v0.6.2

Corrected re-release of the withdrawn v0.6.1 — identical code plus the
version bump v0.6.1 was missing and a release-workflow guard that makes
the mistake impossible to repeat (the tag now refuses to build unless
Cargo.toml matches it).

Fixes:

• nvm is now detected via its filesystem marker
  (${NVM_DIR:-$HOME/.nvm}/nvm.sh) instead of shell probes. nvm is a
  shell function, not a binary, so the previous PATH lookup and
  bash -lc probes could never see it — every jarvy setup with nvm
  in the config re-downloaded and re-ran the installer, and the version
  check reported nvm as needing install forever. Detection now converges
  after one install, and jarvy upgrade node correctly suggests
  nvm install when node is nvm-managed. (Windows is unaffected:
  nvm-windows is a real binary.)

Internal:

• CI action bumps (Dependabot): actions/checkout 4→7,
  actions/download-artifact 7→8, actions/setup-java 4→5,
  azure/setup-helm 4.3.0→5.0.1, docker/setup-buildx-action 3→4.
  The release-critical ones were smoke-validated by dispatch runs
  before this release.

This is also the first release upgradable to via
jarvy update --method binary from v0.6.0 — the redirect fix shipped in
v0.6.0 makes the updater work going forward (upgrading from v0.5.x
still requires the install script or a package manager).

Full Changelog: v0.6.1...v0.6.2

Installation

Quick Install (Unix)

curl -fsSL https://raw.githubusercontent.com/Cliftonz/jarvy/main/dist/scripts/install.sh | bash

Quick Install (Windows PowerShell)

irm https://raw.githubusercontent.com/Cliftonz/jarvy/main/dist/scripts/install.ps1 | iex

Homebrew

brew install Cliftonz/tap/jarvy

Cargo

cargo install jarvy

Early-Release Channel

Pre-release tags (-rc.N, -beta.N) are routed through the beta channel.
Opt in: JARVY_CHANNEL=beta on the install script, or jarvy update --channel beta.
See docs/release-testing.md.

See installation docs for more options.

Security

Verify Signatures

All release artifacts are signed with Sigstore keyless OIDC. Verify any artifact:

# Substitute a triple that matches your platform, e.g.
# aarch64-apple-darwin, x86_64-unknown-linux-musl,
# aarch64-unknown-linux-gnu, x86_64-pc-windows-msvc (.zip).
ARTIFACT=jarvy-v0.6.2-x86_64-unknown-linux-musl.tar.gz
BASE=https://github.com/Cliftonz/jarvy/releases/download/v0.6.2
curl -LO $BASE/$ARTIFACT
curl -LO $BASE/$ARTIFACT.sig
curl -LO $BASE/$ARTIFACT.pem
cosign verify-blob \
  --signature $ARTIFACT.sig \
  --certificate $ARTIFACT.pem \
  --certificate-identity-regexp '^https://github\.com/Cliftonz/jarvy/\.github/workflows/release\.yml@refs/tags/v[0-9.]+(-[A-Za-z0-9.]+)?$' \
  --certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
  $ARTIFACT

Tag Signature

This release was cut from a signed git tag. Verify with:

git -c gpg.ssh.allowedSignersFile=.github/allowed_signers tag --verify v0.6.2

SBOM

Software Bill of Materials in SPDX 2.3 (sbom.spdx.json) and CycloneDX 1.4 (sbom.cdx.json).

Checksums

SHA256 checksums for all artifacts are in SHA256SUMS.txt.