github.com/faustbrian/go-config v1.1.0

Adds the canonical target-oriented adapters/service import path while retaining configservice as an API-compatible facade for independent migration.

github.com/faustbrian/go-config v1.0.0

1.0.0 - 2026-08-25

Changed

• Exclude intentional nested modules from root local-proxy archives so local,
  bootstrap, CI, and public module checksums describe the same source
  boundary.

• Track the pinned documentation-tool lockfile so clean CI checkouts install
  the exact validated cspell dependency.

• Reconcile standalone dependency checksums against deterministic current
  module archives so CI, local verification, and release consumers resolve
  identical content.

• Harden standalone documentation validation with deterministic spelling and
  link checks, package-specific documentation gates, and repository-local
  contributor guidance.

Documentation

• Replace obsolete standalone-repository links and workflow claims with
  monorepo-canonical targets and current release guidance.

• Link the package README to the repository-wide Golib documentation portal.

Changed

• Publish the module from its standalone github.com/faustbrian/go-config identity while preserving its documented API and behavior.

• Replace obsolete owned-module pseudo-version pins with the monorepo's local
  v0.0.0 source-proxy coordinates; release tooling continues to emit exact
  v1.0.0 dependency versions.

• Remove unused CLI-related indirect dependencies from canonical module
  metadata.

• Pin owned sibling modules to exact resolvable main pseudo-versions so
  standalone and clean external consumers use immutable dependency content.

• Unsigned typed defaults and environment or dotenv values within the signed
  integer range now use the same canonical numeric representation as JSON,
  YAML, and TOML sources, allowing equivalent higher-precedence values to
  override them without a false type conflict.

• Replaced obsolete package-local workflow references with the authoritative
  root CI matrix and its canonical per-module quality contract.

• Optional filesystem-backed sources now recognize missing files returned by
  os.DirFS without invoking extension-defined error callbacks.

Added

• A configservice adapter that supplies typed, validated configuration to a
  selected service command before component construction, with explicit local
  dotenv and process-environment precedence.
• Typed immutable configuration plans and snapshots with safe provenance.
• Strict JSON, YAML, TOML, dotenv, environment, filesystem, defaults, and
  programmatic sources.
• Explicit bounded discovery, merge semantics, validation, optional values,
  redacted secrets, byte sizes, test helpers, fuzzing, race tests, and
  benchmarks.
• Exact coverage, compatibility, security, documentation, and release gates.
• Canonical source-tree enforcement, private mutable-state rejection, and
  secret-safe cause wrappers across every public parser and conversion error.
• Runnable source-composition examples plus filesystem and discovery fuzz
  targets for paths, policies, symlinks, permissions, and malformed data.
• Redacted custom-source and oversized numeric failures, plus deterministic
  cycle, depth, key-count, array-element, and cancellation guards for source
  trees and typed schemas.
• Complete precedence/merge permutation evidence and a structured-format
  conformance matrix with executable intentional-difference cases.
• ErrSourceChanged, context-aware filesystem/decode extension contracts, and
  generation checks for fail-closed reads under concurrent mutation.
• Diagnostic JSON/log canary coverage that seals arbitrary causes, plus
  Windows-compatible filtering of unrelated process-environment names.
• Exact case-sensitive discovery containment with filesystem-identity boundary
  checks, plus default rejection of Windows junction and mount-point reparse
  traversal.
• Required hardening traceability from every audit contract to executable
  evidence, including all 13,699 non-empty precedence subset permutations.
• A configtest.DiffSecrets assertion helper for value-aware diffs that never
  expose either secret operand.
• Explicit conformance assertions that decoding, defaults, environment
  loading, metadata, and snapshot cloning do not mutate private struct state.

Release integrity

• Source commit: f387615c2d8a78e734ca3109fb279ef296537bb8
• Exact-head CI: https://github.com/faustbrian/go-config/actions/runs/32907442730
• Release dry-run: urn:sha256:6aee4f0b253dc726ea6891e1090267b374b24b2876531d180806fd757a3aa529
• Assets include a CycloneDX SBOM, SLSA v1 in-toto provenance, and SSH-signed checksums.

Verify the checksum attestation with:

ssh-keygen -Y verify -f ALLOWED_SIGNERS -I brian@cline.sh -n golib-release -s SHA256SUMS.sig < SHA256SUMS

github.com/faustbrian/go-config/adapters/awssecretsmanager v1.0.0

1.0.0 - 2026-08-25

Documentation

• Link the package README to the repository-wide Golib documentation portal.

Changed

• Publish the module from its standalone github.com/faustbrian/go-config/adapters/awssecretsmanager identity while preserving its documented API and behavior.
• Replace the obsolete owned-module pseudo-version pin with the monorepo's
  local v0.0.0 source-proxy coordinate; release tooling continues to emit
  the exact v1.0.0 dependency version.

Added

• A bounded, secret-safe AWS Secrets Manager JSON configuration source with
  explicit version selection, optional-source semantics, and caller-owned AWS
  default credential-chain composition.

No release has been published.

Release integrity

• Source commit: f387615c2d8a78e734ca3109fb279ef296537bb8
• Exact-head CI: https://github.com/faustbrian/go-config/actions/runs/32907442730
• Release dry-run: urn:sha256:89a038e5f52967b2f337b1b5ee1e11b06f23c22d218fb383cc093d1e9cd4cd4f
• Assets include a CycloneDX SBOM, SLSA v1 in-toto provenance, and SSH-signed checksums.

Verify the checksum attestation with:

ssh-keygen -Y verify -f ALLOWED_SIGNERS -I brian@cline.sh -n golib-release -s SHA256SUMS.sig < SHA256SUMS