From a1ca9c5791993f51c6303f38e463ce3db5be6d54 Mon Sep 17 00:00:00 2001 From: Wabo Date: Sun, 17 May 2026 10:13:48 -0400 Subject: [PATCH] Prepare for 1.0.0 release Sweep of stale upstream cruft and missing release-process plumbing: - SECURITY.md routes vuln reports to wabosign@wabo.cc - package.json renamed wabosign + license/repository fields - Drop the docuseal.com fallback href in signature_step.vue - Delete docs/api/ (10 upstream language stubs) and rewrite stale docuseal.com URLs in docs/openapi.json + docs/embedding/* + docs/webhooks/* to sign.wabo.cc - Remove console_redirect + enquiries controllers and routes (/upgrade, /manage, /console_redirect were DocuSeal-SaaS-only). Strip the navbar Console icon, the embed_scripts upgrade-to-Pro fallback, the sessions_controller CONSOLE_URL redirect, and the CONSOLE_URL/CDN_URL/CLOUD_URL/ENQUIRIES_URL constants. The four "Learn more" links in templates/_embedding.html.erb now point at sign.wabo.cc/docs/embedding; the two CDN script-src refs use the local embed_script_url helper. - Dockerfile gains OCI image labels via ARG VERSION/REVISION - docker.yml passes labels + build-args from metadata-action@v5 so the published image has the right manifest-level metadata - Add CHANGELOG.md (Keep-a-Changelog) and a Releases section in README Co-Authored-By: Claude Opus 4.7 --- .github/workflows/docker.yml | 6 +- CHANGELOG.md | 34 + Dockerfile | 13 + README.md | 11 +- SECURITY.md | 10 +- .../console_redirect_controller.rb | 26 - app/controllers/embed_scripts_controller.rb | 9 +- app/controllers/enquiries_controller.rb | 22 - app/controllers/sessions_controller.rb | 6 +- .../submission_form/signature_step.vue | 2 +- app/views/shared/_navbar.html.erb | 8 - app/views/templates/_embedding.html.erb | 12 +- config/routes.rb | 4 - docs/api/csharp.md | 3895 --------------- docs/api/go.md | 4360 ----------------- docs/api/java.md | 3874 --------------- docs/api/javascript.md | 4034 --------------- docs/api/nodejs.md | 4151 ---------------- docs/api/php.md | 3992 --------------- docs/api/python.md | 4055 --------------- docs/api/ruby.md | 4055 --------------- docs/api/shell.md | 3874 --------------- docs/api/typescript.md | 4034 --------------- docs/embedding/form-builder-javascript.md | 2 +- docs/embedding/signing-form-angular.md | 4 +- docs/embedding/signing-form-javascript.md | 6 +- docs/embedding/signing-form-react.md | 4 +- docs/embedding/signing-form-vue.md | 4 +- docs/openapi.json | 64 +- docs/webhooks/form-webhook.md | 4 +- lib/wabosign.rb | 20 - package.json | 7 +- spec/system/signing_form_spec.rb | 2 +- 33 files changed, 127 insertions(+), 40477 deletions(-) create mode 100644 CHANGELOG.md delete mode 100644 app/controllers/console_redirect_controller.rb delete mode 100644 app/controllers/enquiries_controller.rb delete mode 100644 docs/api/csharp.md delete mode 100644 docs/api/go.md delete mode 100644 docs/api/java.md delete mode 100644 docs/api/javascript.md delete mode 100644 docs/api/nodejs.md delete mode 100644 docs/api/php.md delete mode 100644 docs/api/python.md delete mode 100644 docs/api/ruby.md delete mode 100644 docs/api/shell.md delete mode 100644 docs/api/typescript.md diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml index 28542a17..8681e074 100644 --- a/.github/workflows/docker.yml +++ b/.github/workflows/docker.yml @@ -21,7 +21,7 @@ jobs: - name: Docker meta id: meta - uses: docker/metadata-action@v4 + uses: docker/metadata-action@v5 with: images: ghcr.io/wabolabs/wabosign tags: | @@ -51,3 +51,7 @@ jobs: push: true platforms: linux/amd64,linux/arm64 tags: ${{ steps.meta.outputs.tags }} + labels: ${{ steps.meta.outputs.labels }} + build-args: | + VERSION=${{ github.ref_name }} + REVISION=${{ github.sha }} diff --git a/CHANGELOG.md b/CHANGELOG.md new file mode 100644 index 00000000..b3f8d7cf --- /dev/null +++ b/CHANGELOG.md @@ -0,0 +1,34 @@ +# Changelog + +All notable changes to WaboSign are documented here. The format is based on +[Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and this project +adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html). + +## [1.0.0] — 2026-05-17 + +First WaboSign release. Forked from [DocuSeal](https://github.com/docusealco/docuseal) 2.5.3. + +### Added +- Google Workspace SSO via `omniauth-google-oauth2`, configurable from `/settings/sso` with ENV + DB fallback. See [GOOGLE_SSO.md](GOOGLE_SSO.md). +- SMS invitations via BulkVS, configurable from `/settings/sms`. See [SMS.md](SMS.md). +- Custom account logo upload with server-side SVG sanitization. The logo renders on the sign-in page, signing flow, dashboard navbar, share-link QR page, and audit-trail PDFs. +- Editor and Viewer user roles alongside Admin. Editors get CRUD on templates and submissions; Viewers get read-only access. Self-service profile management is preserved for every role. +- OCI image labels (`org.opencontainers.image.*`) and multi-arch (linux/amd64 + linux/arm64) Docker builds wired via `.github/workflows/docker.yml`. +- [CHANGELOG.md](CHANGELOG.md) and a Releases section in [README.md](README.md). + +### Changed +- Removed the upstream "Pro" feature paywall — multi-account, SSO, SMS, audit trail, and timestamping all work out of the box on a self-hosted deployment. +- Rebranded all UI surfaces, emails, and asset paths from DocuSeal to WaboSign while preserving AGPL §7(b) upstream attribution in [NOTICE](NOTICE), [REBRANDING.md](REBRANDING.md), [LICENSE_ADDITIONAL_TERMS](LICENSE_ADDITIONAL_TERMS), and the in-app "Powered by" footer. +- Default container image is now `ghcr.io/wabolabs/wabosign` (public). +- Security contact in [SECURITY.md](SECURITY.md) now routes to `wabosign@wabo.cc`. + +### Removed +- Developer Newsletter step from the initial-setup flow (was a DocuSeal mailing-list signup). +- Console-redirect endpoints (`/upgrade`, `/manage`, `/console_redirect`) and the enquiries form — only made sense for DocuSeal's hosted multitenant SaaS. +- Upstream API-docs language stubs at `docs/api/` (10 files referencing `api.docuseal.com`). The OpenAPI spec at `docs/openapi.json` and the embedding/webhook guides remain (URLs rewritten to `sign.wabo.cc`). +- The "Upgrade to Pro" fallback markup served by the embed-script controller — replaced with a neutral "embed assets not loaded" message. + +### Security +- Account-logo SVG uploads are sanitized via Nokogiri before storage (strips ` + <%= link_to t(:learn_more), "#{Wabosign::PRODUCT_URL}/docs/embedding", target: "_blank", data: { turbo: false }, class: "btn btn-ghost text-gray-100 flex", rel: "noopener" %> + "> "> "> @@ -78,7 +78,7 @@ -
<script src="<%= Wabosign::CDN_URL %>/js/form.js"></script>
+      
<script src="<%= embed_script_url(filename: "form.js") %>"></script>
 
 <docuseal-form data-src="<%= start_form_url(slug: template.slug) %>"></docuseal-form>
 
@@ -88,7 +88,7 @@