release: publish FixBundle v0.6.0

.github/workflows/publish-v0.6.0.yml

@@ -0,0 +1,50 @@
+name: Publish v0.6.0
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - ".github/workflows/publish-v0.6.0.yml"
+
+permissions:
+  contents: write
+
+jobs:
+  release:
+    if: github.repository == 'yaertu/fixbundle'
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Verify release source
+        shell: bash
+        run: |
+          python - <<'PY'
+          from pathlib import Path
+          import re
+
+          init = Path("src/fixbundle/__init__.py").read_text(encoding="utf-8")
+          pyproject = Path("pyproject.toml").read_text(encoding="utf-8")
+          assert '__version__ = "0.6.0"' in init
+          assert re.search(r'^version = "0\.6\.0"$', pyproject, re.MULTILINE)
+          assert Path("docs/releases/v0.6.0.md").is_file()
+          print("PASS release_source=v0.6.0")
+          PY
+
+      - name: Create GitHub release if missing
+        env:
+          GH_TOKEN: ${{ github.token }}
+        shell: bash
+        run: |
+          if gh release view v0.6.0 --repo "$GITHUB_REPOSITORY" >/dev/null 2>&1; then
+            echo "PASS release_exists=v0.6.0"
+            exit 0
+          fi
+
+          gh release create v0.6.0 \
+            --repo "$GITHUB_REPOSITORY" \
+            --target "$GITHUB_SHA" \
+            --title "FixBundle v0.6.0 — Cross-source Evidence Compare" \
+            --notes-file docs/releases/v0.6.0.md
+
+          gh release view v0.6.0 --repo "$GITHUB_REPOSITORY" --json tagName,name,url

docs/releases/v0.6.0.md

@@ -0,0 +1,37 @@
+# FixBundle v0.6.0 — Cross-source Evidence Compare
+
+FixBundle can now capture failure evidence from local commands, historical Git commits, failed GitHub Actions runs, and OpenTelemetry production exports, then compare two FixBundle artifacts to answer one bounded question: **what evidence changed?**
+
+## New in v0.6.0
+
+```bash
+fixbundle compare baseline.zip incident.zip
+fixbundle compare baseline.zip incident.zip --format json
+```
+
+Compare supports current `fixbundle/0.3`, `fixbundle/0.4`, and `fixbundle/0.5` artifacts and normalizes Git identity, changed files, failed commands/jobs/steps, production exceptions, service/deployment identity, traces, and runtime evidence.
+
+The output is deterministic and evidence-oriented: `changed`, `added`, `removed`, `unavailable`, plus an `unchanged` summary count. It does not claim root cause and does not require an LLM or network connection.
+
+## Integrity before interpretation
+
+Both input ZIPs are treated as untrusted. FixBundle validates `SHA256SUMS.txt` before interpreting evidence and fails closed on checksum mismatch, malformed checksum coverage, unsafe ZIP paths, duplicate members, symlinks, encrypted members, unsupported schemas, and archive size/member-limit violations. Input ZIPs are never extracted or mutated.
+
+## Reproducible proof
+
+The v0.6 compare demo creates two real OTLP FixBundle artifacts and proves:
+
+```text
+PASS input_integrity=validated
+PASS service_version=2.4.1->2.4.2
+PASS exception=none->PaymentGatewayError
+PASS trace_id=11111111111111111111111111111111->22222222222222222222222222222222
+```
+
+Final PR CI run `33591771123` and post-merge main run `33591951443` both completed successfully with the full Ubuntu / Windows / macOS × Python 3.10 / 3.12 / 3.13 matrix plus the real GitHub Actions failure-evidence gate.
+
+## Product boundary
+
+FixBundle is not an observability dashboard, generic text diff, or autonomous root-cause agent. The project focuses on **portable, bounded, redacted failure evidence and deterministic evidence comparison** that can be handed to Codex, Claude Code, Cursor, ChatGPT, another agent, or a human engineer.
+
+The next gate is adoption and repeat use, not another version bump: does a maintainer keep a FixBundle artifact because comparing it with the next incident saves time?