v0.8.0

What's Changed

• Harden machine summaries: reconcile .git check, dry-run drift fail-safe, doctor version floor by @redscaresu in #61
• workspaces: accept day/week sugar for --older-than (7d, 2w) by @redscaresu in #62

Full Changelog: v0.7.0...v0.8.0

v0.7.0

What's Changed

• docs: add CONTRIBUTING.md by @redscaresu in #49
• docs: add OpenSSF Best Practices passing badge by @redscaresu in #50
• apply: honest dry-run status digest (WS1 of #48) by @redscaresu in #51
• cmd: global --quiet/-q machine mode for agents (WS2 of #48) by @redscaresu in #52
• cmd: compact machine JSON under --quiet (WS4 of #48) by @redscaresu in #53
• cmd: structured single-line failures under --quiet (WS5 of #48) by @redscaresu in #54
• cmd: terse select stdout by default, --list to echo names (WS7 of #48) by @redscaresu in #55
• selection: repo-set digest on select/selections surfaces (WS6 of #48) by @redscaresu in #56
• mirror: honest reconciliation in --report-json + captured ghorg log (WS3 of #48) by @redscaresu in #57

Full Changelog: v0.6.0...v0.7.0

v0.6.0

What's Changed

• ci: add CodeQL SAST analysis (raises Scorecard SAST 0→10) by @redscaresu in #46
• release: SLSA build provenance for release binaries (Scorecard Signed-Releases 0→~8-10) by @redscaresu in #47

Full Changelog: v0.5.0...v0.6.0

v0.5.0

What's Changed

• ci: add gosec + staticcheck SAST gate (#40) by @redscaresu in #41
• docs(security): add audit map + threat model to SECURITY.md (#40) by @redscaresu in #42
• test(security): fuzz apply script assembly + tag security invariants (#40) by @redscaresu in #43
• build: reproducible-build verify recipe (make repro) (#40) by @redscaresu in #44
• ci: change-process integrity + OpenSSF Scorecard attestation (#40) by @redscaresu in #45

Full Changelog: v0.4.0...v0.5.0

v0.4.0

What's Changed

• docs+e2e: workspaces coverage, honest same-set wording, drop IMPLEMENTATION.md by @redscaresu in #38
• apply: enforce confirm + sign invariants at the execution boundary by @redscaresu in #39

Full Changelog: v0.3.0...v0.4.0

v0.3.0

What's Changed

• ci: Homebrew-install e2e deps + post-release formula smoke test by @redscaresu in #24
• ci: add zizmor supply-chain gate and harden all workflows by @redscaresu in #25
• docs(guide): add brew install path to the operator playbook by @redscaresu in #26
• feat(#27): agent ergonomics — doctor preflight, JSON surfaces, git-free config read by @redscaresu in #31
• mirror(#15): authoritative reconciliation line + pinned clone layout by @redscaresu in #32
• guide(#30): machine-readable capabilities catalogue via guide --json by @redscaresu in #33
• schema(#27 §4): JSON Schema for the lockfile and every machine payload by @redscaresu in #34
• feat(workspaces): list/prune snapshot workspaces + mirror sidecar manifest (#29) by @redscaresu in #36
• release: fix matrix create-race + generated release notes by @redscaresu in #37

Full Changelog: v0.2.1...v0.3.0

v0.2.1

Makes apply --sign a required, explicit trust decision (local | github | none); adds a machine-readable mirror report + lockfile schema v2 and shallow-clone guards; ships a one-line installer and a Homebrew tap.

What's Changed

• release: emit combined SHA256SUMS; AGENTS.md: note --purpose snapshots by @redscaresu in #13
• feat(apply): required --sign mode (local | github | none) by @redscaresu in #16
• feat(mirror): guard --branch+shallow, machine-readable stdout (#15 B/D/E) by @redscaresu in #17
• feat(mirror): machine-readable report + lockfile schema v2 (#15 C) by @redscaresu in #18
• apply/docs: land verified --sign=local note, drop Non-goals, tighten README by @redscaresu in #19
• build(deps): bump the actions group across 1 directory with 4 updates by @dependabot[bot] in #1
• docs/install: one-line installer, Homebrew tap, agent-adoption snippet by @redscaresu in #20
• README: dedup auth/token story and agent framing by @redscaresu in #22
• homebrew: shorten formula desc under audit's 80-char limit by @redscaresu in #23

New Contributors

• @dependabot[bot] made their first contribution in #1

Full Changelog: v0.2.0...v0.2.1

v0.2.0

Adds mirror --branch and millisecond-stamped --purpose snapshot workspaces, and collapses CLAUDE.md into a single AGENTS.md source of truth.

What's Changed

• docs: point Install at the v0.1.0 prebuilt binaries by @redscaresu in #11
• mirror: --branch + millisecond --purpose workspaces; collapse CLAUDE.md into AGENTS.md by @redscaresu in #12

Full Changelog: v0.1.0...v0.2.0

v0.1.0

First tagged release of goldfinger — an orchestration layer for fleet-wide GitHub work.

goldfinger resolves a repo selection (by org/user + topic), freezes it as a reviewable lockfile, then delegates: ghorg mirrors the selection locally, multi-gitter applies a change and opens PRs across it. The lockfile is authoritative, so the repos you mirror and the repos you change are provably the same set.

Commands

• select — resolve an owner's repos by topic and freeze them as a selection lockfile (read-only REST).
• mirror — clone the selection locally via ghorg.
• apply — run a change across the selection and open PRs via multi-gitter (dry-run by default; a real run needs --dry-run=false --confirm).
• check — re-run discovery from the selection's own frozen filter and report drift (added / removed / default-branch-moved / owner-type-changed); read-only, exit 0 in sync · 1 drift · 2 error.

Install

Download the binary for your platform below, or go install github.com/redscaresu/goldfinger/cmd@v0.1.0. Verify with shasum -a 256 -c SHA256SUMS. Auth uses your local gh session automatically, or set GOLD_FINGER_PAT (e.g. in CI). ghorg and multi-gitter must be on PATH for mirror/apply.