🍄 Envilder level up v0.20.0: validate checks remote secrets

envilder validate now checks that every secret declared in your map file exists in the provider, without reading any value. This release also stops text from outside from issuing GitHub Actions workflow commands through the logs of the Action and of envilder exec.

✨ envilder validate checks that every secret exists

envilder validate

Without --offline, validate asks the provider whether each secret path in the map file exists and lists every variable with its path and status: exists, missing, access denied (never reported as missing), authentication failed or provider error. A path shared by several variables is checked once (#558, #637).

• It ends with ✓ All N secrets exist and exit code 0, or with a summary such as ✗ Validation failed: 2 missing, 1 access denied and exit code 1.
• An invalid map file fails with the offline result, and no provider is called.
• Expired credentials and SSO sessions show the same message as a pull, including the aws sso login recovery on a terminal.
• AWS SSM is checked with GetParameters in batches of ten and WithDecryption: false, which needs ssm:GetParameters.
• Azure Key Vault lists the vault's secret metadata once, which needs the List secret permission (access policies) or secrets/readMetadata (Azure RBAC, included in Key Vault Secrets User).

📖 Validate guide: docs/validate-command.md

🔒 Security

• Logs can no longer issue GitHub Actions workflow commands. The GitHub Action and envilder exec (when GITHUB_ACTIONS=true) now write each message as one inert line: CR/LF are escaped, and a leading :: and the legacy ##[ marker are neutralized. Before, an env-file name or a rejected secret reference that contained a newline could emit ::stop-commands::, after which the ::add-mask:: registrations that follow would print secret values as plain output, or could forge annotations (#629).
• The website's trailing-slash redirect stays on its own origin. A request for //host could answer with Location: //host/, which browsers resolve as another host. Leading slashes and backslashes are now collapsed to one / (#629).

The GitHub Action gains the existence check in its provider adapters for the CLI's validate, and does not use it. Its pull flow, inputs and outputs are unchanged.

📦 Upgrade

- uses: macalbert/envilder@v0.20.0
  with:
    map-file: envilder.json
    env-file: .env

npm install -g envilder@0.20.0

📖 Getting started: envilder.com/docs/getting-started

All changes in this release

• feat(cli): check that every declared remote key exists with envilder validate by @macalbert in #637
• build(deps): pin biome to 2.5.14 to avoid the language server crash by @macalbert in #638
• fix: keep website redirects on origin and Action logs free of workflow commands by @macalbert in #629
• chore(release): release CLI 0.20.0 with the remote key check by @macalbert in #640

Full Changelog: v0.19.0...v0.20.0