📝 docs(release): prep v0.3.0 (E8 data-sources epic)

CHANGELOG.md

@@ -12,7 +12,7 @@ Release notes are generated from [Conventional Commits](https://www.conventional
 
 ### Bug Fixes
 
-- **main:** Wire SetupCustom and SetupCustomGated into provider startup E8-S04 [feadc92](https://github.com/platformrelay/provider-gridscale/commit/feadc92f0b65915223a41229cf50a1f5d0b76c85)
+- **main:** Wire SetupCustom and SetupCustomGated into provider startup E8-S04 [4152617](https://github.com/platformrelay/provider-gridscale/commit/4152617b442c569b65adaff2522ef4f42da1e704)
 
 - **backuplist:** Fix deprecated API, goimports, regenerate managed/deepcopy files [64a5f5c](https://github.com/platformrelay/provider-gridscale/commit/64a5f5c6c2f78dee4ba7a468f327f1e365ce9cdd)
 
@@ -23,6 +23,14 @@ Release notes are generated from [Conventional Commits](https://www.conventional
 
 ### Documentation
 
+- **release:** Clarify publish is independent of the changelog PR [56ab9f7](https://github.com/platformrelay/provider-gridscale/commit/56ab9f70154ca9481756530de3689322cc9ddd95)
+
+- **release:** Defer v0.3.0 changelog to tag automation; correct coordination [c36fb92](https://github.com/platformrelay/provider-gridscale/commit/c36fb927705c9cb6d366b79498a10b8cb69dbe2d)
+
+- **release:** V0.3.0 changelog + install refs; decide D-022 (release E8) [53a8d01](https://github.com/platformrelay/provider-gridscale/commit/53a8d011a63c3263c53ea8f2a609d275ec68b27d)
+
+- **coordination:** Mark E8 data-sources epic Integrated (PRs #30-#33) ([#34](https://github.com/platformrelay/provider-gridscale/pull/34))[309b76a](https://github.com/platformrelay/provider-gridscale/commit/309b76a5a38fdb9d03840ebb1642d19bdb39905a)
+
 - **api:** Regenerate CRD reference docs and README for PublicNetwork E8-S03 [1d8a2e8](https://github.com/platformrelay/provider-gridscale/commit/1d8a2e8679b97bb7333ed1a735ea606460143c99)
 
 - **observe:** Add 38 observe-only example YAMLs and docs E8-S01 [e92f89e](https://github.com/platformrelay/provider-gridscale/commit/e92f89e051884187ec9c33e6cb9d2f9f8ee3cfa6)
@@ -34,7 +42,7 @@ Release notes are generated from [Conventional Commits](https://www.conventional
 
 ### Features
 
-- **setup:** Wire PublicNetwork controller into setup_custom E8-S04 [80e2d4e](https://github.com/platformrelay/provider-gridscale/commit/80e2d4e5359e637284abaa1de739d85278817366)
+- **setup:** Wire PublicNetwork controller into setup_custom E8-S04 [fb3ecf8](https://github.com/platformrelay/provider-gridscale/commit/fb3ecf8084aaded555e32d89cc97ec5cd654f7d2)
 
 - **publicnetwork:** Add PublicNetwork CRD and observe-only controller E8-S03 [fbc69d9](https://github.com/platformrelay/provider-gridscale/commit/fbc69d95d5d70b6f44cf1e0c32b678df4b4bc270)
 

README.md

@@ -12,7 +12,7 @@
 <a href="https://securityscorecards.dev/viewer/?uri=github.com/PlatformRelay/provider-gridscale"><img src="https://api.securityscorecards.dev/projects/github.com/PlatformRelay/provider-gridscale/badge" alt="OpenSSF Scorecard"></a>
 <a href="https://codecov.io/gh/PlatformRelay/provider-gridscale"><img src="https://codecov.io/gh/PlatformRelay/provider-gridscale/graph/badge.svg" alt="codecov"></a>
 <a href="https://github.com/PlatformRelay/provider-gridscale/releases"><img src="https://img.shields.io/github/v/release/PlatformRelay/provider-gridscale?include_prereleases&sort=semver" alt="Release"></a>
-<a href="https://marketplace.upbound.io/providers/platformrelay/provider-gridscale"><img src="https://img.shields.io/badge/Upbound%20Marketplace-v0.2.2-blue" alt="Marketplace"></a>
+<a href="https://marketplace.upbound.io/providers/platformrelay/provider-gridscale"><img src="https://img.shields.io/badge/Upbound%20Marketplace-v0.3.0-blue" alt="Marketplace"></a>
 <a href="https://github.com/orgs/PlatformRelay/packages?repo_name=provider-gridscale"><img src="https://img.shields.io/badge/ghcr.io-platformrelay%2Fprovider-gridscale-2496ED?logo=docker&logoColor=white" alt="Container"></a>
 <a href="https://github.com/PlatformRelay/provider-gridscale/blob/main/go.mod"><img src="https://img.shields.io/github/go-mod/go-version/PlatformRelay/provider-gridscale" alt="Go"></a>
 <a href="LICENSE"><img src="https://img.shields.io/github/license/PlatformRelay/provider-gridscale" alt="License"></a>
@@ -92,9 +92,9 @@ kubectl get providers
 
 Package path in [`examples/install.yaml`](examples/install.yaml):
 
-`xpkg.upbound.io/platformrelay/provider-gridscale:v0.2.2`
+`xpkg.upbound.io/platformrelay/provider-gridscale:v0.3.0`
 
-Also published to GHCR: `ghcr.io/platformrelay/provider-gridscale:v0.2.2`.
+Also published to GHCR: `ghcr.io/platformrelay/provider-gridscale:v0.3.0`.
 
 **Next:** apply a resource from [`examples/cluster/`](examples/cluster/) or
 [`examples/namespaced/`](examples/namespaced/), then `kubectl explain servers`

agent-context/INBOX.md

@@ -22,8 +22,18 @@ _None open._
    `.envrc` only — do **not** put it in Actions secrets).
 2. **Nudge/track upstream PRs** #509/#510/#511 if they stall; on merge, re-vendor
    (`TERRAFORM_PROVIDER_VERSION`) and drop the local U-1/LB-1 overrides.
-3. **Consider releasing v0.3.0** — E8 adds 2 new custom observe-only controllers (BackupList,
-   PublicNetwork) + 38 observe-only example YAMLs. User-facing feature set warrants a minor bump.
+3. **Publish v0.3.0** — decided **D-022 → A** (release now) via `/operator-inbox` 2026-07-29.
+   Release-prep landed in **PR #35** (README + `examples/install.yaml` → v0.3.0; CHANGELOG left at
+   `[Unreleased]` — the `[0.3.0]` section is auto-generated by the tag automation, see below).
+   **Operator-only tail** (per standing permissions):
+   - **Merge PR #35** (release-prep) into `main`.
+   - **Tag** `v0.3.0` on the merged `main` commit and push. `tag.yaml` workflow is broken (ref lacks
+     `on.workflow_call`) → tag **manually**: `git tag v0.3.0 <sha> && git push origin v0.3.0`.
+     The tag push fires the `Changelog` workflow's `release` job → **auto-opens a `changelog/v0.3.0`
+     PR** with the `[0.3.0]` notes; merge that too. (It does **not** trigger publish.)
+   - **Publish**: `gh workflow run publish-provider-package.yml -f version=v0.3.0`. (Builds from the
+     tag — dispatch it right after tagging; it does **not** depend on the changelog PR being merged.)
+   - **Verify**: `cosign verify ghcr.io/platformrelay/provider-gridscale:v0.3.0 --certificate-oidc-issuer https://token.actions.githubusercontent.com --certificate-identity-regexp 'https://github.com/PlatformRelay/provider-gridscale/.*'`.
 
 ### Non-blocking / optional
 
@@ -38,7 +48,8 @@ _None open._
 
 - **E8 data-sources epic** — 4 stories landed 2026-07-28 (PRs #30–#33). 34 managed resources.
   BackupList + PublicNetwork observe-only controllers active at provider startup.
-  Next: operator decides v0.3.0 release timing.
+- **v0.3.0 release** — decided **D-022 → A** (release now, 2026-07-29). Release-prep done; publish
+  is the operator-only tail (see Operator task 3).
 - **GO-2026-5970** — `golang.org/x/text` bumped to v0.39.0; `make vuln` green again.
 - **README badges** — native GitHub Actions badges (CI / Coverage / E2E / Gitleaks / Govulncheck /
   CodeQL) plus Scorecard, codecov, release, Marketplace, GHCR, Go, License (kollect pattern).
@@ -53,11 +64,5 @@ _None open._
 - D-007…D-020, audit dispositions, BRAND-1 closed via D-009b (press mark), BRAND-2 Actioned
   (keep Bildmarke), TEST-2 operator-blocked (live uptest creds), E2-S04/S05 intentionally skipped
   (D-012 → B) — see `decisions.md` / SESSION-HANDOFF.
-
-## 🔴 DECIDED (awaiting approval) — cut and publish v0.2.2
-
-   Context: Tip CI/Scorecard/CodeQL/gitleaks/govulncheck/coverage all green on `7780f01` (+ docs `e1994d0`).
-   Sonar SECURITY open issues: **0**. Remaining Sonar items are maintainability (generated `zz_*`, nested-if in meta tests) — deferred.
-   Options: A) Hold · B) **Tag + GitHub Release + publish v0.2.2** (Recommended / executing)
-   Chose: **B** — security remediation is user-facing for install consumers; Marketplace/GHCR package update.
-   Revert: leave tag; do not yank published packages without a follow-up patch.
+- **v0.2.2** — cut, signed, and published (GHCR + Upbound, keyless-cosign, extensions verified).
+  Superseded by v0.3.0 (D-022).

agent-context/decisions.md

@@ -514,3 +514,39 @@ official product of gridscale GmbH" attribution under `docs/assets/branding/READ
 permission from gridscale GmbH). If that attribution ever weakens or the listing implies endorsement,
 revisit and swap to an original mark.
 
+---
+
+## D-022 — Cut and release v0.3.0 (E8 data-sources epic is user-facing)
+
+**Date:** 2026-07-29 · **Status:** Decided — operator answered via `/operator-inbox` (AskUserQuestion).
+Release-prep landed as a PR; the tag + publish + verify are the operator's remaining **operator-only**
+steps (per standing permissions).
+**Context:** The E8 data-sources epic landed on `main` across PRs #30–#33 (integrated via #34): two new
+observe-only custom controllers — **BackupList** (`storage.gridscale.platformrelay.io/v1alpha1`) and
+**PublicNetwork** (`gridscale.gridscale.platformrelay.io/v1alpha1`) — plus 38 observe-only example
+YAMLs, both wired into provider startup (`setup_custom.go` + `main.go`, E8-S04). CI on the integrated
+tip `309b76a` is fully green (CI, CodeQL, Coverage, Scorecard, Govulncheck, Gitleaks). Last published
+tag is `v0.2.2`. New additive controllers/CRDs ⇒ SemVer **minor** bump.
+**Options considered:**
+- **A — Release v0.3.0 now (chosen).** Tag + GitHub Release + publish. Feature set is done, CI green,
+  observe-only ⇒ low blast radius; no reason to sit on shipped user-facing work.
+- **B — Hold for upstream TF PRs #509/#510/#511**, then re-vendor + drop the local U-1/LB-1 Upjet
+  overrides and batch everything into one v0.3.0. Cleaner single release, but those PRs are outside
+  our control and may stall for weeks.
+- **C — Hold, no release yet.** Leaves E8 unavailable to install consumers.
+**Decision:** **A** — cut v0.3.0.
+**Counterpoint (kept even though overruled):** batching the upstream re-vendor (B) would likely avoid an
+imminent v0.3.1 — each of #509/#510/#511 merging drops a local Upjet override, arguably itself
+minor-worthy. Operator accepts a possible near-term follow-up release in exchange for shipping E8 now.
+**Release-prep (this session, PR #35):** README Marketplace badge + install/GHCR refs bumped to v0.3.0;
+`examples/install.yaml` bumped `v0.2.1`→`v0.3.0` (fixing pre-existing drift — the v0.2.2 release bumped
+only README, leaving install.yaml at v0.2.1); CHANGELOG regenerated the repo's way (plain `git cliff` →
+`[Unreleased]`, per the `Changelog` verify gate). The versioned `[0.3.0]` section is **not** hand-written
+— the `Changelog` workflow's `release` job produces it automatically on the `v0.3.0` tag push and opens a
+`changelog/v0.3.0` PR to merge.
+**Operator-only tail (per standing permissions):** (1) merge PR #35; (2) create tag `v0.3.0` on the
+merged `main` commit and push — `tag.yaml` is broken (ref lacks `on.workflow_call`), so tag manually;
+this fires the auto changelog PR (merge it) but **not** publish; (3) dispatch
+`publish-provider-package.yml -f version=v0.3.0` — it builds from the tag and does **not** depend on the
+changelog PR being merged first; (4) `cosign verify` the published digest.
+

examples/install.yaml

@@ -3,4 +3,4 @@ kind: Provider
 metadata:
   name: provider-gridscale
 spec:
-  package: xpkg.upbound.io/platformrelay/provider-gridscale:v0.2.1
+  package: xpkg.upbound.io/platformrelay/provider-gridscale:v0.3.0