release: prepare v0.1.3, retracting the mis-tagged v0.1.2

v0.1.2 was tagged before the release-prep commit was pulled, so it points
at the #50 merge and still carries v0.1.1 pins. The tag cannot be moved:
proxy.golang.org and sum.golang.org already recorded v0.1.2 against that
commit, so re-pointing it would make the checksum database disagree with
the repository and fail installs with a security error.

Retract it in go.mod (Go's documented mechanism, which takes effect from
the next release), re-head the changelog entry as v0.1.3, and bump the
four version pins.

Author: charlesgreen

.github/workflows/simplycubed.yml

@@ -36,7 +36,7 @@ on:
         type: string
       version:
         description: SimplyCubed CLI tag to install.
-        default: v0.1.2
+        default: v0.1.3
         required: false
         type: string
     secrets:

CHANGELOG.md

@@ -3,7 +3,10 @@
 All notable changes are recorded here and summarized again in the matching
 GitHub release notes for each tag.
 
-## v0.1.2
+## v0.1.3
+
+Supersedes v0.1.2, which was tagged from the wrong commit and is retracted in
+`go.mod`. The content below is what v0.1.2 was meant to carry.
 
 **Breaking (GitHub Actions runtime only):** the reusable workflow now
 authenticates as the `simplycubed-code` GitHub App and no longer accepts the

README.md

@@ -2,7 +2,7 @@
 
 An autonomous coding agent that lives inside your own GitHub. You file an issue, it opens a pull request, and a human decides whether to merge.
 
-> Status: beta. `v0.1.2` is the latest release; expect rough edges. Product overview: [simplycubed.com/code](https://simplycubed.com/code?utm_source=github&utm_medium=readme&utm_campaign=code). See [Status](#status).
+> Status: beta. `v0.1.3` is the latest release; expect rough edges. Product overview: [simplycubed.com/code](https://simplycubed.com/code?utm_source=github&utm_medium=readme&utm_campaign=code). See [Status](#status).
 
 ## What it is
 
@@ -60,11 +60,11 @@ Start with the adopter quickstart in [docs/setup.md](docs/setup.md). It covers t
 Install the pinned release you want to run:
 
 ```sh
-go install github.com/simplycubed/code/cmd/simplycubed@v0.1.2
+go install github.com/simplycubed/code/cmd/simplycubed@v0.1.3
 simplycubed version
 ```
 
-That prints `0.1.2`. Pre-1.0 releases follow semver with the usual caveat: minor
+That prints `0.1.3`. Pre-1.0 releases follow semver with the usual caveat: minor
 versions may still change behavior. Pin the tag you have validated rather than
 floating on `@latest`.
 
@@ -135,7 +135,7 @@ The first engine adapter targets the Codex CLI running against Azure OpenAI. Tod
 
 ## Status
 
-Beta, and honest about it. Two loops run end to end via the CLI on the Codex-on-Azure engine: issue to pull request, and fix-on-request (a human requests changes, the fixer addresses them and pushes back). `v0.1.2` is the latest release and you should still expect rough edges.
+Beta, and honest about it. Two loops run end to end via the CLI on the Codex-on-Azure engine: issue to pull request, and fix-on-request (a human requests changes, the fixer addresses them and pushes back). `v0.1.3` is the latest release and you should still expect rough edges.
 
 Roadmap, roughly in order:
 

cmd/simplycubed/main.go

@@ -104,7 +104,7 @@ gate:
 `
 
 const (
-	latestKnownWorkflowTag = "v0.1.2"
+	latestKnownWorkflowTag = "v0.1.3"
 	callerWorkflowTagToken = "__SIMPLYCUBED_TAG__"
 )
 

docs/setup.md

@@ -16,7 +16,7 @@ Prerequisites:
 1. Install the CLI:
 
 ```sh
-go install github.com/simplycubed/code/cmd/simplycubed@v0.1.2
+go install github.com/simplycubed/code/cmd/simplycubed@v0.1.3
 simplycubed version
 ```
 

docs/templates/simplycubed-caller.yml

@@ -9,7 +9,7 @@ on:
 jobs:
   run:
     if: ${{ github.event_name == 'issues' && github.event.label.name == 'sc:go' }}
-    uses: simplycubed/code/.github/workflows/simplycubed.yml@v0.1.2
+    uses: simplycubed/code/.github/workflows/simplycubed.yml@v0.1.3
     with:
       ref: ${{ github.event.issue.number }}
       github-app-id: ${{ vars.SIMPLYCUBED_GH_APP_ID }}
@@ -23,7 +23,7 @@ jobs:
 
   address:
     if: ${{ github.event_name == 'pull_request_review' }}
-    uses: simplycubed/code/.github/workflows/simplycubed.yml@v0.1.2
+    uses: simplycubed/code/.github/workflows/simplycubed.yml@v0.1.3
     with:
       ref: ${{ github.event.pull_request.number }}
       github-app-id: ${{ vars.SIMPLYCUBED_GH_APP_ID }}

go.mod

@@ -1,3 +1,11 @@
 module github.com/simplycubed/code
 
 go 1.26
+
+// v0.1.2 was tagged from the wrong commit (the release-prep commit was not yet
+// pulled), so its version strings and workflow pins point at v0.1.1. The tag
+// could not be re-pointed: proxy.golang.org and sum.golang.org had already
+// recorded v0.1.2 against that commit, and moving it would make the checksum
+// database disagree with the repository. v0.1.3 is the same content, tagged
+// correctly.
+retract v0.1.2