chore(main): release 0.3.0

[hermes-agent-release-bot]

🤖 I have created a release beep boop

0.3.0 (2026-09-29)

⚠ BREAKING CHANGES

• upgrade: since feat(resources): give the agent container a default request/limit floor stubbi/hermes-operator#151, instances that leave spec.resources unset render CPU and memory requests and limits on the agent container instead of running unbounded. An instance whose working set exceeds 4Gi of memory, or that relied on bursting past 2 CPUs, will be OOM-killed or throttled after this upgrade. Set spec.resources explicitly, or spec.resources.applyOperatorDefaults: false, before upgrading such an instance. Clusters relying on a namespace LimitRange to supply these values should note that the operator now wins over the LimitRange default. See docs/upgrade-notes.md.

Features

• chart: world-class Artifact Hub metadata + cosign chart signing (#78) (4e38216)
• hermes-operator v1.0.0 — plans 1–7 implementation (#1) (a99ad5c)
• optional Gateway API HTTPRoute for HermesInstance (#59) (ff5d781)
• publish images under ubc and auto-build on upstream releases (#1) (8b203b4)
• resources: give the agent container a default request/limit floor (#151) (35100b1)
• runtime: run agents on the upstream s6 image — instance reaches Ready (gateway API + /health) (#90) (12dccb4)
• scheduling: add spec.scheduling.runtimeClassName (#123) (4462cb7)
• spec.tailscale.mode=serve (private tailnet exposure) (#63) (da7c307)
• tier-1/2 parity (digest-pin, bench, image CEL, zombie reaping, Grafana, docs-site) (#56) (712ed2b)

Bug Fixes

• agent-image: broken runtime venv + invalid smoke workflow YAML (#66) (ec6016c)
• agent-image: native pinned uv relock + bump uv to 0.11.7 (#48) (6e2615f)
• agent-image: relock uses uv image entrypoint (unblocks hermes-agent publish) (#46) (9e456b1)
• agent-image: ship pyproject.toml + uv.lock at /opt/venv-template/ (#68) (#85) (39ef52c)
• agent-image: ship SBOM as run artifact, drop rekor attestation (#2) (8de8f13)
• agent-image: ship the uv binary in the runtime stage (#68) (#88) (13fb1e5)
• agent-image: verify uv.lock by git tag (unblocks publish) (#50) (3cbcc7f)
• backup: bound the on-delete finalizer so a failing snapshot can't make an instance undeletable (#94) (40d6099)
• bundle: declare com.redhat.openshift.versions for OpenShift cert (#80) (47d5ff4)
• bundle: keep the OLM CSV operator image refs on the current release (#150) (7a9bbab)
• chart: render pullable default image tags (#122) (88445b1)
• chart: stop rendering a doubled v in the operator image tag (#131) (7a724e5)
• ci: drop --remote from gh repo fork in operatorhub-submit (#29) (55bab59)
• ci: operatorhub-submit uses classic PAT with public_repo scope (#39) (33273ad)
• ci: release-please auto-creates tag via commit-message detection (#38) (e36a8d4)
• ci: semantic Bundle RBAC sync check (was: file-diff flake) (#16) (3b3b5a6)
• olm: correct CSV image refs so OperatorHub submission passes (#54) (edaa87d)
• olm: declare webhookDefinitions so OLM provisions the webhook cert (#57) (4420511)
• olm: use the official Hermes logo for the bundle icon (#60) (45c2f38)
• operatorhub: ship ci.yaml to redhat submission + add reviewers (#82) (9e9cafe)
• release: build container images via docker/build-push-action (#23) (d1b4862)
• release: bump the OLM CSV generically, the yaml updater drops the markers (#153) (14d41d2)
• release: run make installer via goreleaser before:hooks (#25) (5bcd154)
• release: trigger v0.1.2 (v0.1.1 tag has broken release.yaml) (#18) (e3f8289)
• release: use --skip=validate instead of throw-away commit (#20) (61f2099)
• release: write install.yaml outside dist for goreleaser dist check (#28) (b1f3f0a)
• rename stubbi → paperclipinc across chart, CI, docs, Go module (de3e0bd)

Documentation

• upgrade: add upgrade notes, starting with the agent resource floor (#154) (f2528e3)

---

This PR was generated with Release Please. See documentation.

[xcompass]

Closing: every entry here is already released. 35 are upstream commits synced in #21 and published as v0.2.0; the other two (8b203b4, 8de8f13) shipped in the fork's 0.1.19. release-please proposed this because #21 (a manual upstream sync, not a release-please PR) lacked the autorelease: tagged label it uses to find the last release — now added, so v0.2.0 is the anchor.