From 114f7f5f850c155030813e36ca4ce2db3f4480d9 Mon Sep 17 00:00:00 2001
From: Eric Rakestraw <eric@rakestraw.us>
Date: Sun, 2 Aug 2026 00:36:54 +0000
Subject: [PATCH] Make release validation portable

---
 docs/releases/v0.10.1.md       | 33 +++++++++++++++++++++++++++++++++
 internal/config/config_test.go |  3 +++
 2 files changed, 36 insertions(+)
 create mode 100644 docs/releases/v0.10.1.md

diff --git a/docs/releases/v0.10.1.md b/docs/releases/v0.10.1.md
new file mode 100644
index 0000000..dc1f42e
--- /dev/null
+++ b/docs/releases/v0.10.1.md
@@ -0,0 +1,33 @@
+# Weatherreporter v0.10.1
+
+This release repairs release validation after the `v0.10.0` pipeline failed in
+its privileged build container. Application behavior is unchanged from
+`v0.10.0`.
+
+## Summary
+
+The unreadable-secret configuration test now verifies that its process is
+actually subject to file permission bits before asserting that a mode-`000`
+file cannot be read. This keeps the test meaningful for ordinary users while
+allowing the release suite to run correctly in privileged containers.
+
+## Compatibility
+
+This patch release makes no changes to Weatherreporter's CLI, configuration,
+report output, integrations, prompts, profiles, or operating behavior. It is
+fully compatible with `v0.10.0`.
+
+## Upgrade
+
+No special operator action is required. Use `v0.10.1` in place of `v0.10.0`;
+the `v0.10.0` tag remains immutable, but its failed pipeline did not publish
+release binaries.
+
+## Changes
+
+- Made the unreadable-secret test capability-aware when the test process can
+  bypass filesystem permission bits.
+- Preserved the production contract that genuinely unreadable secret files
+  fail configuration loading.
+- Restored portable release validation in Woodpecker's privileged Go
+  container.
diff --git a/internal/config/config_test.go b/internal/config/config_test.go
index a4e94cd..32232c0 100644
--- a/internal/config/config_test.go
+++ b/internal/config/config_test.go
@@ -1674,6 +1674,9 @@ func TestLoadSecretsRejectsInvalidDirectoryEntries(t *testing.T) {
 				t.Cleanup(func() {
 					_ = os.Chmod(path, 0o600)
 				})
+				if _, err := os.ReadFile(path); err == nil {
+					t.Skip("test process can read files without permission bits")
+				}
 			},
 			wantErr: "read secret file",
 		},