A packaging release. No change to scanning, scoring, the agent, the server or
the knowledge base since v0.1.0 — the point of the tag is that the GitHub
Action's release-install path resolves for the first time.

The Action installs from a release again

v0.1.0 published its archives as upgradescope-v0.1.0-<os>-<arch>.tar.gz,
while action/action.yml fetched upgradescope_<os>_<arch>.tar.gz. Every run
404'd and fell through to the go install fallback, so the gate worked but
built from source each time and never once took the route the README describes.

402206f fixed both sides — the archive name drops the version so
/releases/latest/download/<asset> resolves to a stable filename, and the
Action extracts the binary from the tarball — but that landed six weeks after
v0.1.0, and the Action resolves assets against the release, not against
main. Until this tag there was no release carrying the corrected names.

This release publishes:

upgradescope_linux_amd64.tar.gz
upgradescope_linux_arm64.tar.gz
upgradescope_darwin_amd64.tar.gz
upgradescope_darwin_arm64.tar.gz
checksums.txt

which is exactly what the Action requests. The go install fallback stays for
platforms with no published archive.

Also in this tag

• The README's headline question targeted Kubernetes 1.38 while the embedded
  knowledge base tops out at 1.36 (maxKnownK8s, generated from k8s.io/api
  v0.36.1 — and 1.36 is the newest minor upstream has actually released). The
  flagship command's only finding was therefore a kb-stale warning about the
  tool's own knowledge base. The examples now target the horizon, and the
  horizon is documented: scanning above it is still supported, and the
  kb-stale warning is the honest answer when you do.
• staticcheck is pinned to v0.7.0 in both CI and make lint instead of
  @latest, so an upstream linter release can no longer turn an unrelated pull
  request red. make lint also no longer defers to whatever staticcheck
  happens to be on PATH.
• The Go Report Card badge is gone — goreportcard.com retired the service and
  the badge rendered "go report: retired".

Verifying

sha256sum -c checksums.txt --ignore-missing

upgradescope v0.1.0 — first release

Continuous Kubernetes upgrade-readiness scanning, self-hosted and Apache-2.0.

Highlights

• upgradescope scan — point-in-time readiness scan of a live cluster or rendered manifests (--files). Table, JSON, and SARIF output; exit-code gate for CI (--fail-on). ~0.25s against a small cluster.
• Continuous mode — read-only in-cluster agent maintains a ClusterReadiness CRD (kubectl get ucr) and pushes deduped snapshots to a self-hosted server (SQLite or Postgres): history, what-if (?target=), Slack/webhook alerts fired only on new blockers.
• Fleet — cluster × target score matrix, per-team scores with server-side team mapping, per-cluster ingest tokens, auditor CSV/HTML exports.
• CI gate — POST /api/v1/gate evaluates manifests inside a known cluster's context; composite GitHub Action included (action/).
• Embedded web dashboard — fleet matrix, cluster drill-down, registry browser; single binary via go:embed.
• Knowledge base — 160 API-lifecycle entries generated from upstream k8s.io/api source (covers removals beyond the human-written migration guide), 18-add-on EOL registry with required upstream citations, synced against endoflife.date weekly via CI.

Detection coverage

deprecated/removed API objects (probed at the deprecated endpoints), clients still calling deprecated APIs (apiserver_requested_deprecated_apis metric), add-on EOL (e.g. ingress-nginx, EOL since 2026-03-24), Helm chart ↔ K8s compatibility, kubelet/control-plane/kube-proxy version skew.

Score

score = max(0, 100 − min(75, 25×blockers) − min(20, 5×warnings)); ready = no blockers. Deterministic and documented.

Install

go install github.com/abd-ulbasit/upgradescope/cmd/upgradescope@v0.1.0
# or grab a binary below; Helm chart in deploy/chart

Known limitations

• kubectl client skew is not detectable without apiserver audit logs (by design; documented).
• Managed control planes (EKS/GKE/AKS) may block /metrics — the deprecated-callers signal degrades gracefully and is reported as "not assessed"; everything else works unchanged.
• kind: List items are not expanded in --files mode.