chore(cert-tools): Release 0.1.1 (#682)

* chore(cert-tools): Add release instructions

* chore(cert-tools): Add changelog

* chore(cert-tools): Bump version to 0.1.1

* chore(cert-tools): Add comment to Cargo.toml

* chore(cert-tools): Don't match comment in release script, rename variable

Co-authored-by: Nick Larsen <nick.larsen@stackable.tech>

---------

Co-authored-by: Nick Larsen <nick.larsen@stackable.tech>

Author: Techassi

Cargo.lock

@@ -0,0 +1,13 @@
+<!-- GENERATED BY GIT-CLIFF, DO NOT EDIT MANUALLY -->
+
+# Changelog
+
+All notable changes to this project will be documented in this file.
+
+## [0.1.1] - 2026-02-23
+
+### Features
+
+- Add typed errors and restructure code ([#678](https://github.com/stackabletech/secret-operator/pull/678)).
+
+<!-- GENERATED BY GIT-CLIFF, DO NOT EDIT MANUALLY -->

Cargo.nix

@@ -1,7 +1,7 @@
 [package]
 name = "cert-tools"
 description = "Merge multiple truststores encoded as PEM or PKCS12 into a JVM compatible format"
-version = "0.0.0-dev"
+version = "0.1.1" # Managed by .scripts/release_cert-tools.sh
 authors.workspace = true
 license.workspace = true
 edition.workspace = true

rust/cert-tools/CHANGELOG.md

@@ -0,0 +1,12 @@
+# Release Process
+
+To release a new version of `cert-tools` the following steps need to be done:
+
+1. Make sure the local `main` branch is up-to-date and in a clean state.
+2. Run the `scripts/release_cert-tools.sh` script. This takes care of
+   - generating the changelog
+   - updating the `Cargo.toml` version
+   - raising a PR with the changes
+3. Merge the PR.
+4. Add the appropriate tag on `main` by running `git tag <TAG> -m <TAG> -s`.
+5. Push the tag.

rust/cert-tools/Cargo.toml

@@ -0,0 +1,89 @@
+[bump]
+# We set this to false, because we currently use a 0.X.X version. Features will thus only bump the
+# patch-level version.
+features_always_bump_minor = false
+
+# We set this to false, because we currently use a 0.X.X version. Breaking changes will thus only
+# bump the minor version.
+breaking_always_bump_major = false
+
+initial_tag = "cert-tools-0.1.1"
+
+[git]
+# All commits should be parsed as conventional commits.
+conventional_commits = true
+
+# All unconventional commits are filtered out and ignored.
+filter_unconventional = true
+
+# Commits listed in the changelog are sorted from newest to oldest.
+sort_commits = "newest"
+
+# Filter and ignore all commits NOT matched by the commit parsers below.
+filter_commits = true
+
+commit_parsers = [
+  { message = "^chore\\(cert-tools\\): Release", skip = true },
+  { message = "^feat\\(cert-tools\\)", group = "<!-- 0 --> Features" },
+  { message = "^fix\\(cert-tools\\)", group = "<!-- 1 --> Bug Fixes" },
+  { message = "^docs?\\(cert-tools\\)", group = "<!-- 2 --> Documentation" },
+  { message = "^(perf|refactor|test)\\(cert-tools\\)", group = "<!-- 3 --> Improvements" },
+  { message = "^chore\\(cert-tools\\): Improve", group = "<!-- 3 --> Improvements" },
+  { message = "^chore\\(cert-tools\\)", group = "<!-- 4 --> Miscellaneous" },
+]
+
+commit_preprocessors = [
+  # Replace issue numbers with link templates to be updated in `changelog.postprocessors`.
+  { pattern = '\((\w+\s)?#([0-9]+)\)', replace = "([#${2}](<REPO>/pull/${2}))" },
+]
+
+# Only consider the 'cert-tools-' Git tags when generating the changelog
+tag_pattern = "cert-tools-[0-9]*.[0-9]*.[0-9]*"
+
+# Ignore the first release tag
+skip_tags = "cert-tools-0.1.0"
+
+[changelog]
+trim = true
+
+postprocessors = [
+  # Replace the placeholder `<REPO>` with a URL.
+  { pattern = '<REPO>', replace = "https://github.com/stackabletech/secret-operator" },
+]
+
+header = """<!-- GENERATED BY GIT-CLIFF, DO NOT EDIT MANUALLY -->
+
+# Changelog
+
+All notable changes to this project will be documented in this file.
+"""
+
+body = """
+
+{% if version %}\
+    {% if previous.version %}\
+        ## [{{ version | trim_start_matches(pat="cert-tools-") }}] - {{ timestamp | date(format="%Y-%m-%d") }}
+
+        [See complete diff](<REPO>/compare/{{ previous.version }}..{{ version }})
+    {% else %}\
+        ## [{{ version | trim_start_matches(pat="cert-tools-") }}] - {{ timestamp | date(format="%Y-%m-%d") }}
+    {% endif %}\
+{% else %}\
+    ## [Unreleased]
+{% endif %}\
+
+{% for group, commits in commits | group_by(attribute="group") %}
+    ### {{ group | striptags | trim | upper_first }}
+    {% for commit in commits %}
+        - {% if commit.breaking %}**BREAKING:** {% endif %}\
+            {{ commit.message | upper_first }}.\
+    {%- endfor %}
+{% endfor -%}
+
+
+"""
+
+footer = """
+
+<!-- GENERATED BY GIT-CLIFF, DO NOT EDIT MANUALLY -->
+"""

rust/cert-tools/RELEASE.md

@@ -0,0 +1,87 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# NOTE: Slashes need to be escaped.
+CRATE_VERSION_COMMENT="# Managed by .scripts\/release_cert-tools.sh"
+
+BUMPED_VERSION=$(git-cliff --config rust/cert-tools/cliff.toml --bumped-version)
+CLEANED_BUMPED_VERSION=${BUMPED_VERSION#boil-}
+
+RELEASE_BRANCH="chore/cert-tools-release-$CLEANED_BUMPED_VERSION"
+
+echo "Checking if working directory is clean"
+if ! git diff-index --quiet HEAD --; then
+  echo "Working directory is dirty, aborting" >&2
+  exit 1
+fi
+
+# Prompt the user to confirm their Git identity used to create the commit
+GIT_EMAIL=$(git config --includes --get user.email)
+GIT_USER=$(git config --includes --get user.name)
+
+echo "The following Git user will be used: $GIT_USER <$GIT_EMAIL>"
+echo "Is this correct (Y/n)?"
+read -r RESPONSE
+
+if [[ "$RESPONSE" == "y" || "$RESPONSE" == "Y" || -z "$RESPONSE" ]]; then
+  echo "Proceeding with $GIT_USER <$GIT_EMAIL>"
+else
+  >&2 echo "User not accepted. Exiting."
+  exit 1
+fi
+
+# Check dependencies
+gh auth status
+git-cliff --version
+
+# Switch to main branch after we validated that the working directory is clean
+git switch main
+
+# Make sure we have the latest remote changes locally
+git pull
+
+echo "Creating and switching to $RELEASE_BRANCH branch"
+git switch -c "$RELEASE_BRANCH"
+
+echo "Generating updated changelog for $BUMPED_VERSION"
+git-cliff --config rust/cert-tools/cliff.toml --tag "$BUMPED_VERSION" > rust/cert-tools/CHANGELOG.md
+
+echo "Updating the version to $CLEANED_BUMPED_VERSION in the Cargo.toml file"
+sed -E -i "s/^version = .*$/version = \"$CLEANED_BUMPED_VERSION\" $CRATE_VERSION_COMMENT/" rust/cert-tools/Cargo.toml
+cargo check
+
+echo "Committing changes"
+# Make sure that there are changes to be committed
+if git diff-index --quiet HEAD --; then
+  echo "No changes to commit"
+  exit 1
+fi
+
+git add rust/cert-tools/CHANGELOG.md rust/cert-tools/Cargo.*
+git commit --message "chore(cert-tools): Release $CLEANED_BUMPED_VERSION" --no-verify --gpg-sign
+
+echo "Do you want to proceed with rasing a PR (y/N)?"
+read -r RESPONSE
+
+if [[ "$RESPONSE" == "y" || "$RESPONSE" == "Y" ]]; then
+  echo "Pushing changes and raising PR"
+else
+  >&2 echo "Not pushing. Exiting."
+  exit 1
+fi
+
+CHANGELOG_SUMMARY=$(git-cliff --config rust/cert-tools/cliff.toml --tag "$BUMPED_VERSION" --strip header --unreleased)
+PR_BODY=$(mktemp)
+echo -e "This PR was raised automatically by a release script. It releases $BUMPED_VERSION:\n$CHANGELOG_SUMMARY" > "$PR_BODY"
+
+git push --set-upstream origin "$RELEASE_BRANCH"
+gh pr create --base main \
+  --title "chore(cert-tools): Release $CLEANED_BUMPED_VERSION" \
+  --body-file "$PR_BODY" \
+  --assignee "@me" \
+  --draft
+
+echo "After merging the PR, make sure to run the following commands to finish up the release:"
+echo "git switch main && git pull"
+echo "git tag $BUMPED_VERSION -m $BUMPED_VERSION -s"
+echo "git push --follow-tags"