2.0.1

What's Changed

• chore(actions): bump actions/download-artifact from 5 to 8 by @dependabot[bot] in #61
• chore(actions): bump actions/upload-artifact from 4 to 7 by @dependabot[bot] in #62
• chore(actions): bump actions/cache from 4 to 5 by @dependabot[bot] in #63
• chore(actions): bump peter-evans/find-comment from 3 to 4 by @dependabot[bot] in #64
• chore(docs): bump mkdocs-include-markdown-plugin from 7.0.0 to 7.1.8 in /docs by @dependabot[bot] in #67
• chore(actions): bump cloudflare/wrangler-action from 3 to 4 by @dependabot[bot] in #68
• chore(actions): bump peter-evans/create-or-update-comment from 4 to 5 by @dependabot[bot] in #69
• chore(actions): bump actions/checkout from 6 to 7 by @dependabot[bot] in #65
• fix: BSD stat in brewup lock check + ignore mkdocs site/ build output by @edjchapman in #70
• fix(secrets): derive GitHub MCP token from gh CLI on main by @edjchapman in #72
• chore(brew): drop 7 manually-removed casks from Brewfile by @edjchapman in #73
• chore(standups): log 2026-06-19 session @ 22:25 by @edjchapman in #71

Full Changelog: 2.0.0...2.0.1

2.0.0

What's Changed

• feat(docs): turbo-charge mkdocs site with comprehensive automation by @edjchapman in #59
• feat(docs): migrate production to Cloudflare Pages with custom domains by @edjchapman in #60

Full Changelog: 1.4.0...2.0.0

1.4.0

What's Changed

• chore(deps): bump pymdown-extensions from 10.11.2 to 10.21.3 in /docs in the pip group across 1 directory by @dependabot[bot] in #56
• demo(bootstrap): stage recording with mac shim, provision vhs by @edjchapman in #57
• chore(standups): log 2026-06-16 session @ 00:40 by @edjchapman in #58

Full Changelog: 1.3.0...1.4.0

1.3.0

What's Changed

• fix(drift): stop counting chezmoi warnings as drifted files by @edjchapman in #46
• feat(zshrc): refresh drift cache after chezmoi apply by @edjchapman in #47
• docs(standups): extend today's log to cover the full second session by @edjchapman in #48
• fix(pre-commit): propagate make-lint and pre-commit exit codes by @edjchapman in #49
• docs: add CONTRIBUTING, CODE_OF_CONDUCT, SECURITY, CHANGELOG by @edjchapman in #50
• feat(.github): issue + discussion templates, CODEOWNERS, FUNDING, ADR-0004 by @edjchapman in #51
• docs(README): rewrite as public-showcase, add branding/demo assets, FAQ, comparison by @edjchapman in #52
• feat(docs): mkdocs-material Pages site at edjchapman.github.io/dotfiles by @edjchapman in #53
• fix(pages): pin mkdocs-material deps for setup-python cache by @edjchapman in #54
• fix(pages): move mkdocs.yml to repo root for canonical layout by @edjchapman in #55

Full Changelog: 1.2.0...1.3.0

1.2.0

What's Changed

• chore: optimise repo for agentic development by @edjchapman in #1
• chore(actions): bump DavidAnson/markdownlint-cli2-action from 17 to 23 by @dependabot[bot] in #2
• chore(actions): bump peter-evans/create-pull-request from 6 to 8 by @dependabot[bot] in #3
• chore(actions): bump actions/setup-python from 5 to 6 by @dependabot[bot] in #4
• chore(actions): bump actions/setup-node from 4 to 6 by @dependabot[bot] in #7
• docs: codify main-branch protection settings by @edjchapman in #9
• chore(actions): bump actions/checkout from 4 to 6 by @dependabot[bot] in #5
• feat: detect drift between $HOME and chezmoi source on the live machine by @edjchapman in #10
• chore(brewfile): replace deprecated tldr with tlrc by @edjchapman in #11
• chore: weekly brew outdated report by @github-actions[bot] in #8
• chore: bump oh-my-zsh pin to e64912e0c1eaa32181c3b5e5e4bf8042ecd0e8a7 by @edjchapman in #6
• fix/gpg path and brewfile extras by @edjchapman in #12
• feat: brew→Brewfile loop via journaled events + interactive sync (1/6) by @edjchapman in #16
• feat: chezmoi-fix as the single remediation entry point (2/6) by @edjchapman in #17
• feat: macOS defaults drift via chezmoi-defaults-audit (3/6) by @edjchapman in #18
• feat: chezmoi-security-audit — FileVault, SIP, firewall, keys, perms (4/6) by @edjchapman in #19
• feat: weekly VS Code + mas health checks; broader brew audit (5/6) by @edjchapman in #20
• feat: --alert mode for clickable remediation from notification (6/6) by @edjchapman in #21
• chore(actions): bump mfinelli/setup-shfmt from 3 to 4 by @dependabot[bot] in #13
• chore: bump oh-my-zsh pin to a07126330b9f56f12f1e00ddd29786d35d6e64d9 by @github-actions[bot] in #15
• chore: declare poppler in Brewfile to clear brew-extra drift by @edjchapman in #22
• feat(git): add git sync alias by @edjchapman in #25
• refactor: collapse day-to-day surface behind 'mac' alias by @edjchapman in #26
• refactor(mac): rework banner + chezmoi-fix UX, add bats harness by @edjchapman in #27
• fix(brew): detect cask vs formula per-name in chezmoi-brew-record by @edjchapman in #28
• chore(actions): bump gitleaks/gitleaks-action from 2 to 3 by @dependabot[bot] in #29
• chore(brewfile): regroup zoom under Productivity by @edjchapman in #30
• feat(ci): validate plist templates with xmllint by @edjchapman in #31
• fix(pre-commit): preserve ggshield exit code so detected secrets block commits by @edjchapman in #32
• feat(defaults-audit): list unreadable entries under --drift by @edjchapman in #33
• docs: add plist XML validation to required-checks list (11 -> 12) by @edjchapman in #34
• chore(brewfile): rename windsurf cask to devin-desktop by @edjchapman in #35
• docs: clarify self-update paths and silent-degradation diagnostic by @edjchapman in #36
• feat(git): make 'git sync' alias squash-merge aware by @edjchapman in #37
• fix(drift): silence brew-extras false positives and ignore oh-my-zsh cache by @edjchapman in #38
• chore(ci): retire update-brew workflow (superseded by local brewup) by @edjchapman in #39
• feat(ci): auto-rebase open PRs when main advances by @edjchapman in #40
• chore(ci): swap GITHUB_TOKEN for BOT_PAT in bot-driven workflows by @edjchapman in #41
• docs(standups): seed daily log + chezmoi-ignore the directory by @edjchapman in #42
• chore: bump oh-my-zsh pin to df34d2b8d575777465aed8ae9b7cd90d63fdcd6e by @github-actions[bot] in #24
• chore: delete orphan brew-outdated report (#39 follow-up) by @edjchapman in #43
• docs(runbook): add 'Back up the age key' section by @edjchapman in #45
• chore(secrets): rotate age recipient key by @edjchapman in #44

New Contributors

• @edjchapman made their first contribution in #1
• @dependabot[bot] made their first contribution in #2
• @github-actions[bot] made their first contribution in #8

Full Changelog: 1.1.0...1.2.0

1.1.0

CI/CD Pipeline

Adds automated validation for chezmoi templates and shell scripts.

What's new

• GitHub Actions CI workflow — Runs on push to main and on pull requests
• Makefile — Unified make lint target for local and CI use
• Template validation — Chezmoi templates verified with --override-data to inject required template variables without interactive prompts
• CI badge added to README

Fixes

• Iterative fixes to CI template validation: progressed from --dry-run to execute-template --source to the final --override-data approach for reliable headless runs

1.0.0

Initial Public Release

Full macOS dotfiles management with chezmoi, covering automated provisioning, security hardening, and developer tooling.

Highlights

• Chezmoi-managed dotfiles — Brewfile, shell config, gitconfig, and macOS defaults all templated and version-controlled
• macOS automation — Dock layout, Finder preferences, keyboard/trackpad settings, screenshots, Touch ID sudo, and energy settings applied via scripts
• Security hardening — macOS privacy & security defaults, GPG commit signing, age encryption for secrets, ggshield pre-commit hooks, restricted file permissions, and HIST_IGNORE_SPACE
• Privacy stack — Brave browser, DuckDuckGo search, NordVPN, LuLu outbound firewall, ProtonMail, 2FA checklist
• Developer tooling — Oh-my-zsh (pinned external), GNU/modern CLI tools, architecture-aware gitconfig credential helpers, Claude Code config via chezmoi symlinks
• Brewfile audit — Updated versions, replaced deprecated packages, removed 18 unused apps
• Documentation — Full setup README with design principles, repo structure, step-by-step provisioning guide, and GPG key instructions
• MIT license for public release