go-cfenv v1.20.0

Release v1.20.0

[Features]

• Service.Credential(keys ...string) reads a credential at any depth and returns it with its own type, so nested values like protocols.amqp.uri and non-string leaves like protocols.amqp.ssl are reachable. Passing the keys separately means every key is addressable, including one containing a dot such as jdbc.url. (#23)
• Service.CredentialPath("protocols.amqp.uri") is the dot-delimited form of the same lookup. It cannot address a key that itself contains a dot — use Credential for those.

[BugFixes]

• Pinned the credentials payload from #11, whose nested object once panicked the decoder, as a regression test. The defect was already fixed; the test keeps it fixed.

[Chores]

• Release notes are now assembled from per-PR changelog.d/ fragments into the annotated tag body, so cutting a release no longer requires hand-editing a notes file. CHANGELOG.md is removed; notes for v1.19.1 and earlier remain in the GitHub releases.
• The CI security job installs gitleaks with make install-gitleaks — a pinned, checksum-verified download from the shared make snippets — replacing the download step that was inlined in the workflow.
• Added a make actionlint target that lints the GitHub Actions workflow files, auto-installing actionlint on demand. It is part of make check and runs as its own step in the CI quality-gates job.