v0.3.0

Changelog

• f08f21c Scope the ENVOKE_* variables, add disable/enable and reload, and work through the rest of the review (#17)

Install / upgrade

• Homebrew (macOS/Linux): brew install neirda24/tap/envoke, or brew upgrade envoke if already installed.
• Scoop (Windows): scoop bucket add neirda24 https://github.com/Neirda24/scoop-bucket, then scoop install envoke, or scoop update envoke if already installed.
• Debian/Ubuntu: download the .deb from the Assets above and sudo dpkg -i envoke_*.deb.
• Fedora/RHEL: download the .rpm from the Assets above and sudo rpm -i envoke_*.rpm.
• Manual download: grab the archive for your OS/arch from the Assets above, extract it, and put envoke on your PATH. Verify against checksums.txt.
• Go toolchain: go install github.com/Neirda24/envoke/cmd/envoke@v0.3.0

Verifying releases

Each archive ships an SPDX SBOM alongside it (*.sbom.json), generated by syft and hashed in checksums.txt like every other asset — so it inherits the signature below.

checksums.txt is signed keylessly with cosign via GitHub Actions OIDC (Sigstore/Fulcio) — no long-lived signing key exists. checksums.txt.sigstore.json (in Assets above) bundles the signature, signing certificate, and Rekor transparency-log entry. Verify with:

cosign verify-blob checksums.txt \
  --bundle checksums.txt.sigstore.json \
  --certificate-identity-regexp "^https://github\.com/Neirda24/envoke/\.github/workflows/release\.yml@.*$" \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

A successful verification proves checksums.txt (and, transitively, every archive it hashes) was built and signed by this repository's own release.yml workflow, not tampered with in transit.

v0.2.0

Changelog

• ed774fe Update dagger pipeline images (#11)
• 4a26661 Add "envoke vs. direnv" comparison page to the docs site (#16)
• d13c8d4 Update dependency mkdocs-material to v9.7.7 (#12)
• 2d926f5 Fix autofix PR push via peter-evans/create-pull-request (#14)
• 7b63c4f Fix a command injection and a trust TOCTOU, and work through the rest of the review (#15)
• 7504470 Apply zizmor/actions-up autofix (#13)
• e18a00a Update dependency yamllint to v1.38.0 (#10)
• 4b18aa4 Add uninstall documentation per install method (#9)

Install / upgrade

• Homebrew (macOS/Linux): brew install neirda24/tap/envoke, or brew upgrade envoke if already installed.
• Scoop (Windows): scoop bucket add neirda24 https://github.com/Neirda24/scoop-bucket, then scoop install envoke, or scoop update envoke if already installed.
• Debian/Ubuntu: download the .deb from the Assets above and sudo dpkg -i envoke_*.deb.
• Fedora/RHEL: download the .rpm from the Assets above and sudo rpm -i envoke_*.rpm.
• Manual download: grab the archive for your OS/arch from the Assets above, extract it, and put envoke on your PATH. Verify against checksums.txt.
• Go toolchain: go install github.com/Neirda24/envoke/cmd/envoke@v0.2.0

Verifying releases

Each archive ships an SPDX SBOM alongside it (*.sbom.json), generated by syft and hashed in checksums.txt like every other asset — so it inherits the signature below.

checksums.txt is signed keylessly with cosign via GitHub Actions OIDC (Sigstore/Fulcio) — no long-lived signing key exists. checksums.txt.sigstore.json (in Assets above) bundles the signature, signing certificate, and Rekor transparency-log entry. Verify with:

cosign verify-blob checksums.txt \
  --bundle checksums.txt.sigstore.json \
  --certificate-identity-regexp "^https://github\.com/Neirda24/envoke/\.github/workflows/release\.yml@.*$" \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

A successful verification proves checksums.txt (and, transitively, every archive it hashes) was built and signed by this repository's own release.yml workflow, not tampered with in transit.

v0.1.4

Changelog

• d7cf292 Add Scoop bucket and .deb/.rpm (nfpm) packaging (#8)
• fb2fdf8 Add root .gitattributes to normalize line endings to LF (#7)
• 9952c38 Add issue/PR/discussion templates, breaking-change policy, and YAML lint (#6)

Install / upgrade

• Homebrew (macOS/Linux): brew install neirda24/tap/envoke, or brew upgrade envoke if already installed.
• Scoop (Windows): scoop bucket add neirda24 https://github.com/Neirda24/scoop-bucket, then scoop install envoke, or scoop update envoke if already installed.
• Debian/Ubuntu: download the .deb from the Assets above and sudo dpkg -i envoke_*.deb.
• Fedora/RHEL: download the .rpm from the Assets above and sudo rpm -i envoke_*.rpm.
• Manual download: grab the archive for your OS/arch from the Assets above, extract it, and put envoke on your PATH. Verify against checksums.txt.
• Go toolchain: go install github.com/Neirda24/envoke/cmd/envoke@v0.1.4

Verifying releases

checksums.txt is signed keylessly with cosign via GitHub Actions OIDC (Sigstore/Fulcio) — no long-lived signing key exists. checksums.txt.sigstore.json (in Assets above) bundles the signature, signing certificate, and Rekor transparency-log entry. Verify with:

cosign verify-blob checksums.txt \
  --bundle checksums.txt.sigstore.json \
  --certificate-identity-regexp "^https://github\.com/Neirda24/envoke/\.github/workflows/release\.yml@.*$" \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

A successful verification proves checksums.txt (and, transitively, every archive it hashes) was built and signed by this repository's own release.yml workflow, not tampered with in transit.

v0.1.3

Changelog

• fcd3b4e Fix deprecated app-id input on create-github-app-token
• 892e580 Revert "Document the GitHub App migration in SECURITY.md"
• ddf9214 Document the GitHub App migration in SECURITY.md

Install / upgrade

• Homebrew (macOS/Linux): brew install neirda24/tap/envoke, or brew upgrade envoke if already installed.
• Manual download: grab the archive for your OS/arch from the Assets above, extract it, and put envoke on your PATH. Verify against checksums.txt.
• Go toolchain: go install github.com/Neirda24/envoke/cmd/envoke@v0.1.3

Verifying releases

checksums.txt is signed keylessly with cosign via GitHub Actions OIDC (Sigstore/Fulcio) — no long-lived signing key exists. checksums.txt.sigstore.json (in Assets above) bundles the signature, signing certificate, and Rekor transparency-log entry. Verify with:

cosign verify-blob checksums.txt \
  --bundle checksums.txt.sigstore.json \
  --certificate-identity-regexp "^https://github\.com/Neirda24/envoke/\.github/workflows/release\.yml@.*$" \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

A successful verification proves checksums.txt (and, transitively, every archive it hashes) was built and signed by this repository's own release.yml workflow, not tampered with in transit.

v0.1.2

Changelog

• 319e61f Overhaul contributor and user-facing docs for accuracy and tone
• d5dfbab Document allow's confirm prompt, diff-on-reallow, and envoke version
• 903c6c3 Show a diff instead of a full re-dump when re-allowing a changed config
• 09770ae Merge feature 1: explicit confirm gate on envoke allow
• cc36942 Make envoke allow actually confirm before trusting a config
• 712225e Merge feature 5: wire up envoke version with real build info
• def1127 Wire up version/commit/date ldflags for release builds
• 8ccbe94 Merge feature 2: persist approved config content in trust store
• 670d660 Persist approved config content in the trust store for diff-on-allow
• 546fa51 Replace broad-scope PAT with a scoped GitHub App token for homebrew-tap

Install / upgrade

• Homebrew (macOS/Linux): brew install neirda24/tap/envoke, or brew upgrade envoke if already installed.
• Manual download: grab the archive for your OS/arch from the Assets above, extract it, and put envoke on your PATH. Verify against checksums.txt.
• Go toolchain: go install github.com/Neirda24/envoke/cmd/envoke@v0.1.2

Verifying releases

checksums.txt is signed keylessly with cosign via GitHub Actions OIDC (Sigstore/Fulcio) — no long-lived signing key exists. checksums.txt.sigstore.json (in Assets above) bundles the signature, signing certificate, and Rekor transparency-log entry. Verify with:

cosign verify-blob checksums.txt \
  --bundle checksums.txt.sigstore.json \
  --certificate-identity-regexp "^https://github\.com/Neirda24/envoke/\.github/workflows/release\.yml@.*$" \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

A successful verification proves checksums.txt (and, transitively, every archive it hashes) was built and signed by this repository's own release.yml workflow, not tampered with in transit.

v0.1.1

Changelog

• c0f2281 Fix release.yml: correct Dagger CLI flag names for Publish's OIDC params
• fa13d21 Merge branch 'main' of github.com:Neirda24/envoke
• 79dfc6e Check in a reusable zero-skip shellinit verification script
• f73d087 Harden release chain: sign checksums.txt, document PAT/quarantine tradeoffs
• 8c3b977 Add zsh/fish/powershell behavioral shell-hook tests
• d122ad6 Show config script before trust, warn on unsafe config permissions
• 96f85c9 Merge pull request #5 from Neirda24/renovate/major-dagger-pipeline-images
• e643879 Update Node.js to v24
• aadc8d7 Authenticate zizmor/actions-up in CI to fix rate-limit failures
• b253782 Merge pull request #3 from Neirda24/renovate/dagger-pipeline-images
• ffc041f Disable Renovate for .dagger/go.mod
• a45f86a Update dagger pipeline images
• ade96fb Add Renovate config and a daily zizmor/actions-up autofix workflow
• 83a26ba Fix ci.yml: use dagger-for-github's check input, not call: check
• 79f76ed Add zizmor and actions-up CI maintenance, wire dagger check into GitHub Actions
• a458d0f Note old Formula/envoke.rb cleanup in homebrew-tap
• cdd2ff0 Document v0.1.0 reset and regeneration with casks + footer

Install / upgrade

• Homebrew (macOS/Linux): brew install neirda24/tap/envoke, or brew upgrade envoke if already installed.
• Manual download: grab the archive for your OS/arch from the Assets above, extract it, and put envoke on your PATH. Verify against checksums.txt.
• Go toolchain: go install github.com/Neirda24/envoke/cmd/envoke@v0.1.1

Verifying releases

checksums.txt is signed keylessly with cosign via GitHub Actions OIDC (Sigstore/Fulcio) — no long-lived signing key exists. checksums.txt.sigstore.json (in Assets above) bundles the signature, signing certificate, and Rekor transparency-log entry. Verify with:

cosign verify-blob checksums.txt \
  --bundle checksums.txt.sigstore.json \
  --certificate-identity-regexp "^https://github\.com/Neirda24/envoke/\.github/workflows/release\.yml@.*$" \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

A successful verification proves checksums.txt (and, transitively, every archive it hashes) was built and signed by this repository's own release.yml workflow, not tampered with in transit.

v0.1.0

Changelog

• 8474ba0 Add install/upgrade instructions to release notes footer
• a73c2b4 Migrate Homebrew tap from deprecated brews to homebrew_casks
• 21e8808 Document release CI wired up and verified against v0.1.0
• 2254bf6 Pin dagger-for-github to v8.4.1
• e29838b Add release CI: tag-triggered goreleaser publish via Dagger
• 16bc66d Add Dagger function to preview docs without installing Python
• c400069 Add MkDocs Material docs site, deployed to GitHub Pages
• a32716e Start MVP step 7: goreleaser-based build/publish via Dagger
• f6b8c97 Add Dagger CI pipeline: checks + shell test matrix
• bb422a8 Implement MVP step 5: fish/tcsh/powershell shell integration
• ec4e026 Implement MVP step 4: envoke debug dry-run diagnostics
• d5b4220 Implement MVP step 3: envoke allow trust mechanism
• bd87852 Make CONTRIBUTING.md verification steps unambiguous
• 43db6cf Add MIT LICENSE and CONTRIBUTING.md
• e48df68 Implement MVP step 1: config parser, path matcher, executor
• b498b10 Add README and CLAUDE.md for the envoke MVP

Install / upgrade

• Homebrew (macOS/Linux): brew install neirda24/tap/envoke, or brew upgrade envoke if already installed.
• Manual download: grab the archive for your OS/arch from the Assets above, extract it, and put envoke on your PATH. Verify against checksums.txt.
• Go toolchain: go install github.com/Neirda24/envoke/cmd/envoke@v0.1.0