *testing.T, dir, ver string) {
+	t.Helper()
+	content := fmt.Sprintf("group = \"com.example\"\nversion = \"%s\"\n", ver)
+	if err := os.WriteFile(filepath.Join(dir, "build.gradle"), []byte(content), 0644); err != nil {
+		t.Fatal(err)
+	}
+}
+
+func TestRunGradleVersionBump(t *testing.T) {
+	dir := t.TempDir()
+	repo, err := gogit.PlainInit(dir, false)
+	if err != nil {
+		t.Fatal(err)
+	}
+	writeGradleFile(t, dir, "0.0.0")
+	commitAll(t, repo, dir, "chore: init")
+
+	os.WriteFile(filepath.Join(dir, ".releaser.yml"), []byte("gradle:\n  build_file: \"build.gradle\"\n"), 0644)
+
+	addFile(t, dir, "x.go", "// fix")
+	w, _ := repo.Worktree()
+	w.Add("x.go")
+	w.Commit("fix: something", &gogit.CommitOptions{Author: testSig()})
+
+	if err := execCmd(t, "--no-push", "--branch", "release/1.2", "--repo", dir); err != nil {
+		t.Fatalf("gradle version bump: unexpected error: %v", err)
+	}
+
+	data, _ := os.ReadFile(filepath.Join(dir, "build.gradle"))
+	if !strings.Contains(string(data), `version = "1.2.0"`) {
+		t.Errorf("expected version 1.2.0 in build.gradle, got: %s", data)
+	}
+}
+
+func TestRunGradleOverrideFlag(t *testing.T) {
+	dir := t.TempDir()
+	repo, err := gogit.PlainInit(dir, false)
+	if err != nil {
+		t.Fatal(err)
+	}
+	// Write gradle file at custom path
+	if err := os.MkdirAll(filepath.Join(dir, "sub"), 0755); err != nil {
+		t.Fatal(err)
+	}
+	content := "version = \"0.0.0\"\n"
+	os.WriteFile(filepath.Join(dir, "sub", "build.gradle"), []byte(content), 0644)
+	commitAll(t, repo, dir, "chore: init")
+
+	addFile(t, dir, "x.go", "// fix")
+	w, _ := repo.Worktree()
+	w.Add("x.go")
+	w.Commit("fix: something", &gogit.CommitOptions{Author: testSig()})
+
+	if err := execCmd(t, "--no-push", "--branch", "release/1.2", "--repo", dir, "--gradle", "sub/build.gradle"); err != nil {
+		t.Fatalf("--gradle flag: unexpected error: %v", err)
+	}
+
+	data, _ := os.ReadFile(filepath.Join(dir, "sub", "build.gradle"))
+	if !strings.Contains(string(data), `version = "1.2.0"`) {
+		t.Errorf("expected version 1.2.0, got: %s", data)
+	}
+}
+
+func TestRunGradleReadVersionFails(t *testing.T) {
+	dir := t.TempDir()
+	repo, err := gogit.PlainInit(dir, false)
+	if err != nil {
+		t.Fatal(err)
+	}
+	// build.gradle with no version assignment
+	os.WriteFile(filepath.Join(dir, "build.gradle"), []byte(`group = "com.example"`), 0644)
+	commitAll(t, repo, dir, "chore: init")
+
+	os.WriteFile(filepath.Join(dir, ".releaser.yml"), []byte("gradle:\n  build_file: \"build.gradle\"\n"), 0644)
+
+	addFile(t, dir, "x.go", "// fix")
+	w, _ := repo.Worktree()
+	w.Add("x.go")
+	w.Commit("fix: something", &gogit.CommitOptions{Author: testSig()})
+
+	if err := execCmd(t, "--branch", "release/1.2", "--repo", dir); err == nil {
+		t.Fatal("expected error when build.gradle has no version assignment")
+	}
+}
+
+func TestRunGradleWriteVersionFails(t *testing.T) {
+	dir := t.TempDir()
+	repo, err := gogit.PlainInit(dir, false)
+	if err != nil {
+		t.Fatal(err)
+	}
+	writeGradleFile(t, dir, "0.0.0")
+	commitAll(t, repo, dir, "chore: init")
+
+	os.WriteFile(filepath.Join(dir, ".releaser.yml"), []byte("gradle:\n  build_file: \"build.gradle\"\n"), 0644)
+
+	addFile(t, dir, "x.go", "// fix")
+	w, _ := repo.Worktree()
+	w.Add("x.go")
+	w.Commit("fix: something", &gogit.CommitOptions{Author: testSig()})
+
+	os.Chmod(filepath.Join(dir, "build.gradle"), 0444)
+	defer os.Chmod(filepath.Join(dir, "build.gradle"), 0644)
+
+	if err := execCmd(t, "--branch", "release/1.2", "--repo", dir); err == nil {
+		t.Fatal("expected error when build.gradle is read-only")
+	}
+}
+
+// ── pyproject.toml handling ───────────────────────────────────────────────────
+
+func writePyprojectFile(t *testing.T, dir, ver string) {
+	t.Helper()
+	content := fmt.Sprintf("[project]\nname = \"my-app\"\nversion = \"%s\"\n", ver)
+	if err := os.WriteFile(filepath.Join(dir, "pyproject.toml"), []byte(content), 0644); err != nil {
+		t.Fatal(err)
+	}
+}
+
+func TestRunPyprojectVersionBump(t *testing.T) {
+	dir := t.TempDir()
+	repo, err := gogit.PlainInit(dir, false)
+	if err != nil {
+		t.Fatal(err)
+	}
+	writePyprojectFile(t, dir, "0.0.0")
+	commitAll(t, repo, dir, "chore: init")
+
+	os.WriteFile(filepath.Join(dir, ".releaser.yml"), []byte("python:\n  pyproject_toml: \"pyproject.toml\"\n"), 0644)
+
+	addFile(t, dir, "x.go", "// fix")
+	w, _ := repo.Worktree()
+	w.Add("x.go")
+	w.Commit("fix: something", &gogit.CommitOptions{Author: testSig()})
+
+	if err := execCmd(t, "--no-push", "--branch", "release/1.2", "--repo", dir); err != nil {
+		t.Fatalf("pyproject version bump: unexpected error: %v", err)
+	}
+
+	data, _ := os.ReadFile(filepath.Join(dir, "pyproject.toml"))
+	if !strings.Contains(string(data), `version = "1.2.0"`) {
+		t.Errorf("expected version 1.2.0 in pyproject.toml, got: %s", data)
+	}
+}
+
+func TestRunPyprojectPoetryVersionBump(t *testing.T) {
+	dir := t.TempDir()
+	repo, err := gogit.PlainInit(dir, false)
+	if err != nil {
+		t.Fatal(err)
+	}
+	content := "[tool.poetry]\nname = \"my-app\"\nversion = \"0.0.0\"\n"
+	os.WriteFile(filepath.Join(dir, "pyproject.toml"), []byte(content), 0644)
+	commitAll(t, repo, dir, "chore: init")
+
+	os.WriteFile(filepath.Join(dir, ".releaser.yml"), []byte("python:\n  pyproject_toml: \"pyproject.toml\"\n"), 0644)
+
+	addFile(t, dir, "x.go", "// fix")
+	w, _ := repo.Worktree()
+	w.Add("x.go")
+	w.Commit("fix: something", &gogit.CommitOptions{Author: testSig()})
+
+	if err := execCmd(t, "--no-push", "--branch", "release/1.2", "--repo", dir); err != nil {
+		t.Fatalf("poetry version bump: unexpected error: %v", err)
+	}
+
+	data, _ := os.ReadFile(filepath.Join(dir, "pyproject.toml"))
+	if !strings.Contains(string(data), `version = "1.2.0"`) {
+		t.Errorf("expected version 1.2.0 in pyproject.toml, got: %s", data)
+	}
+}
+
+func TestRunPyprojectOverrideFlag(t *testing.T) {
+	dir := t.TempDir()
+	repo, err := gogit.PlainInit(dir, false)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := os.MkdirAll(filepath.Join(dir, "sub"), 0755); err != nil {
+		t.Fatal(err)
+	}
+	content := "[project]\nversion = \"0.0.0\"\n"
+	os.WriteFile(filepath.Join(dir, "sub", "pyproject.toml"), []byte(content), 0644)
+	commitAll(t, repo, dir, "chore: init")
+
+	addFile(t, dir, "x.go", "// fix")
+	w, _ := repo.Worktree()
+	w.Add("x.go")
+	w.Commit("fix: something", &gogit.CommitOptions{Author: testSig()})
+
+	if err := execCmd(t, "--no-push", "--branch", "release/1.2", "--repo", dir, "--pyproject", "sub/pyproject.toml"); err != nil {
+		t.Fatalf("--pyproject flag: unexpected error: %v", err)
+	}
+
+	data, _ := os.ReadFile(filepath.Join(dir, "sub", "pyproject.toml"))
+	if !strings.Contains(string(data), `version = "1.2.0"`) {
+		t.Errorf("expected version 1.2.0, got: %s", data)
+	}
+}
+
+func TestRunPyprojectReadVersionFails(t *testing.T) {
+	dir := t.TempDir()
+	repo, err := gogit.PlainInit(dir, false)
+	if err != nil {
+		t.Fatal(err)
+	}
+	// pyproject.toml with no version field
+	os.WriteFile(filepath.Join(dir, "pyproject.toml"), []byte("[build-system]\nrequires=[]\n"), 0644)
+	commitAll(t, repo, dir, "chore: init")
+
+	os.WriteFile(filepath.Join(dir, ".releaser.yml"), []byte("python:\n  pyproject_toml: \"pyproject.toml\"\n"), 0644)
+
+	addFile(t, dir, "x.go", "// fix")
+	w, _ := repo.Worktree()
+	w.Add("x.go")
+	w.Commit("fix: something", &gogit.CommitOptions{Author: testSig()})
+
+	if err := execCmd(t, "--branch", "release/1.2", "--repo", dir); err == nil {
+		t.Fatal("expected error when pyproject.toml has no version")
+	}
+}
+
+func TestRunPyprojectWriteVersionFails(t *testing.T) {
+	if os.Getuid() == 0 {
+		t.Skip("skipping: chmod restrictions do not apply when running as root")
+	}
+	dir := t.TempDir()
+	repo, err := gogit.PlainInit(dir, false)
+	if err != nil {
+		t.Fatal(err)
+	}
+	writePyprojectFile(t, dir, "0.0.0")
+	commitAll(t, repo, dir, "chore: init")
+
+	os.WriteFile(filepath.Join(dir, ".releaser.yml"), []byte("python:\n  pyproject_toml: \"pyproject.toml\"\n"), 0644)
+
+	addFile(t, dir, "x.go", "// fix")
+	w, _ := repo.Worktree()
+	w.Add("x.go")
+	w.Commit("fix: something", &gogit.CommitOptions{Author: testSig()})
+
+	os.Chmod(filepath.Join(dir, "pyproject.toml"), 0444)
+	defer os.Chmod(filepath.Join(dir, "pyproject.toml"), 0644)
+
+	if err := execCmd(t, "--branch", "release/1.2", "--repo", dir); err == nil {
+		t.Fatal("expected error when pyproject.toml is read-only")
+	}
+}

docs/content/_index.md

@@ -0,0 +1,26 @@
+---
+title: releaser
+---
+
+**CI-friendly release automation for GitFlow workflows using Conventional Commits.**
+
+[Source code](https://git.k3nny.fr/k3nny/releaser) · [Releases](https://git.k3nny.fr/k3nny/releaser/releases)
+
+Standard tools like `semantic-release` are designed for trunk-based development. In a GitFlow setup with versioned release branches (`release/1.1`, `release/1.2`), they either fail to respect the branch's version range or require brittle configuration.
+
+`releaser` is built for this exact workflow: it reads the branch name to pin the `major.minor`, parses Conventional Commits to determine the patch increment, and handles everything from `pom.xml` / `package.json` update to GitLab/GitHub tag and release creation.
+
+## How it works
+
+```
+release/1.2 branch
+  └─ last tag: 1.2.3 (or none → start at 1.2.0)
+       └─ commits since tag → Conventional Commits analysis
+            └─ next version: 1.2.4
+```
+
+1. **Branch parsing** — extracts `major.minor` from branch name (`release/1.2` → `1.2`)
+2. **Tag discovery** — finds the latest tag matching `major.minor.*` on the current branch
+3. **Commit analysis** — parses Conventional Commits between last tag and HEAD
+4. **Version bump** — increments patch (or minor, if configured via `bump_rules`)
+5. **Release** — updates `pom.xml` / `package.json`, commits, tags, creates GitLab or GitHub release

docs/content/changelog.md

@@ -0,0 +1,88 @@
+---
+title: Changelog
+weight: 50
+---
+
+## v1.8.0 — 2026-07-12
+
+### Added
+
+- **Release notifications** — best-effort notification on release to Slack, Microsoft Teams, Google Chat, Telegram, and/or a generic JSON webhook via the new `notify` config section; every target is independently opt-in (config file or env var), and a failed notification never fails the release
+
+## v1.7.0 — 2026-07-12
+
+### Added
+
+- **Python `pyproject.toml` support** — opt-in via `python.pyproject_toml` (single) or `python.pyproject_tomls` (list); reads `[project].version` (PEP 621) first, then `[tool.poetry].version`; original formatting preserved; `--pyproject <path>` CLI flag for one-off overrides
+
+## v1.6.0 — 2026-07-11
+
+### Added
+
+- **Gradle support** — opt-in via `gradle.build_file` (single path) or `gradle.build_files` (list, overrides single); supports both Groovy DSL (`version = '1.2.3'`) and Kotlin DSL (`version = "1.2.3"`); original quote style preserved on write; `--gradle <path>` CLI flag for one-off overrides
+
+## v1.5.1 — 2026-07-11
+
+### Added
+
+- **Documentation site** — Hugo + Geekdoc; installation, CLI reference, configuration, CI integration, and changelog pages; deployed to `gh-pages` via Gitea CI on push to `main`
+- **`FuzzUpdate`** in `internal/changelog` and **`FuzzWriteVersion`** in `internal/node` — complete fuzz coverage for all file-rewriting packages
+
+### Changed
+
+- **CLAUDE.md** — fuzzing completeness guidelines with authoritative table
+
+## v1.5.0 — 2026-07-11
+
+### Added
+
+- **Multi-module Maven support** — `maven.pom_paths: [...]` lists multiple `pom.xml` paths; overrides `pom_path`; each path is updated and committed in the same release commit
+- **Node.js `package.json` support** — opt-in via `node.package_json` (single path) or `node.package_jsons` (list); version bumped in-place alongside `pom.xml` and `CHANGELOG.md`
+- **`git.bump_rules` config** — controls which version component each commit type bumps: `breaking`, `feat`, `fix` each accept `"patch"` (default) or `"minor"`
+- **100% per-package statement coverage** across all 12 packages via injectable function vars
+
+### Changed
+
+- **`--pom` flag** now clears `maven.pom_paths` before setting `maven.pom_path`
+- **`version.Next()` signature** — accepts a bump-rules map as a sixth parameter; `nil` defaults to all-patch
+- **Verbose config table** — now includes `git.bump_rules.*`, `maven.pom_paths`, and `node.paths` rows
+
+## v1.4.0 — 2026-07-11
+
+### Added
+
+- **GitHub release support** — `internal/ghclient` package; configured via `github.token` + `github.repo`; GitHub takes precedence over GitLab when both are configured
+- **SSH agent push** — go-git `gitssh.NewSSHAgentAuth` for `git@` / `ssh://` remotes
+- **`--release-env-file` flag** — override dotenv artifact path; pass `""` to disable
+- **`git.releasable_types` config** — opt-in list of commit types that count as releasable
+- **CHANGELOG deduplication guard** — `changelog.Update()` is idempotent; skips write if section already exists
+
+## v1.3.0 — 2026-07-07
+
+### Added
+
+- **`release.env` dotenv artifact** — written on every real release containing `NEXT_VERSION=<tag>`; never committed; exposes the version to downstream GitLab CI jobs
+
+## v1.2.0 — 2026-07-07
+
+### Added
+
+- **`--verbose` flag** — prints config table, commit list with parsed types, and version decision
+- **Colored, structured CLI output** — `·` / `✓` / `!` prefix symbols; TTY-aware ANSI colors; respects `NO_COLOR` and `TERM=dumb`
+- **Name and version header** on every invocation
+
+### Changed
+
+- **Default `tag_prefix` is now empty** — bare version numbers (`1.2.3`) by default; add `tag_prefix: "v"` to opt in
+
+## v1.1.0 — 2026-07-07
+
+### Added
+
+- **CHANGELOG.md auto-update** — new dated section written on every release, grouped by commit type
+- **`--changelog-file` flag** — override changelog path
+- **`--init` flag** — scaffolds a fully-commented `.releaser.yml`
+
+## v1.0 and earlier
+
+See the [full CHANGELOG](https://git.k3nny.fr/k3nny/releaser/src/branch/main/CHANGELOG.md) in the repository.

docs/content/ci-integration.md

@@ -0,0 +1,109 @@
+---
+title: CI Integration
+weight: 40
+---
+
+## GitLab CI
+
+The simplest setup uses the reusable job template shipped alongside `releaser`:
+
+```yaml
+# .gitlab-ci.yml
+include:
+  - project: releaser/releaser
+    file: .releaser.gitlab-ci.yml
+
+release:
+  extends: .releaser
+  variables:
+    GITLAB_TOKEN: $RELEASE_TOKEN   # project/group variable with api + write_repository scope
+```
+
+Or write it inline:
+
+```yaml
+release:
+  stage: release
+  image: registry.example.com/releaser:latest
+  rules:
+    - if: $CI_COMMIT_BRANCH =~ /^release\/.+$/
+  variables:
+    GITLAB_TOKEN: $RELEASE_TOKEN
+  script:
+    - releaser
+  artifacts:
+    reports:
+      dotenv: release.env          # exposes NEXT_VERSION to downstream jobs
+```
+
+### Consuming `NEXT_VERSION` downstream
+
+The `release.env` dotenv artifact exports `NEXT_VERSION=<tag>` automatically. Downstream jobs can use it:
+
+```yaml
+deploy:
+  stage: deploy
+  needs:
+    - job: release
+      artifacts: true
+  script:
+    - echo "Deploying version $NEXT_VERSION"
+```
+
+Disable the dotenv artifact (e.g. for local runs):
+
+```bash
+releaser --release-env-file ""
+```
+
+Write it to a custom path:
+
+```bash
+releaser --release-env-file deploy/version.env
+```
+
+## GitHub Actions / Gitea Actions
+
+```yaml
+name: release
+on:
+  push:
+    branches:
+      - 'release/**'
+
+jobs:
+  release:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0          # full history needed for tag discovery
+
+      - name: Run releaser
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          curl -sSL https://git.k3nny.fr/k3nny/releaser/releases/latest/download/releaser-linux-amd64 \
+            -o /usr/local/bin/releaser
+          chmod +x /usr/local/bin/releaser
+          releaser
+```
+
+{{< hint warning >}}
+`fetch-depth: 0` is required. A shallow clone (`--depth 1`) hides the previous tag, causing `releaser` to treat every commit as the first release.
+{{< /hint >}}
+
+## Detached HEAD
+
+In CI environments where `git checkout` leaves the repository in detached HEAD state, pass the branch name explicitly:
+
+```yaml
+script:
+  - releaser --branch "$CI_COMMIT_BRANCH"
+```
+
+## SSH push
+
+When pushing over SSH (`git@host:...` or `ssh://...` remotes), `releaser` attempts go-git SSH agent auth automatically — no extra configuration needed as long as the CI runner has an SSH agent socket available.
+
+For HTTPS remotes without a token, `releaser` delegates to the system `git` binary so credential helpers and `netrc` work as expected.

docs/content/configuration.md

@@ -0,0 +1,213 @@
+---
+title: Configuration
+weight: 30
+---
+
+`releaser` reads `.releaser.yml` from the repository root. All fields are optional — missing values fall back to the defaults shown below. Run `releaser --init` to scaffold the file with annotations.
+
+## Full reference
+
+```yaml
+git:
+  tag_prefix: ""                                     # default: no prefix; "v" for v1.2.3 style
+  branch_pattern: "^(?:.*/)?release/(\\d+)\\.(\\d+)$"  # two capture groups: major, minor
+  commit_message: "chore(release): {version} [skip ci]"
+  author_name: ""                                    # defaults to git config user.name
+  author_email: ""                                   # defaults to git config user.email
+
+  # Limit which commit types trigger a release (default: all three).
+  releasable_types:
+    - fix
+    - feat
+    - breaking
+
+  # Control which version component each commit type bumps.
+  # Valid values: "patch" (default) or "minor".
+  bump_rules:
+    breaking: "patch"
+    feat: "patch"
+    fix: "patch"
+
+maven:
+  pom_path: "pom.xml"                                # single pom.xml, relative to repo root
+
+  # Multi-module: list overrides pom_path.
+  # pom_paths:
+  #   - "pom.xml"
+  #   - "module-a/pom.xml"
+  #   - "module-b/pom.xml"
+
+node:                                                # opt-in — omit section to skip
+  # package_json: "package.json"                     # single path
+
+  # Monorepo: list overrides package_json.
+  # package_jsons:
+  #   - "packages/frontend/package.json"
+  #   - "packages/backend/package.json"
+
+gradle:                                              # opt-in — omit section to skip
+  # build_file: "build.gradle"                       # Groovy or Kotlin DSL; single path
+
+  # Multi-module: list overrides build_file.
+  # build_files:
+  #   - "build.gradle"
+  #   - "module-a/build.gradle"
+
+python:                                              # opt-in — omit section to skip
+  # pyproject_toml: "pyproject.toml"                 # PEP 621 [project].version or [tool.poetry].version
+
+  # Monorepo: list overrides pyproject_toml.
+  # pyproject_tomls:
+  #   - "pyproject.toml"
+  #   - "packages/cli/pyproject.toml"
+
+gitlab:
+  url: "https://gitlab.example.com"                  # or env CI_SERVER_URL
+  token: ""                                          # prefer env GITLAB_TOKEN
+  project: ""                                        # prefer env CI_PROJECT_ID or CI_PROJECT_PATH
+
+github:
+  token: ""                                          # prefer env GITHUB_TOKEN
+  repo: ""                                           # "owner/repo" format
+
+notify:                                              # opt-in — every field independent; failures are warnings, not errors
+  # slack_webhook_url: ""                             # or env SLACK_WEBHOOK_URL
+  # teams_webhook_url: ""                             # or env TEAMS_WEBHOOK_URL
+  # google_chat_webhook_url: ""                       # or env GOOGLE_CHAT_WEBHOOK_URL
+  # telegram_bot_token: ""                            # or env TELEGRAM_BOT_TOKEN (both required)
+  # telegram_chat_id: ""                              # or env TELEGRAM_CHAT_ID
+  # webhook_url: ""                                   # generic {"version","notes"} JSON POST; or env RELEASER_WEBHOOK_URL
+```
+
+{{< hint info >}}
+When both `github.*` and `gitlab.*` are configured, GitHub takes precedence.
+{{< /hint >}}
+
+## Environment variables
+
+| Variable | Used for |
+|----------|----------|
+| `GITLAB_TOKEN` | GitLab API auth + HTTPS push auth |
+| `CI_SERVER_URL` | GitLab instance URL |
+| `CI_PROJECT_ID` | GitLab project identifier (numeric) |
+| `CI_PROJECT_PATH` | GitLab project identifier (fallback) |
+| `GITHUB_TOKEN` | GitHub API auth |
+| `SLACK_WEBHOOK_URL` | Slack release notification |
+| `TEAMS_WEBHOOK_URL` | Microsoft Teams release notification |
+| `GOOGLE_CHAT_WEBHOOK_URL` | Google Chat release notification |
+| `TELEGRAM_BOT_TOKEN` / `TELEGRAM_CHAT_ID` | Telegram release notification (both required) |
+| `RELEASER_WEBHOOK_URL` | Generic webhook release notification |
+
+## Config sources
+
+Run `releaser --verbose --dry-run` to see every config key, its resolved value, and where it came from (`default` / `config file` / `env: VARNAME` / `flag: --name`).
+
+## `git.releasable_types`
+
+By default `fix`, `feat`, and `breaking` commits all trigger a release. Use `releasable_types` to restrict this — for example, on a maintenance branch where you want only bug fixes to release:
+
+```yaml
+git:
+  releasable_types:
+    - fix
+```
+
+## `git.bump_rules`
+
+By default every releasable commit bumps the **patch** component. The `bump_rules` map lets you promote specific types to bump **minor** instead. This is useful on a branch that manages its own minor versioning:
+
+```yaml
+git:
+  bump_rules:
+    feat: "minor"      # feat: commits bump minor, not patch
+    breaking: "minor"  # breaking changes bump minor too
+    fix: "patch"       # fix: stays patch (this is the default)
+```
+
+## Multi-module Maven
+
+`pom_paths` accepts a list and overrides `pom_path`. All listed files are updated and committed in the same release commit:
+
+```yaml
+maven:
+  pom_paths:
+    - "pom.xml"
+    - "module-a/pom.xml"
+    - "module-b/pom.xml"
+```
+
+The `--pom` CLI flag sets a single path and clears `pom_paths`.
+
+## Node.js support
+
+The `node` section is opt-in — if omitted, no `package.json` is touched. Use `package_jsons` for monorepos:
+
+```yaml
+node:
+  package_jsons:
+    - "packages/frontend/package.json"
+    - "packages/backend/package.json"
+```
+
+## Python support
+
+The `python` section is opt-in — if omitted, no `pyproject.toml` is touched. `releaser` reads `[project].version` (PEP 621) first; if not found it falls back to `[tool.poetry].version`. The original file formatting is preserved on write.
+
+```yaml
+python:
+  pyproject_toml: "pyproject.toml"
+```
+
+Use `pyproject_tomls` for monorepos:
+
+```yaml
+python:
+  pyproject_tomls:
+    - "pyproject.toml"
+    - "packages/cli/pyproject.toml"
+    - "packages/lib/pyproject.toml"
+```
+
+The `--pyproject <path>` CLI flag sets a single path and clears `pyproject_tomls`.
+
+## Gradle support
+
+The `gradle` section is opt-in — if omitted, no build file is touched. Both Groovy DSL (`version = '1.2.3'`) and Kotlin DSL (`version = "1.2.3"`) are supported; the original quote style is preserved on write.
+
+```yaml
+gradle:
+  build_file: "build.gradle"
+```
+
+Use `build_files` for multi-module projects:
+
+```yaml
+gradle:
+  build_files:
+    - "build.gradle"
+    - "module-a/build.gradle"
+    - "module-b/build.gradle"
+```
+
+The `--gradle <path>` CLI flag sets a single build file path and clears `build_files`.
+
+## Notifications
+
+The `notify` section is opt-in — every target is independent, and any combination may be configured at once. A notification failure is logged as a warning and never fails the release; notifications fire once the tag has been pushed, whether or not a GitLab/GitHub release is also created (`--no-release` still notifies; `--no-push` and `--no-commit` do not, since nothing was published).
+
+```yaml
+notify:
+  slack_webhook_url: "https://hooks.slack.com/services/..."
+  teams_webhook_url: "https://outlook.office.com/webhook/..."
+  google_chat_webhook_url: "https://chat.googleapis.com/v1/spaces/.../messages?key=..."
+  telegram_bot_token: "123456:ABC-..."
+  telegram_chat_id: "-1001234567890"
+  webhook_url: "https://example.com/hooks/releaser"
+```
+
+- **Slack** / **Google Chat** — a single `{"text": "..."}` incoming-webhook payload.
+- **Microsoft Teams** — a legacy O365 connector `MessageCard` payload (the format Teams incoming webhook URLs accept).
+- **Telegram** — `telegram_bot_token` and `telegram_chat_id` are both required; posts to the Bot API `sendMessage` endpoint as plain text (no `parse_mode`, since release notes come from free-form commit messages and aren't guaranteed to be valid Telegram Markdown).
+- **Generic webhook** — POSTs `{"version": "<tag>", "notes": "<release notes>"}` for any downstream consumer (n8n, Zapier, a custom receiver).
+
+Each field also has an environment variable fallback — see [Environment variables](#environment-variables) above.

docs/content/installation.md

@@ -0,0 +1,59 @@
+---
+title: Installation
+weight: 10
+---
+
+## Pre-built binaries
+
+Download the latest release for your platform from the [Releases page](https://git.k3nny.fr/k3nny/releaser/releases).
+
+```bash
+# Linux (amd64)
+curl -sSL https://git.k3nny.fr/k3nny/releaser/releases/download/v1.5.0/releaser-v1.5.0-linux-amd64 \
+  -o /usr/local/bin/releaser
+chmod +x /usr/local/bin/releaser
+```
+
+Available platforms: `linux-amd64`, `linux-arm64`, `darwin-amd64`, `darwin-arm64`, `windows-amd64.exe`.
+
+## Docker
+
+```bash
+docker pull git.k3nny.fr/k3nny/releaser/releaser:latest
+
+# Run in the current repository
+docker run --rm \
+  -v "$PWD:/repo" \
+  -e GITLAB_TOKEN="$GITLAB_TOKEN" \
+  git.k3nny.fr/k3nny/releaser/releaser:latest
+```
+
+## Build from source
+
+Requires Go 1.21+.
+
+```bash
+git clone https://git.k3nny.fr/k3nny/releaser/releaser.git
+cd releaser
+go build -o /usr/local/bin/releaser ./cmd
+```
+
+## Verify
+
+```bash
+releaser --version
+```
+
+## First run
+
+Scaffold a default `.releaser.yml` in your repository root:
+
+```bash
+releaser --init
+```
+
+Then do a dry run to check the version that would be produced:
+
+```bash
+releaser --dry-run
+```

docs/content/usage.md

@@ -0,0 +1,71 @@
+---
+title: CLI Reference
+weight: 20
+---
+
+## Common workflows
+
+```bash
+# Scaffold a default .releaser.yml
+releaser --init
+
+# Preview next version (no side effects)
+releaser --dry-run
+
+# Full release: bump versions, commit, tag, push, create release
+releaser
+
+# Commit and tag locally — skip push and release creation
+releaser --no-push
+
+# Push commit and tag but skip creating the release
+releaser --no-release
+
+# Update files but stop before committing
+releaser --no-commit
+# ... review changes, then commit manually and re-run:
+releaser --tag-only
+
+# Verbose mode: show config sources, commit analysis, version decision
+releaser --verbose --dry-run
+```
+
+## Flags
+
+| Flag | Default | Description |
+|------|---------|-------------|
+| `--dry-run` | false | Print next version and exit without making any changes |
+| `--branch <name>` | auto-detected | Override branch name (useful in detached HEAD / CI) |
+| `--branch-pattern <regex>` | `^(?:.*/)?release/(\d+)\.(\d+)$` | Override branch pattern (two capture groups: major, minor) |
+| `--tag-prefix <prefix>` | `""` | Prefix for version tags (e.g. `v` → `v1.2.3`) |
+| `--pom <path>` | `pom.xml` | Path to pom.xml relative to repo root |
+| `--gradle <path>` | — | Override `gradle.build_file` from config |
+| `--pyproject <path>` | — | Override `python.pyproject_toml` from config |
+| `--changelog-file <path>` | `CHANGELOG.md` | Path to changelog file |
+| `--release-env-file <path>` | `release.env` | Path for dotenv artifact; pass `""` to disable |
+| `--no-commit` | false | Update version files but stop before committing |
+| `--no-push` | false | Commit and tag locally, skip push and release |
+| `--no-release` | false | Push branch and tag but skip release creation |
+| `--tag-only` | false | Skip version file updates — tag HEAD and push |
+| `--init` | false | Scaffold a default `.releaser.yml` and exit |
+| `--verbose` | false | Print config table, commit analysis, and version decision |
+
+## Exit codes
+
+| Code | Meaning |
+|------|---------|
+| `0` | Success |
+| `1` | Error (config, git, API, etc.) |
+| `2` | No releasable commits found — nothing to do |
+
+## Version bump rules
+
+By default all releasable commits bump the **patch** component (minor is pinned to the branch). Override per commit type via `git.bump_rules` in `.releaser.yml`:
+
+| Commit type | Default | Configurable via `bump_rules` |
+|-------------|---------|-------------------------------|
+| `fix:` | patch | `fix: "minor"` to bump minor |
+| `feat:` | patch | `feat: "minor"` to bump minor |
+| `feat!:` / `BREAKING CHANGE` | patch | `breaking: "minor"` to bump minor |
+| `chore:`, `docs:`, etc. | none | — |
+| unparseable message | none | non-strict: silently ignored |

docs/data/menu/main.yaml

@@ -0,0 +1,16 @@
+main:
+  - name: Installation
+    ref: /installation
+    weight: 10
+  - name: CLI Reference
+    ref: /usage
+    weight: 20
+  - name: Configuration
+    ref: /configuration
+    weight: 30
+  - name: CI Integration
+    ref: /ci-integration
+    weight: 40
+  - name: Changelog
+    ref: /changelog
+    weight: 50

docs/hugo.toml

@@ -0,0 +1,26 @@
+baseURL = "https://releaser.k3nny.fr/"
+title = "releaser"
+theme = "geekdoc"
+
+pygmentsUseClasses = true
+pygmentsCodeFences = true
+
+[markup]
+  [markup.goldmark.renderer]
+    unsafe = true
+  [markup.tableOfContents]
+    startLevel = 1
+    endLevel = 9
+
+[params]
+  geekdocLogo = "images/releaser-logo-1024.png"
+  geekdocRepo = "https://git.k3nny.fr/k3nny/releaser"
+  geekdocEditPath = "_edit/main/docs"
+  geekdocSearch = true
+  geekdocMenuBundle = true
+  geekdocBreadcrumb = false
+  geekdocToC = true
+
+  [params.geekdocContentLicense]
+    name = "Apache License 2.0"
+    link = "https://git.k3nny.fr/k3nny/releaser/src/branch/main/LICENSE"

internal/changelog/changelog_test.go

@@ -149,3 +149,22 @@ func TestUpdateIdempotent(t *testing.T) {
 		t.Error("version heading should appear exactly once after idempotent call")
 	}
 }
+
+// FuzzUpdate verifies Update never panics on arbitrary existing file content or commit messages.
+func FuzzUpdate(f *testing.F) {
+	f.Add("", "feat: add thing")
+	f.Add("# Changelog\n\n## [1.0.0] - 2026-01-01\n\n### Added\n- something\n", "fix: something")
+	f.Add("some preamble\n", "feat!: breaking change")
+	f.Add("\n## [2.0.0] - 2026-01-01\n", "feat: another thing")
+	f.Add("", "chore: no release")
+	f.Add("", "")
+
+	f.Fuzz(func(t *testing.T, existing, message string) {
+		dir := t.TempDir()
+		path := filepath.Join(dir, "CHANGELOG.md")
+		if existing != "" {
+			os.WriteFile(path, []byte(existing), 0644) //nolint:errcheck
+		}
+		Update(path, "v1.0.0", "1.0.0", []string{message}) //nolint:errcheck
+	})
+}

internal/config/config.go

@@ -17,8 +17,11 @@ type Config struct {
 	Git    GitConfig    `yaml:"git"`
 	Maven  MavenConfig  `yaml:"maven"`
 	Node   NodeConfig   `yaml:"node"`
+	Gradle  GradleConfig  `yaml:"gradle"`
+	Python  PythonConfig  `yaml:"python"`
 	GitLab  GitLabConfig  `yaml:"gitlab"`
 	GitHub GitHubConfig `yaml:"github"`
+	Notify NotifyConfig `yaml:"notify"`
 }
 
 type GitConfig struct {
@@ -73,6 +76,40 @@ func (n NodeConfig) EffectivePaths() []string {
 	return nil
 }
 
+type GradleConfig struct {
+	BuildFile  string   `yaml:"build_file"`  // single path (opt-in, no default)
+	BuildFiles []string `yaml:"build_files"` // multiple paths; overrides BuildFile
+}
+
+// EffectiveBuildFiles returns the list of Gradle build file paths to process.
+// Returns nil when no gradle paths are configured (gradle processing is opt-in).
+func (g GradleConfig) EffectiveBuildFiles() []string {
+	if len(g.BuildFiles) > 0 {
+		return g.BuildFiles
+	}
+	if g.BuildFile != "" {
+		return []string{g.BuildFile}
+	}
+	return nil
+}
+
+type PythonConfig struct {
+	PyprojectTOML  string   `yaml:"pyproject_toml"`  // single path (opt-in, no default)
+	PyprojectTOMLs []string `yaml:"pyproject_tomls"` // multiple paths; overrides PyprojectTOML
+}
+
+// EffectivePaths returns the list of pyproject.toml paths to process.
+// Returns nil when no python paths are configured (python processing is opt-in).
+func (p PythonConfig) EffectivePaths() []string {
+	if len(p.PyprojectTOMLs) > 0 {
+		return p.PyprojectTOMLs
+	}
+	if p.PyprojectTOML != "" {
+		return []string{p.PyprojectTOML}
+	}
+	return nil
+}
+
 type GitLabConfig struct {
 	URL     string `yaml:"url"`
 	Token   string `yaml:"token"`
@@ -84,6 +121,17 @@ type GitHubConfig struct {
 	Repo  string `yaml:"repo"` // "owner/repo"
 }
 
+// NotifyConfig configures best-effort release notifications. Every field is
+// opt-in — a target is only used when its required fields are non-empty.
+type NotifyConfig struct {
+	SlackWebhookURL      string `yaml:"slack_webhook_url"`
+	TeamsWebhookURL      string `yaml:"teams_webhook_url"`
+	GoogleChatWebhookURL string `yaml:"google_chat_webhook_url"`
+	TelegramBotToken     string `yaml:"telegram_bot_token"`
+	TelegramChatID       string `yaml:"telegram_chat_id"`
+	WebhookURL           string `yaml:"webhook_url"`
+}
+
 func defaults() Config {
 	return Config{
 		Git: GitConfig{
@@ -117,11 +165,21 @@ func defaultSources() Sources {
 		"maven.pom_paths":         "default",
 		"node.package_json":       "default",
 		"node.package_jsons":      "default",
+		"gradle.build_file":        "default",
+		"gradle.build_files":       "default",
+		"python.pyproject_toml":    "default",
+		"python.pyproject_tomls":   "default",
 		"gitlab.url":               "default",
 		"gitlab.token":            "default",
 		"gitlab.project":          "default",
 		"github.token":            "default",
 		"github.repo":             "default",
+		"notify.slack_webhook_url":       "default",
+		"notify.teams_webhook_url":       "default",
+		"notify.google_chat_webhook_url": "default",
+		"notify.telegram_bot_token":      "default",
+		"notify.telegram_chat_id":        "default",
+		"notify.webhook_url":             "default",
 	}
 }
 
@@ -193,6 +251,18 @@ func LoadWithSources(dir string) (Config, Sources, error) {
 	if len(overlay.Node.PackageJSONs) > 0 {
 		src["node.package_jsons"] = "config file"
 	}
+	if overlay.Gradle.BuildFile != "" {
+		src["gradle.build_file"] = "config file"
+	}
+	if len(overlay.Gradle.BuildFiles) > 0 {
+		src["gradle.build_files"] = "config file"
+	}
+	if overlay.Python.PyprojectTOML != "" {
+		src["python.pyproject_toml"] = "config file"
+	}
+	if len(overlay.Python.PyprojectTOMLs) > 0 {
+		src["python.pyproject_tomls"] = "config file"
+	}
 	if overlay.GitLab.URL != "" {
 		src["gitlab.url"] = "config file"
 	}
@@ -208,6 +278,24 @@ func LoadWithSources(dir string) (Config, Sources, error) {
 	if overlay.GitHub.Repo != "" {
 		src["github.repo"] = "config file"
 	}
+	if overlay.Notify.SlackWebhookURL != "" {
+		src["notify.slack_webhook_url"] = "config file"
+	}
+	if overlay.Notify.TeamsWebhookURL != "" {
+		src["notify.teams_webhook_url"] = "config file"
+	}
+	if overlay.Notify.GoogleChatWebhookURL != "" {
+		src["notify.google_chat_webhook_url"] = "config file"
+	}
+	if overlay.Notify.TelegramBotToken != "" {
+		src["notify.telegram_bot_token"] = "config file"
+	}
+	if overlay.Notify.TelegramChatID != "" {
+		src["notify.telegram_chat_id"] = "config file"
+	}
+	if overlay.Notify.WebhookURL != "" {
+		src["notify.webhook_url"] = "config file"
+	}
 
 	return cfg, src, nil
 }
@@ -258,4 +346,52 @@ func (c *Config) ApplyEnvWithSources(src Sources) {
 			}
 		}
 	}
+	if c.Notify.SlackWebhookURL == "" {
+		if v := os.Getenv("SLACK_WEBHOOK_URL"); v != "" {
+			c.Notify.SlackWebhookURL = v
+			if src != nil {
+				src["notify.slack_webhook_url"] = "env: SLACK_WEBHOOK_URL"
+			}
+		}
+	}
+	if c.Notify.TeamsWebhookURL == "" {
+		if v := os.Getenv("TEAMS_WEBHOOK_URL"); v != "" {
+			c.Notify.TeamsWebhookURL = v
+			if src != nil {
+				src["notify.teams_webhook_url"] = "env: TEAMS_WEBHOOK_URL"
+			}
+		}
+	}
+	if c.Notify.GoogleChatWebhookURL == "" {
+		if v := os.Getenv("GOOGLE_CHAT_WEBHOOK_URL"); v != "" {
+			c.Notify.GoogleChatWebhookURL = v
+			if src != nil {
+				src["notify.google_chat_webhook_url"] = "env: GOOGLE_CHAT_WEBHOOK_URL"
+			}
+		}
+	}
+	if c.Notify.TelegramBotToken == "" {
+		if v := os.Getenv("TELEGRAM_BOT_TOKEN"); v != "" {
+			c.Notify.TelegramBotToken = v
+			if src != nil {
+				src["notify.telegram_bot_token"] = "env: TELEGRAM_BOT_TOKEN"
+			}
+		}
+	}
+	if c.Notify.TelegramChatID == "" {
+		if v := os.Getenv("TELEGRAM_CHAT_ID"); v != "" {
+			c.Notify.TelegramChatID = v
+			if src != nil {
+				src["notify.telegram_chat_id"] = "env: TELEGRAM_CHAT_ID"
+			}
+		}
+	}
+	if c.Notify.WebhookURL == "" {
+		if v := os.Getenv("RELEASER_WEBHOOK_URL"); v != "" {
+			c.Notify.WebhookURL = v
+			if src != nil {
+				src["notify.webhook_url"] = "env: RELEASER_WEBHOOK_URL"
+			}
+		}
+	}
 }

internal/config/config_test.go

@@ -292,6 +292,187 @@ func TestApplyEnvWithSourcesCIServerURL(t *testing.T) {
 	}
 }
 
+func TestGradleEffectiveBuildFiles(t *testing.T) {
+	// Neither set → nil (opt-in)
+	if got := (GradleConfig{}).EffectiveBuildFiles(); got != nil {
+		t.Errorf("empty config: got %v, want nil", got)
+	}
+	// BuildFile only
+	if got := (GradleConfig{BuildFile: "build.gradle"}).EffectiveBuildFiles(); len(got) != 1 || got[0] != "build.gradle" {
+		t.Errorf("BuildFile only: got %v", got)
+	}
+	// BuildFiles wins over BuildFile
+	g := GradleConfig{BuildFile: "build.gradle", BuildFiles: []string{"a/build.gradle", "b/build.gradle"}}
+	if got := g.EffectiveBuildFiles(); len(got) != 2 || got[0] != "a/build.gradle" {
+		t.Errorf("BuildFiles priority: got %v", got)
+	}
+}
+
+func TestLoadGradleSources(t *testing.T) {
+	dir := t.TempDir()
+	content := "gradle:\n  build_file: \"build.gradle\"\n"
+	if err := os.WriteFile(filepath.Join(dir, filename), []byte(content), 0644); err != nil {
+		t.Fatal(err)
+	}
+	_, src, err := LoadWithSources(dir)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if src["gradle.build_file"] != "config file" {
+		t.Errorf("src[gradle.build_file] = %q, want %q", src["gradle.build_file"], "config file")
+	}
+}
+
+func TestLoadGradleBuildFilesSources(t *testing.T) {
+	dir := t.TempDir()
+	content := "gradle:\n  build_files:\n    - \"a/build.gradle\"\n    - \"b/build.gradle\"\n"
+	if err := os.WriteFile(filepath.Join(dir, filename), []byte(content), 0644); err != nil {
+		t.Fatal(err)
+	}
+	_, src, err := LoadWithSources(dir)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if src["gradle.build_files"] != "config file" {
+		t.Errorf("src[gradle.build_files] = %q, want %q", src["gradle.build_files"], "config file")
+	}
+}
+
+func TestPythonEffectivePaths(t *testing.T) {
+	if got := (PythonConfig{}).EffectivePaths(); got != nil {
+		t.Errorf("empty config: got %v, want nil", got)
+	}
+	if got := (PythonConfig{PyprojectTOML: "pyproject.toml"}).EffectivePaths(); len(got) != 1 || got[0] != "pyproject.toml" {
+		t.Errorf("single path: got %v", got)
+	}
+	p := PythonConfig{PyprojectTOML: "pyproject.toml", PyprojectTOMLs: []string{"a/pyproject.toml", "b/pyproject.toml"}}
+	if got := p.EffectivePaths(); len(got) != 2 || got[0] != "a/pyproject.toml" {
+		t.Errorf("multi-path priority: got %v", got)
+	}
+}
+
+func TestLoadPythonSources(t *testing.T) {
+	dir := t.TempDir()
+	content := "python:\n  pyproject_toml: \"pyproject.toml\"\n"
+	if err := os.WriteFile(filepath.Join(dir, filename), []byte(content), 0644); err != nil {
+		t.Fatal(err)
+	}
+	_, src, err := LoadWithSources(dir)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if src["python.pyproject_toml"] != "config file" {
+		t.Errorf("src[python.pyproject_toml] = %q, want %q", src["python.pyproject_toml"], "config file")
+	}
+}
+
+func TestLoadPythonPathsSources(t *testing.T) {
+	dir := t.TempDir()
+	content := "python:\n  pyproject_tomls:\n    - \"a/pyproject.toml\"\n    - \"b/pyproject.toml\"\n"
+	if err := os.WriteFile(filepath.Join(dir, filename), []byte(content), 0644); err != nil {
+		t.Fatal(err)
+	}
+	_, src, err := LoadWithSources(dir)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if src["python.pyproject_tomls"] != "config file" {
+		t.Errorf("src[python.pyproject_tomls] = %q, want %q", src["python.pyproject_tomls"], "config file")
+	}
+}
+
+func TestLoadNotifySources(t *testing.T) {
+	dir := t.TempDir()
+	content := `
+notify:
+  slack_webhook_url: "https://hooks.slack.example/x"
+  teams_webhook_url: "https://outlook.office.example/y"
+  google_chat_webhook_url: "https://chat.googleapis.example/z"
+  telegram_bot_token: "bot-token"
+  telegram_chat_id: "chat-1"
+  webhook_url: "https://example.com/webhook"
+`
+	if err := os.WriteFile(filepath.Join(dir, filename), []byte(content), 0644); err != nil {
+		t.Fatal(err)
+	}
+	cfg, src, err := LoadWithSources(dir)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if cfg.Notify.SlackWebhookURL != "https://hooks.slack.example/x" {
+		t.Errorf("SlackWebhookURL = %q", cfg.Notify.SlackWebhookURL)
+	}
+	if cfg.Notify.TeamsWebhookURL != "https://outlook.office.example/y" {
+		t.Errorf("TeamsWebhookURL = %q", cfg.Notify.TeamsWebhookURL)
+	}
+	if cfg.Notify.GoogleChatWebhookURL != "https://chat.googleapis.example/z" {
+		t.Errorf("GoogleChatWebhookURL = %q", cfg.Notify.GoogleChatWebhookURL)
+	}
+	if cfg.Notify.TelegramBotToken != "bot-token" {
+		t.Errorf("TelegramBotToken = %q", cfg.Notify.TelegramBotToken)
+	}
+	if cfg.Notify.TelegramChatID != "chat-1" {
+		t.Errorf("TelegramChatID = %q", cfg.Notify.TelegramChatID)
+	}
+	if cfg.Notify.WebhookURL != "https://example.com/webhook" {
+		t.Errorf("WebhookURL = %q", cfg.Notify.WebhookURL)
+	}
+
+	wantConfigFile := []string{
+		"notify.slack_webhook_url", "notify.teams_webhook_url", "notify.google_chat_webhook_url",
+		"notify.telegram_bot_token", "notify.telegram_chat_id", "notify.webhook_url",
+	}
+	for _, key := range wantConfigFile {
+		if got := src[key]; got != "config file" {
+			t.Errorf("src[%q] = %q, want %q", key, got, "config file")
+		}
+	}
+}
+
+func TestApplyEnvWithSourcesNotify(t *testing.T) {
+	t.Setenv("SLACK_WEBHOOK_URL", "https://hooks.slack.example/env")
+	t.Setenv("TEAMS_WEBHOOK_URL", "https://outlook.office.example/env")
+	t.Setenv("GOOGLE_CHAT_WEBHOOK_URL", "https://chat.googleapis.example/env")
+	t.Setenv("TELEGRAM_BOT_TOKEN", "env-bot-token")
+	t.Setenv("TELEGRAM_CHAT_ID", "env-chat-id")
+	t.Setenv("RELEASER_WEBHOOK_URL", "https://example.com/env-webhook")
+
+	cfg := defaults()
+	src := defaultSources()
+	cfg.ApplyEnvWithSources(src)
+
+	cases := []struct {
+		got, want, srcKey, wantSrc string
+	}{
+		{cfg.Notify.SlackWebhookURL, "https://hooks.slack.example/env", "notify.slack_webhook_url", "env: SLACK_WEBHOOK_URL"},
+		{cfg.Notify.TeamsWebhookURL, "https://outlook.office.example/env", "notify.teams_webhook_url", "env: TEAMS_WEBHOOK_URL"},
+		{cfg.Notify.GoogleChatWebhookURL, "https://chat.googleapis.example/env", "notify.google_chat_webhook_url", "env: GOOGLE_CHAT_WEBHOOK_URL"},
+		{cfg.Notify.TelegramBotToken, "env-bot-token", "notify.telegram_bot_token", "env: TELEGRAM_BOT_TOKEN"},
+		{cfg.Notify.TelegramChatID, "env-chat-id", "notify.telegram_chat_id", "env: TELEGRAM_CHAT_ID"},
+		{cfg.Notify.WebhookURL, "https://example.com/env-webhook", "notify.webhook_url", "env: RELEASER_WEBHOOK_URL"},
+	}
+	for _, c := range cases {
+		if c.got != c.want {
+			t.Errorf("got %q, want %q", c.got, c.want)
+		}
+		if src[c.srcKey] != c.wantSrc {
+			t.Errorf("src[%q] = %q, want %q", c.srcKey, src[c.srcKey], c.wantSrc)
+		}
+	}
+}
+
+func TestApplyEnvNotifyDoesNotOverwrite(t *testing.T) {
+	t.Setenv("SLACK_WEBHOOK_URL", "https://hooks.slack.example/env")
+
+	cfg := defaults()
+	cfg.Notify.SlackWebhookURL = "https://hooks.slack.example/config"
+	cfg.ApplyEnv()
+
+	if cfg.Notify.SlackWebhookURL != "https://hooks.slack.example/config" {
+		t.Errorf("SlackWebhookURL overwritten: got %q", cfg.Notify.SlackWebhookURL)
+	}
+}
+
 func TestLoadPartialOverride(t *testing.T) {
 	dir := t.TempDir()
 	// Only override tag_prefix — commit_message should keep its default

internal/gitutil/gitutil_test.go

@@ -752,19 +752,21 @@ func TestLatestTagTagsIterFails(t *testing.T) {
 	repo, dir := newTestRepo(t)
 	addCommit(t, repo, dir, "fix: c1", "v1")
 
+	if os.Getuid() == 0 {
+		t.Skip("skipping: chmod restrictions do not apply when running as root")
+	}
+
 	// Make .git/refs/tags/ unreadable so that go-git's walkReferencesTree
 	// returns EPERM when it tries to list the directory, triggering the
-	// Tags() error path.  Skip when running as root (chmod has no effect).
+	// Tags() error path.
 	tagsDir := filepath.Join(dir, ".git", "refs", "tags")
-	if err := os.Chmod(tagsDir, 0000); err != nil {
-		t.Skipf("cannot chmod %s: %v", tagsDir, err)
-	}
+	os.Chmod(tagsDir, 0000)
 	t.Cleanup(func() { os.Chmod(tagsDir, 0755) })
 
 	// Reopen so the filesystem storer holds no cached state.
 	repo2, err := gogit.PlainOpen(dir)
 	if err != nil {
-		t.Skipf("PlainOpen failed (likely running as root): %v", err)
+		t.Fatalf("PlainOpen: %v", err)
 	}
 
 	_, _, err = LatestTag(repo2, branch.Info{Major: 1, Minor: 2, TagPrefix: "v"})

internal/gradle/gradle.go

@@ -0,0 +1,54 @@
+package gradle
+
+import (
+	"fmt"
+	"os"
+	"regexp"
+)
+
+// versionRe matches a Gradle/Kotlin DSL version assignment on its own line.
+// Group 1 captures the version string (without quotes).
+// Handles both double-quoted (Kotlin/Groovy) and single-quoted (Groovy) forms,
+// with or without spaces around =.
+var versionRe = regexp.MustCompile(`(?m)^[ \t]*version\s*=\s*["']([^"']+)["']`)
+
+// ReadVersion returns the version value from a build.gradle or build.gradle.kts file.
+func ReadVersion(path string) (string, error) {
+	data, err := os.ReadFile(path)
+	if err != nil {
+		return "", fmt.Errorf("read %s: %w", path, err)
+	}
+	m := versionRe.FindStringSubmatch(string(data))
+	if m == nil {
+		return "", fmt.Errorf("no version assignment found in %s", path)
+	}
+	return m[1], nil
+}
+
+// WriteVersion replaces the version assignment in a build.gradle or build.gradle.kts
+// file in-place. oldVersion must match what ReadVersion returned. Quote style is preserved.
+func WriteVersion(path, oldVersion, newVersion string) error {
+	data, err := os.ReadFile(path)
+	if err != nil {
+		return fmt.Errorf("read %s: %w", path, err)
+	}
+	updated, ok := replaceVersion(string(data), oldVersion, newVersion)
+	if !ok {
+		return fmt.Errorf("version %q not found in %s", oldVersion, path)
+	}
+	return os.WriteFile(path, []byte(updated), 0644)
+}
+
+// replaceVersion finds and replaces the first version assignment line in a Gradle build file.
+// Quote style (single or double) of the original line is preserved.
+// Returns the updated content and true if a replacement was made.
+func replaceVersion(content, oldVersion, newVersion string) (string, bool) {
+	re := regexp.MustCompile(`(?m)^([ \t]*version\s*=\s*)(["'])` + regexp.QuoteMeta(oldVersion) + `["']`)
+	m := re.FindStringSubmatchIndex(content)
+	if m == nil {
+		return content, false
+	}
+	prefix := content[m[2]:m[3]] // "version = " etc., preserving whitespace
+	quote := content[m[4]:m[5]]  // " or '
+	return content[:m[0]] + prefix + quote + newVersion + quote + content[m[1]:], true
+}

internal/gradle/gradle_test.go

@@ -0,0 +1,183 @@
+package gradle
+
+import (
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+)
+
+const gradleGroovy = `plugins {
+    id 'java'
+}
+
+group = 'com.example'
+version = '1.2.3'
+description = 'My project'
+`
+
+const gradleKotlin = `plugins {
+    kotlin("jvm") version "1.9.0"
+}
+
+group = "com.example"
+version = "1.2.3"
+description = "My project"
+`
+
+func writeGradle(t *testing.T, content string) string {
+	t.Helper()
+	path := filepath.Join(t.TempDir(), "build.gradle")
+	if err := os.WriteFile(path, []byte(content), 0644); err != nil {
+		t.Fatal(err)
+	}
+	return path
+}
+
+// ── ReadVersion ──────────────────────────────────────────────────────────────
+
+func TestReadVersionGroovy(t *testing.T) {
+	got, err := ReadVersion(writeGradle(t, gradleGroovy))
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if got != "1.2.3" {
+		t.Errorf("got %q, want 1.2.3", got)
+	}
+}
+
+func TestReadVersionKotlin(t *testing.T) {
+	got, err := ReadVersion(writeGradle(t, gradleKotlin))
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if got != "1.2.3" {
+		t.Errorf("got %q, want 1.2.3", got)
+	}
+}
+
+func TestReadVersionNoSpaces(t *testing.T) {
+	got, err := ReadVersion(writeGradle(t, `version="1.0.0"`))
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if got != "1.0.0" {
+		t.Errorf("got %q, want 1.0.0", got)
+	}
+}
+
+func TestReadVersionMissingFile(t *testing.T) {
+	_, err := ReadVersion(filepath.Join(t.TempDir(), "build.gradle"))
+	if err == nil {
+		t.Error("expected error for missing file")
+	}
+}
+
+func TestReadVersionNoVersionField(t *testing.T) {
+	_, err := ReadVersion(writeGradle(t, `group = "com.example"`))
+	if err == nil {
+		t.Error("expected error when no version assignment is present")
+	}
+}
+
+// ── WriteVersion ─────────────────────────────────────────────────────────────
+
+func TestWriteVersionKotlin(t *testing.T) {
+	path := writeGradle(t, gradleKotlin)
+	if err := WriteVersion(path, "1.2.3", "1.2.4"); err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	data, _ := os.ReadFile(path)
+	if !strings.Contains(string(data), `version = "1.2.4"`) {
+		t.Errorf("expected updated version; got:\n%s", data)
+	}
+	// plugin version declaration must not be touched
+	if !strings.Contains(string(data), `kotlin("jvm") version "1.9.0"`) {
+		t.Error("plugin version was incorrectly modified")
+	}
+}
+
+func TestWriteVersionGroovy(t *testing.T) {
+	path := writeGradle(t, gradleGroovy)
+	if err := WriteVersion(path, "1.2.3", "1.2.4"); err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	data, _ := os.ReadFile(path)
+	if !strings.Contains(string(data), `version = '1.2.4'`) {
+		t.Errorf("expected updated version with single quotes; got:\n%s", data)
+	}
+}
+
+func TestWriteVersionMissingFile(t *testing.T) {
+	err := WriteVersion(filepath.Join(t.TempDir(), "build.gradle"), "1.0.0", "1.0.1")
+	if err == nil {
+		t.Error("expected error for missing file")
+	}
+}
+
+func TestWriteVersionNotFound(t *testing.T) {
+	path := writeGradle(t, gradleKotlin)
+	err := WriteVersion(path, "9.9.9", "9.9.10")
+	if err == nil {
+		t.Error("expected error when old version not found in file")
+	}
+}
+
+func TestWriteVersionReadOnly(t *testing.T) {
+	if os.Getuid() == 0 {
+		t.Skip("skipping: chmod restrictions do not apply when running as root")
+	}
+	path := writeGradle(t, gradleKotlin)
+	os.Chmod(path, 0444)
+	defer os.Chmod(path, 0644)
+	err := WriteVersion(path, "1.2.3", "1.2.4")
+	if err == nil {
+		t.Error("expected error writing to read-only file")
+	}
+}
+
+// ── replaceVersion ────────────────────────────────────────────────────────────
+
+func TestReplaceVersionNotFound(t *testing.T) {
+	content := `group = "com.example"`
+	got, ok := replaceVersion(content, "1.0.0", "1.0.1")
+	if ok {
+		t.Error("expected ok=false when version not present")
+	}
+	if got != content {
+		t.Error("content should be unchanged when not found")
+	}
+}
+
+// ── fuzz ──────────────────────────────────────────────────────────────────────
+
+// FuzzReadVersion verifies ReadVersion never panics on arbitrary file content.
+func FuzzReadVersion(f *testing.F) {
+	f.Add(gradleGroovy)
+	f.Add(gradleKotlin)
+	f.Add(`version="1.0.0"`)
+	f.Add(`group = "com.example"`)
+	f.Add("")
+	f.Add("\x00\xff")
+
+	f.Fuzz(func(t *testing.T, content string) {
+		path := filepath.Join(t.TempDir(), "build.gradle")
+		os.WriteFile(path, []byte(content), 0644) //nolint:errcheck
+		ReadVersion(path)                          //nolint:errcheck
+	})
+}
+
+// FuzzWriteVersion verifies WriteVersion never panics on arbitrary content or version strings.
+func FuzzWriteVersion(f *testing.F) {
+	f.Add(gradleGroovy, "1.2.3", "1.2.4")
+	f.Add(gradleKotlin, "1.2.3", "1.2.4")
+	f.Add(`version="1.0.0"`, "1.0.0", "1.0.1")
+	f.Add("", "1.0.0", "1.0.1")
+	f.Add(`version = "1.0.0"`, "", "1.0.1")
+
+	f.Fuzz(func(t *testing.T, content, oldVersion, newVersion string) {
+		path := filepath.Join(t.TempDir(), "build.gradle")
+		os.WriteFile(path, []byte(content), 0644)  //nolint:errcheck
+		WriteVersion(path, oldVersion, newVersion)  //nolint:errcheck
+	})
+}

internal/node/node_test.go

@@ -82,6 +82,21 @@ func TestWriteVersionNotFound(t *testing.T) {
 	}
 }
 
+// FuzzWriteVersion verifies WriteVersion never panics on arbitrary content or version strings.
+func FuzzWriteVersion(f *testing.F) {
+	f.Add(simplePackage, "1.2.3", "1.2.4")
+	f.Add(`{"version":"0.0.1"}`, "0.0.1", "0.0.2")
+	f.Add(`{}`, "1.0.0", "1.0.1")
+	f.Add("", "1.0.0", "1.0.1")
+	f.Add(`{"name":"app","version":"1.0.0","version":"dup"}`, "1.0.0", "1.0.1")
+
+	f.Fuzz(func(t *testing.T, content, oldVersion, newVersion string) {
+		path := filepath.Join(t.TempDir(), "package.json")
+		os.WriteFile(path, []byte(content), 0644) //nolint:errcheck
+		WriteVersion(path, oldVersion, newVersion) //nolint:errcheck
+	})
+}
+
 // FuzzReadVersion verifies ReadVersion never panics on arbitrary content.
 func FuzzReadVersion(f *testing.F) {
 	f.Add(simplePackage)

internal/notify/googlechat.go

@@ -0,0 +1,20 @@
+package notify
+
+import (
+	"context"
+	"fmt"
+)
+
+// googleChatPayload matches the Google Chat Incoming Webhook contract: a
+// single "text" field.
+type googleChatPayload struct {
+	Text string `json:"text"`
+}
+
+func newGoogleChatPayload(msg Message) googleChatPayload {
+	return googleChatPayload{Text: fmt.Sprintf("*Released %s*\n\n%s", msg.Version, msg.Notes)}
+}
+
+func sendGoogleChat(ctx context.Context, webhookURL string, msg Message) error {
+	return postJSON(ctx, webhookURL, newGoogleChatPayload(msg))
+}

internal/notify/googlechat_test.go

@@ -0,0 +1,37 @@
+package notify
+
+import (
+	"context"
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+)
+
+func TestSendGoogleChat(t *testing.T) {
+	var got googleChatPayload
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		json.NewDecoder(r.Body).Decode(&got) //nolint:errcheck
+		w.WriteHeader(http.StatusOK)
+	}))
+	defer srv.Close()
+
+	if err := sendGoogleChat(context.Background(), srv.URL, Message{Version: "v1.2.3", Notes: "- feat: y"}); err != nil {
+		t.Fatalf("sendGoogleChat: %v", err)
+	}
+	if !strings.Contains(got.Text, "v1.2.3") || !strings.Contains(got.Text, "feat: y") {
+		t.Errorf("payload text = %q", got.Text)
+	}
+}
+
+func TestSendGoogleChatError(t *testing.T) {
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.WriteHeader(http.StatusBadRequest)
+	}))
+	defer srv.Close()
+
+	if err := sendGoogleChat(context.Background(), srv.URL, Message{Version: "v1.0.0"}); err == nil {
+		t.Fatal("expected error for 400 response")
+	}
+}

internal/notify/notify.go

@@ -0,0 +1,88 @@
+// Package notify sends best-effort release notifications to chat and webhook targets.
+package notify
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"time"
+)
+
+// Message is the content of a release notification, shared across all targets.
+type Message struct {
+	Version string // tag name, e.g. "v1.2.3"
+	Notes   string // release notes body
+}
+
+// Config holds the destination for every supported notification target.
+// Every field is opt-in — a target is skipped when its required fields are empty.
+type Config struct {
+	SlackWebhookURL      string
+	TeamsWebhookURL      string
+	GoogleChatWebhookURL string
+	TelegramBotToken     string
+	TelegramChatID       string
+	WebhookURL           string
+}
+
+var httpClient = &http.Client{Timeout: 15 * time.Second}
+
+// SendAll sends msg to every target configured in cfg. Each target is attempted
+// independently — a failure on one does not prevent the others from being tried.
+// Returns one error per failed target, or nil if every configured target
+// succeeded (or none were configured).
+func SendAll(ctx context.Context, cfg Config, msg Message) []error {
+	var errs []error
+
+	if cfg.SlackWebhookURL != "" {
+		if err := sendSlack(ctx, cfg.SlackWebhookURL, msg); err != nil {
+			errs = append(errs, fmt.Errorf("slack: %w", err))
+		}
+	}
+	if cfg.TeamsWebhookURL != "" {
+		if err := sendTeams(ctx, cfg.TeamsWebhookURL, msg); err != nil {
+			errs = append(errs, fmt.Errorf("teams: %w", err))
+		}
+	}
+	if cfg.GoogleChatWebhookURL != "" {
+		if err := sendGoogleChat(ctx, cfg.GoogleChatWebhookURL, msg); err != nil {
+			errs = append(errs, fmt.Errorf("google chat: %w", err))
+		}
+	}
+	if cfg.TelegramBotToken != "" && cfg.TelegramChatID != "" {
+		if err := sendTelegram(ctx, cfg.TelegramBotToken, cfg.TelegramChatID, msg); err != nil {
+			errs = append(errs, fmt.Errorf("telegram: %w", err))
+		}
+	}
+	if cfg.WebhookURL != "" {
+		if err := sendWebhook(ctx, cfg.WebhookURL, msg); err != nil {
+			errs = append(errs, fmt.Errorf("webhook: %w", err))
+		}
+	}
+
+	return errs
+}
+
+// postJSON POSTs payload as JSON to url and treats any non-2xx response as an error.
+func postJSON(ctx context.Context, url string, payload any) error {
+	body, _ := json.Marshal(payload) // payload fields are always plain strings — Marshal cannot fail here
+
+	req, err := http.NewRequestWithContext(ctx, http.MethodPost, url, bytes.NewReader(body))
+	if err != nil {
+		return err
+	}
+	req.Header.Set("Content-Type", "application/json")
+
+	resp, err := httpClient.Do(req)
+	if err != nil {
+		return fmt.Errorf("request failed: %w", err)
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode < 200 || resp.StatusCode >= 300 {
+		return fmt.Errorf("returned status %d", resp.StatusCode)
+	}
+	return nil
+}

internal/notify/notify_fuzz_test.go

@@ -0,0 +1,28 @@
+package notify
+
+import (
+	"encoding/json"
+	"strings"
+	"testing"
+)
+
+// FuzzMessagePayloads verifies that building a notification payload never
+// panics on arbitrary version/notes strings, no matter the target — release
+// notes are generated from free-form commit messages and end up embedded in
+// every payload below.
+func FuzzMessagePayloads(f *testing.F) {
+	f.Add("v1.2.3", "release notes")
+	f.Add("", "")
+	f.Add("v1.0.0", "* markdown _weird_ [chars] `code` <html> & \"quotes\"")
+	f.Add("tag\nwith\nnewline", "notes\x00with\xffbinary")
+	f.Add("v1.0.0", strings.Repeat("x", 10000))
+
+	f.Fuzz(func(t *testing.T, version, notes string) {
+		msg := Message{Version: version, Notes: notes}
+		_, _ = json.Marshal(newSlackPayload(msg))
+		_, _ = json.Marshal(newGoogleChatPayload(msg))
+		_, _ = json.Marshal(newTeamsPayload(msg))
+		_, _ = json.Marshal(newTelegramPayload("chat-id", msg))
+		_, _ = json.Marshal(newWebhookPayload(msg))
+	})
+}

internal/notify/notify_test.go

@@ -0,0 +1,137 @@
+package notify
+
+import (
+	"context"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+)
+
+// alwaysFailTransport returns an error for every request.
+type alwaysFailTransport struct{}
+
+func (alwaysFailTransport) RoundTrip(*http.Request) (*http.Response, error) {
+	return nil, &testTransportError{"connection refused"}
+}
+
+type testTransportError struct{ msg string }
+
+func (e *testTransportError) Error() string { return e.msg }
+
+func TestPostJSONSuccess(t *testing.T) {
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.WriteHeader(http.StatusOK)
+	}))
+	defer srv.Close()
+
+	if err := postJSON(context.Background(), srv.URL, map[string]string{"a": "b"}); err != nil {
+		t.Fatalf("postJSON: %v", err)
+	}
+}
+
+func TestPostJSONBadURL(t *testing.T) {
+	err := postJSON(context.Background(), "http://\x00bad", map[string]string{"a": "b"})
+	if err == nil {
+		t.Fatal("expected error for invalid URL")
+	}
+}
+
+func TestPostJSONRequestFails(t *testing.T) {
+	orig := httpClient
+	httpClient = &http.Client{Transport: alwaysFailTransport{}}
+	defer func() { httpClient = orig }()
+
+	err := postJSON(context.Background(), "http://127.0.0.1:1", map[string]string{"a": "b"})
+	if err == nil {
+		t.Fatal("expected error when HTTP request fails")
+	}
+}
+
+func TestPostJSONNon2xx(t *testing.T) {
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.WriteHeader(http.StatusInternalServerError)
+	}))
+	defer srv.Close()
+
+	err := postJSON(context.Background(), srv.URL, map[string]string{"a": "b"})
+	if err == nil {
+		t.Fatal("expected error for 500 response")
+	}
+}
+
+func TestSendAllNoneConfigured(t *testing.T) {
+	errs := SendAll(context.Background(), Config{}, Message{Version: "v1.0.0"})
+	if errs != nil {
+		t.Fatalf("expected no errors, got %v", errs)
+	}
+}
+
+func TestSendAllAllSucceed(t *testing.T) {
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.WriteHeader(http.StatusOK)
+	}))
+	defer srv.Close()
+
+	origBase := telegramAPIBase
+	telegramAPIBase = srv.URL
+	defer func() { telegramAPIBase = origBase }()
+
+	cfg := Config{
+		SlackWebhookURL:      srv.URL,
+		TeamsWebhookURL:      srv.URL,
+		GoogleChatWebhookURL: srv.URL,
+		TelegramBotToken:     "tok",
+		TelegramChatID:       "123",
+		WebhookURL:           srv.URL,
+	}
+	errs := SendAll(context.Background(), cfg, Message{Version: "v1.0.0", Notes: "notes"})
+	if errs != nil {
+		t.Fatalf("expected no errors, got %v", errs)
+	}
+}
+
+func TestSendAllAllFail(t *testing.T) {
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.WriteHeader(http.StatusInternalServerError)
+	}))
+	defer srv.Close()
+
+	origBase := telegramAPIBase
+	telegramAPIBase = srv.URL
+	defer func() { telegramAPIBase = origBase }()
+
+	cfg := Config{
+		SlackWebhookURL:      srv.URL,
+		TeamsWebhookURL:      srv.URL,
+		GoogleChatWebhookURL: srv.URL,
+		TelegramBotToken:     "tok",
+		TelegramChatID:       "123",
+		WebhookURL:           srv.URL,
+	}
+	errs := SendAll(context.Background(), cfg, Message{Version: "v1.0.0"})
+	if len(errs) != 5 {
+		t.Fatalf("expected 5 errors, got %d: %v", len(errs), errs)
+	}
+}
+
+func TestSendAllTelegramRequiresBothFields(t *testing.T) {
+	calls := 0
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		calls++
+		w.WriteHeader(http.StatusOK)
+	}))
+	defer srv.Close()
+
+	origBase := telegramAPIBase
+	telegramAPIBase = srv.URL
+	defer func() { telegramAPIBase = origBase }()
+
+	// Only bot token set — chat ID missing — Telegram target must be skipped.
+	errs := SendAll(context.Background(), Config{TelegramBotToken: "tok"}, Message{Version: "v1.0.0"})
+	if errs != nil {
+		t.Fatalf("expected no errors, got %v", errs)
+	}
+	if calls != 0 {
+		t.Fatalf("expected telegram to be skipped, got %d calls", calls)
+	}
+}

internal/notify/slack.go

@@ -0,0 +1,20 @@
+package notify
+
+import (
+	"context"
+	"fmt"
+)
+
+// slackPayload matches the Slack Incoming Webhook contract: a single "text"
+// field, interpreted as Slack mrkdwn.
+type slackPayload struct {
+	Text string `json:"text"`
+}
+
+func newSlackPayload(msg Message) slackPayload {
+	return slackPayload{Text: fmt.Sprintf("*Released %s*\n\n%s", msg.Version, msg.Notes)}
+}
+
+func sendSlack(ctx context.Context, webhookURL string, msg Message) error {
+	return postJSON(ctx, webhookURL, newSlackPayload(msg))
+}

internal/notify/slack_test.go

@@ -0,0 +1,40 @@
+package notify
+
+import (
+	"context"
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+)
+
+func TestSendSlack(t *testing.T) {
+	var got slackPayload
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if ct := r.Header.Get("Content-Type"); ct != "application/json" {
+			t.Errorf("Content-Type = %q", ct)
+		}
+		json.NewDecoder(r.Body).Decode(&got) //nolint:errcheck
+		w.WriteHeader(http.StatusOK)
+	}))
+	defer srv.Close()
+
+	if err := sendSlack(context.Background(), srv.URL, Message{Version: "v1.2.3", Notes: "- fix: x"}); err != nil {
+		t.Fatalf("sendSlack: %v", err)
+	}
+	if !strings.Contains(got.Text, "v1.2.3") || !strings.Contains(got.Text, "fix: x") {
+		t.Errorf("payload text = %q", got.Text)
+	}
+}
+
+func TestSendSlackError(t *testing.T) {
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.WriteHeader(http.StatusForbidden)
+	}))
+	defer srv.Close()
+
+	if err := sendSlack(context.Background(), srv.URL, Message{Version: "v1.0.0"}); err == nil {
+		t.Fatal("expected error for 403 response")
+	}
+}

internal/notify/teams.go

@@ -0,0 +1,31 @@
+package notify
+
+import (
+	"context"
+	"fmt"
+)
+
+// teamsPayload is a Microsoft Teams "Incoming Webhook" O365 connector card
+// (MessageCard schema) — the format Teams webhook URLs still accept.
+type teamsPayload struct {
+	Type    string `json:"@type"`
+	Context string `json:"@context"`
+	Summary string `json:"summary"`
+	Title   string `json:"title"`
+	Text    string `json:"text"`
+}
+
+func newTeamsPayload(msg Message) teamsPayload {
+	title := fmt.Sprintf("Released %s", msg.Version)
+	return teamsPayload{
+		Type:    "MessageCard",
+		Context: "http://schema.org/extensions",
+		Summary: title,
+		Title:   title,
+		Text:    msg.Notes,
+	}
+}
+
+func sendTeams(ctx context.Context, webhookURL string, msg Message) error {
+	return postJSON(ctx, webhookURL, newTeamsPayload(msg))
+}

internal/notify/teams_test.go

@@ -0,0 +1,43 @@
+package notify
+
+import (
+	"context"
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+)
+
+func TestSendTeams(t *testing.T) {
+	var got teamsPayload
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		json.NewDecoder(r.Body).Decode(&got) //nolint:errcheck
+		w.WriteHeader(http.StatusOK)
+	}))
+	defer srv.Close()
+
+	if err := sendTeams(context.Background(), srv.URL, Message{Version: "v1.2.3", Notes: "- fix: z"}); err != nil {
+		t.Fatalf("sendTeams: %v", err)
+	}
+	if got.Type != "MessageCard" {
+		t.Errorf("Type = %q, want MessageCard", got.Type)
+	}
+	if !strings.Contains(got.Title, "v1.2.3") || !strings.Contains(got.Summary, "v1.2.3") {
+		t.Errorf("Title/Summary = %q/%q, want to contain v1.2.3", got.Title, got.Summary)
+	}
+	if !strings.Contains(got.Text, "fix: z") {
+		t.Errorf("Text = %q", got.Text)
+	}
+}
+
+func TestSendTeamsError(t *testing.T) {
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.WriteHeader(http.StatusServiceUnavailable)
+	}))
+	defer srv.Close()
+
+	if err := sendTeams(context.Background(), srv.URL, Message{Version: "v1.0.0"}); err == nil {
+		t.Fatal("expected error for 503 response")
+	}
+}

internal/notify/telegram.go

@@ -0,0 +1,30 @@
+package notify
+
+import (
+	"context"
+	"fmt"
+)
+
+// telegramAPIBase is the Telegram Bot API host. Overridden in tests.
+var telegramAPIBase = "https://api.telegram.org"
+
+// telegramPayload matches the Telegram Bot API sendMessage contract. Notes
+// are sent as plain text (no parse_mode) — release notes come from arbitrary
+// commit messages and are not guaranteed to be valid Telegram Markdown/HTML,
+// and a malformed entity makes the whole request fail with a 400.
+type telegramPayload struct {
+	ChatID string `json:"chat_id"`
+	Text   string `json:"text"`
+}
+
+func newTelegramPayload(chatID string, msg Message) telegramPayload {
+	return telegramPayload{
+		ChatID: chatID,
+		Text:   fmt.Sprintf("Released %s\n\n%s", msg.Version, msg.Notes),
+	}
+}
+
+func sendTelegram(ctx context.Context, botToken, chatID string, msg Message) error {
+	url := fmt.Sprintf("%s/bot%s/sendMessage", telegramAPIBase, botToken)
+	return postJSON(ctx, url, newTelegramPayload(chatID, msg))
+}

internal/notify/telegram_test.go

@@ -0,0 +1,53 @@
+package notify
+
+import (
+	"context"
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+)
+
+func TestSendTelegram(t *testing.T) {
+	var got telegramPayload
+	var path string
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		path = r.URL.Path
+		json.NewDecoder(r.Body).Decode(&got) //nolint:errcheck
+		w.WriteHeader(http.StatusOK)
+	}))
+	defer srv.Close()
+
+	orig := telegramAPIBase
+	telegramAPIBase = srv.URL
+	defer func() { telegramAPIBase = orig }()
+
+	if err := sendTelegram(context.Background(), "bot-token", "chat-1", Message{Version: "v1.2.3", Notes: "notes body"}); err != nil {
+		t.Fatalf("sendTelegram: %v", err)
+	}
+	if !strings.Contains(path, "bot-token") {
+		t.Errorf("path = %q, want to contain bot token", path)
+	}
+	if got.ChatID != "chat-1" {
+		t.Errorf("ChatID = %q, want chat-1", got.ChatID)
+	}
+	if !strings.Contains(got.Text, "v1.2.3") || !strings.Contains(got.Text, "notes body") {
+		t.Errorf("Text = %q", got.Text)
+	}
+}
+
+func TestSendTelegramError(t *testing.T) {
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.WriteHeader(http.StatusBadRequest)
+	}))
+	defer srv.Close()
+
+	orig := telegramAPIBase
+	telegramAPIBase = srv.URL
+	defer func() { telegramAPIBase = orig }()
+
+	if err := sendTelegram(context.Background(), "bot-token", "chat-1", Message{Version: "v1.0.0"}); err == nil {
+		t.Fatal("expected error for 400 response")
+	}
+}

internal/notify/webhook.go

@@ -0,0 +1,18 @@
+package notify
+
+import "context"
+
+// webhookPayload is a generic JSON envelope for arbitrary API webhooks
+// (e.g. n8n, Zapier, a custom receiver) that don't follow a chat-app schema.
+type webhookPayload struct {
+	Version string `json:"version"`
+	Notes   string `json:"notes"`
+}
+
+func newWebhookPayload(msg Message) webhookPayload {
+	return webhookPayload(msg)
+}
+
+func sendWebhook(ctx context.Context, url string, msg Message) error {
+	return postJSON(ctx, url, newWebhookPayload(msg))
+}

internal/notify/webhook_test.go

@@ -0,0 +1,39 @@
+package notify
+
+import (
+	"context"
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+)
+
+func TestSendWebhook(t *testing.T) {
+	var got webhookPayload
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		json.NewDecoder(r.Body).Decode(&got) //nolint:errcheck
+		w.WriteHeader(http.StatusOK)
+	}))
+	defer srv.Close()
+
+	if err := sendWebhook(context.Background(), srv.URL, Message{Version: "v1.2.3", Notes: "notes body"}); err != nil {
+		t.Fatalf("sendWebhook: %v", err)
+	}
+	if got.Version != "v1.2.3" {
+		t.Errorf("Version = %q, want v1.2.3", got.Version)
+	}
+	if got.Notes != "notes body" {
+		t.Errorf("Notes = %q, want %q", got.Notes, "notes body")
+	}
+}
+
+func TestSendWebhookError(t *testing.T) {
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.WriteHeader(http.StatusInternalServerError)
+	}))
+	defer srv.Close()
+
+	if err := sendWebhook(context.Background(), srv.URL, Message{Version: "v1.0.0"}); err == nil {
+		t.Fatal("expected error for 500 response")
+	}
+}

internal/pyproject/pyproject.go

@@ -0,0 +1,74 @@
+package pyproject
+
+import (
+	"fmt"
+	"os"
+	"regexp"
+)
+
+// sectionRe matches a TOML section from its header to the next header (or end of file).
+// TOML section headers always appear at the start of a line, so \n[ is a reliable boundary.
+var (
+	projectSectionRe = regexp.MustCompile(`(?s)\[project\].*?(?:\n\[|\z)`)
+	poetrySectionRe  = regexp.MustCompile(`(?s)\[tool\.poetry\].*?(?:\n\[|\z)`)
+)
+
+// versionLineRe matches version = "x.y.z" on its own line inside a section.
+var versionLineRe = regexp.MustCompile(`(?m)^version\s*=\s*"([^"]+)"`)
+
+// ReadVersion returns the project version from a pyproject.toml file.
+// It checks [project] (PEP 621) first, then [tool.poetry] (Poetry).
+func ReadVersion(path string) (string, error) {
+	data, err := os.ReadFile(path)
+	if err != nil {
+		return "", fmt.Errorf("read %s: %w", path, err)
+	}
+	content := string(data)
+	for _, sectionRe := range []*regexp.Regexp{projectSectionRe, poetrySectionRe} {
+		section := sectionRe.FindString(content)
+		if section == "" {
+			continue
+		}
+		m := versionLineRe.FindStringSubmatch(section)
+		if m != nil {
+			return m[1], nil
+		}
+	}
+	return "", fmt.Errorf("no version found in %s", path)
+}
+
+// WriteVersion replaces the project version in a pyproject.toml file in-place.
+// oldVersion must match what ReadVersion returned.
+func WriteVersion(path, oldVersion, newVersion string) error {
+	data, err := os.ReadFile(path)
+	if err != nil {
+		return fmt.Errorf("read %s: %w", path, err)
+	}
+	updated, ok := replaceVersion(string(data), oldVersion, newVersion)
+	if !ok {
+		return fmt.Errorf("version %q not found in %s", oldVersion, path)
+	}
+	return os.WriteFile(path, []byte(updated), 0644)
+}
+
+// replaceVersion finds and replaces the version in the first [project] or [tool.poetry]
+// section that contains it. Returns the updated content and true on success.
+// regexp.QuoteMeta is used so version strings with dots or specials are safe.
+func replaceVersion(content, oldVersion, newVersion string) (string, bool) {
+	re := regexp.MustCompile(`(?m)^(version\s*=\s*)"` + regexp.QuoteMeta(oldVersion) + `"`)
+	for _, sectionRe := range []*regexp.Regexp{projectSectionRe, poetrySectionRe} {
+		loc := sectionRe.FindStringIndex(content)
+		if loc == nil {
+			continue
+		}
+		section := content[loc[0]:loc[1]]
+		m := re.FindStringSubmatchIndex(section)
+		if m == nil {
+			continue
+		}
+		// m[0]:m[1] = full match; m[2]:m[3] = group 1 (prefix "version = ")
+		newSection := section[:m[0]] + section[m[2]:m[3]] + `"` + newVersion + `"` + section[m[1]:]
+		return content[:loc[0]] + newSection + content[loc[1]:], true
+	}
+	return content, false
+}

internal/pyproject/pyproject_test.go

@@ -0,0 +1,232 @@
+package pyproject
+
+import (
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+)
+
+const pyprojectPEP621 = `[project]
+name = "my-package"
+version = "1.2.3"
+description = "A test package"
+dependencies = ["requests>=2.0", "click>=8.0"]
+
+[build-system]
+requires = ["hatchling"]
+build-backend = "hatchling.build"
+`
+
+const pyprojectPoetry = `[tool.poetry]
+name = "my-package"
+version = "1.2.3"
+description = "A test package"
+
+[tool.poetry.dependencies]
+python = "^3.9"
+requests = "^2.0"
+`
+
+const pyprojectBoth = `[project]
+name = "my-package"
+version = "1.2.3"
+
+[tool.poetry]
+name = "my-package"
+version = "1.2.3"
+`
+
+const pyprojectBuildSystemFirst = `[build-system]
+requires = ["hatchling"]
+
+[project]
+name = "my-package"
+version = "1.2.3"
+`
+
+func writePyproject(t *testing.T, content string) string {
+	t.Helper()
+	path := filepath.Join(t.TempDir(), "pyproject.toml")
+	if err := os.WriteFile(path, []byte(content), 0644); err != nil {
+		t.Fatal(err)
+	}
+	return path
+}
+
+// ── ReadVersion ───────────────────────────────────────────────────────────────
+
+func TestReadVersionPEP621(t *testing.T) {
+	got, err := ReadVersion(writePyproject(t, pyprojectPEP621))
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if got != "1.2.3" {
+		t.Errorf("got %q, want 1.2.3", got)
+	}
+}
+
+func TestReadVersionPoetry(t *testing.T) {
+	got, err := ReadVersion(writePyproject(t, pyprojectPoetry))
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if got != "1.2.3" {
+		t.Errorf("got %q, want 1.2.3", got)
+	}
+}
+
+func TestReadVersionPEP621TakesPrecedence(t *testing.T) {
+	// When both [project] and [tool.poetry] are present, [project] wins.
+	got, err := ReadVersion(writePyproject(t, pyprojectBoth))
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if got != "1.2.3" {
+		t.Errorf("got %q, want 1.2.3", got)
+	}
+}
+
+func TestReadVersionBuildSystemIgnored(t *testing.T) {
+	// version under [build-system] must not be returned.
+	got, err := ReadVersion(writePyproject(t, pyprojectBuildSystemFirst))
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if got != "1.2.3" {
+		t.Errorf("got %q, want 1.2.3", got)
+	}
+}
+
+func TestReadVersionMissingFile(t *testing.T) {
+	_, err := ReadVersion(filepath.Join(t.TempDir(), "pyproject.toml"))
+	if err == nil {
+		t.Error("expected error for missing file")
+	}
+}
+
+func TestReadVersionNoVersion(t *testing.T) {
+	_, err := ReadVersion(writePyproject(t, `[build-system]
+requires = ["hatchling"]
+`))
+	if err == nil {
+		t.Error("expected error when no version is found")
+	}
+}
+
+// ── WriteVersion ──────────────────────────────────────────────────────────────
+
+func TestWriteVersionPEP621(t *testing.T) {
+	path := writePyproject(t, pyprojectPEP621)
+	if err := WriteVersion(path, "1.2.3", "1.2.4"); err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	data, _ := os.ReadFile(path)
+	s := string(data)
+	if !strings.Contains(s, `version = "1.2.4"`) {
+		t.Errorf("expected updated version; got:\n%s", s)
+	}
+	// build-system section must not be touched
+	if strings.Contains(s, `"hatchling>=1.2.4"`) {
+		t.Error("build-system section was incorrectly modified")
+	}
+}
+
+func TestWriteVersionPoetry(t *testing.T) {
+	path := writePyproject(t, pyprojectPoetry)
+	if err := WriteVersion(path, "1.2.3", "1.2.4"); err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	data, _ := os.ReadFile(path)
+	if !strings.Contains(string(data), `version = "1.2.4"`) {
+		t.Errorf("expected updated version; got:\n%s", data)
+	}
+}
+
+func TestWriteVersionBothSectionsUpdatesProject(t *testing.T) {
+	path := writePyproject(t, pyprojectBoth)
+	if err := WriteVersion(path, "1.2.3", "1.2.4"); err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	data, _ := os.ReadFile(path)
+	s := string(data)
+	// [project] version updated
+	if !strings.Contains(s, `[project]`) || strings.Index(s, `version = "1.2.4"`) > strings.Index(s, `[tool.poetry]`) {
+		t.Error("expected [project] version to be updated first")
+	}
+}
+
+func TestWriteVersionMissingFile(t *testing.T) {
+	err := WriteVersion(filepath.Join(t.TempDir(), "pyproject.toml"), "1.0.0", "1.0.1")
+	if err == nil {
+		t.Error("expected error for missing file")
+	}
+}
+
+func TestWriteVersionNotFound(t *testing.T) {
+	path := writePyproject(t, pyprojectPEP621)
+	err := WriteVersion(path, "9.9.9", "9.9.10")
+	if err == nil {
+		t.Error("expected error when old version not found")
+	}
+}
+
+func TestWriteVersionReadOnly(t *testing.T) {
+	if os.Getuid() == 0 {
+		t.Skip("skipping: chmod restrictions do not apply when running as root")
+	}
+	path := writePyproject(t, pyprojectPEP621)
+	os.Chmod(path, 0444)
+	defer os.Chmod(path, 0644)
+	if err := WriteVersion(path, "1.2.3", "1.2.4"); err == nil {
+		t.Error("expected error writing to read-only file")
+	}
+}
+
+// ── replaceVersion ────────────────────────────────────────────────────────────
+
+func TestReplaceVersionNotFound(t *testing.T) {
+	content := `[build-system]
+requires = ["hatchling"]
+`
+	got, ok := replaceVersion(content, "1.0.0", "1.0.1")
+	if ok {
+		t.Error("expected ok=false when no matching section")
+	}
+	if got != content {
+		t.Error("content should be unchanged when not found")
+	}
+}
+
+// ── fuzz ─────────────────────────────────────────────────────────────────────
+
+// FuzzReadVersion verifies ReadVersion never panics on arbitrary file content.
+func FuzzReadVersion(f *testing.F) {
+	f.Add(pyprojectPEP621)
+	f.Add(pyprojectPoetry)
+	f.Add(pyprojectBoth)
+	f.Add(`[project]` + "\n")
+	f.Add("")
+	f.Add("\x00\xff")
+
+	f.Fuzz(func(t *testing.T, content string) {
+		path := filepath.Join(t.TempDir(), "pyproject.toml")
+		os.WriteFile(path, []byte(content), 0644) //nolint:errcheck
+		ReadVersion(path)                          //nolint:errcheck
+	})
+}
+
+// FuzzWriteVersion verifies WriteVersion never panics on arbitrary content or version strings.
+func FuzzWriteVersion(f *testing.F) {
+	f.Add(pyprojectPEP621, "1.2.3", "1.2.4")
+	f.Add(pyprojectPoetry, "1.2.3", "1.2.4")
+	f.Add(pyprojectBoth, "1.2.3", "1.2.4")
+	f.Add("", "1.0.0", "1.0.1")
+	f.Add(`[project]`+"\n"+"version = \"1.0.0\"\n", "1.0.0", "1.0.1")
+
+	f.Fuzz(func(t *testing.T, content, oldVersion, newVersion string) {
+		path := filepath.Join(t.TempDir(), "pyproject.toml")
+		os.WriteFile(path, []byte(content), 0644)  //nolint:errcheck
+		WriteVersion(path, oldVersion, newVersion)  //nolint:errcheck
+	})
+}