FastAuth v0.8.0

Added

• scripts/prepare_release.py bumps every version location and rolls the
  changelog's [Unreleased] section into a dated release in one command. It
  refuses to run when there are no notes to release.

• scripts/check_release.py verifies the version agrees across all four files
  it is written in, that the changelog has notes for it, and that no stale
  domains remain. CI runs it on every push and again before publishing.

• CI now lints and builds the documentation site, so a broken docs build fails
  the pull request instead of surfacing on Vercel after merge.

• A one-button Release workflow: it reads the changelog, infers whether the
  change is a patch, minor or major, bumps every version location, tests,
  commits, tags and pushes.

• prepare_release.py infers the bump from the [Unreleased] headings, so the
  version follows from what changed rather than from a judgement call.

• Dependency and security automation: Dependabot for Python, npm and GitHub
  Actions; CodeQL analysis; pip-audit and pnpm audit on every push and
  weekly, so a CVE published against an unchanged dependency is still found.

• Coverage measurement with a regression threshold. Currently 81% overall, with
  the security-critical paths higher: core/auth.py 94%, routers 96%,
  security/ 97-100%.

• tests/test_docs_match_api.py asserts the documented API matches the API
  that exists: the routes the app mounts, the endpoint reference, AGENTS.md,
  and the route count the landing page advertises. Documentation drift is now
  a test failure rather than something noticed later by a user.

• A weekly external link check for the documentation, advisory only so a
  third-party site being briefly unreachable never fails a build.

• tests/test_cli.py covers settings discovery, .env parsing, role
  initialization and superadmin creation. CLI coverage rises from 34% to 74%
  and the project total from 81% to 89%.

Fixed

• The CLI could discover a wrong database URL. A pattern like
  create_engine("sqlite:///" + name) matched the settings regex and yielded
  "sqlite:///" — a URL that looks plausible and points nowhere. The patterns
  now require the string literal to be the complete value, so a concatenated
  expression falls through to importing the module and evaluating it properly.
• A .env file could override the real environment. SECRET_KEY set in a
  deployment was silently replaced by a stale .env shipped in the image,
  signing every token with the wrong key. The real environment now always
  wins, and .env fills in only what is missing.
• Removed an unused import from exceptions.py.
• The CI consistency job failed on every dependency-update pull request. Its
  changelog check diffed against the base branch with a three-dot range, which
  needs a merge base that the default shallow clone does not fetch. The job now
  checks out full history, the check is advisory and cannot fail a build, and
  dependency bumps skip it entirely.

Changed

• Every workflow now declares least-privilege permissions, so CI jobs get a
  read-only token instead of inheriting the repository default.
• The publish workflow validates the release before publishing rather than
  after, so a missing changelog section stops the release instead of producing
  one with empty notes.
• The publish workflow now runs the full Python 3.10-3.14 matrix rather than
  3.12 alone. A tag can point at a commit that never went through pull-request
  CI, so this is the only guarantee that what ships runs everywhere it claims.

Upgrading

No action needed for most projects, but one behaviour changed deliberately:

A .env file no longer overrides real environment variables. Previously a
.env value won; now the environment does, and .env fills in only what is
missing. This matches dotenv tooling elsewhere and closes a real hazard, where
a stale .env in a deployed image silently replaced the production
SECRET_KEY.

If you relied on .env taking precedence, unset the variable in the
environment instead, or pass the value explicitly with --secret-key /
--db-url.