chore(release): prepare v0.3.0 and pin release signing identity in docs

[santosr2]

What and why

Release prep for v0.3.0: version bumps for the Go project (0.2.0 → 0.3.0) and the VS Code extension (0.2.1 → 0.3.0), an upgrade-guide entry for the rule-ID renames, and the tightened verification commands promised in #279.

Why: This release was originally planned as v0.2.1, but a patch is the wrong classification. #258 renamed public rule IDs — style.block-label-case split into style.resource-name-convention and style.data-name-convention, style.{variable,output,local}-naming gained -name-convention suffixes, and lint.terraform-naming-convention was removed. Those IDs are config keys, terratidy:ignore targets, and SARIF rule IDs, so existing configs break. Worse, internal/config does not reject unrecognized rule keys, so a config left on the old IDs loads without error and silently stops applying its overrides. git-cliff already routes that commit into a Breaking Changes group, which would have appeared under a patch heading. pkg/sdk itself is unchanged apart from doc comments, so gorelease stays clean.

The VS Code extension follows the major.minor matches Go rule from vscode/.bumpversion.toml, landing on 0.3.0 — the "versions realign here" case that config already anticipates.

On the verification side, the documented cosign identity used --certificate-identity-regexp 'https://github.com/santosr2/TerraTidy', which matches any workflow on any ref in the repository. It is now pinned to the exact release.yml@refs/tags/vX.Y.Z identity, and gh attestation verify gained --signer-workflow and --source-ref. A new .bumpversion.toml entry keeps those pinned tags in step with the version. The guide also records why the strict command fails against v0.2.0: those artifacts were published by dispatching from main, so the certificate names refs/heads/main and commit bc6433c rather than the tag.

Refs #279

How to test

mise run check          # fmt, vet, lint, test — passes
mise run docs:build     # MkDocs builds clean
cd vscode && bun run compile

mise run version:show           # 0.3.0
mise run vscode:version:show    # 0.3.0
mise run changelog:preview      # Breaking Changes section is present

After the tag is pushed, the tightened command should verify against the v0.3.0 artifacts:

gh release download v0.3.0 --repo santosr2/terratidy -p 'checksums.txt*'
cosign verify-blob checksums.txt \
  --bundle checksums.txt.bundle \
  --certificate-identity 'https://github.com/santosr2/TerraTidy/.github/workflows/release.yml@refs/tags/v0.3.0' \
  --certificate-oidc-issuer 'https://token.actions.githubusercontent.com'

Notes for reviewers

mise run bump:minor does not produce a stable minor version. pre_l carries optional_value = "final" with values = ["alpha", "beta", "rc", "final"], so a minor bump resets the pre-release part and lands on 0.3.0-alpha. Reaching 0.3.0 took bump:minor followed by bump:stable. The mise.toml descriptions claimed otherwise, so the last commit corrects them (and CLAUDE.md) to say these tasks open a pre-release cycle. The serialization itself is left as-is on purpose: resetting to alpha is what lets a pre-1.0 project start a new alpha cycle, and bump:stable is the documented way to finish one.

bump:pre has a related sharp edge, now documented rather than changed: run from a stable version it serializes the optional final label and yields 0.3.0-final.2.

The v0.2.0 certificate is not fixable. Re-signing needs a workflow at the tag's commit that has a workflow_dispatch trigger (it does not), re-pushing the tag re-runs the GoReleaser v2.15.0 build that #250 fixed, and re-pointing the tag breaks the module proxy entry. The guide documents the workaround (rebuild from the tag and compare checksums, since builds are reproducible) instead.

CHANGELOG.md is untouched — git-cliff regenerates it from the release workflow after the tag is cut.

The v0.2.0 release notes now carry a warning about the mislabeled certificate, and #279 has a comment explaining the switch from v0.2.1 to v0.3.0. The one remaining step after merge is pushing the signed v0.3.0 tag.

Checklist

• I have read the CONTRIBUTING guidelines
• My code follows the project's code style
• I have added tests that prove my fix/feature works
• All checks pass (mise run check runs fmt, vet, lint, and test)
• I have updated documentation as needed
• My commits follow Conventional Commits

---

🤖 Generated with Claude Code