v0.2.0

0.2.0 (2026-09-05)

ci

• dependabot: add path monitoring for mise toolchain config (ebc7227)
• deps: remove MISE_SKIP_CHECKSUM workaround (0a80645)

🚀 Features

• add advanced general commands (cache, generate) and silent/no-config flags (cf37c1c)
• add config placeholder and update edit command to use it (36ab555)
• add df, edit, and implode generic commands (a733069)
• add generate manpage command to CLI (4f95703)
• add multi-os docker support (e12e9ed)
• add rocket icon to performance workflow name (e6a6146)
• add SQLite transaction manager for atomic multi-repo operations (c04dd2f)
• add support for riscv64, ppc64le, loong64, and s390x architectures in install script (26d48f0)
• add UNIRTM_HOOK_ALLOW_MISSING=1 to .unirtm.toml (a1ceab9)
• align df command with unirtm pterm implementation (0658356)
• align env command with pterm interactive output (fa7363d)
• align generate command with unirtm implementation (f143f2b)
• align implode command with UniRTM (ab558d3)
• align version command with UniRTM (fb53d44)
• archive: add ExtractArchive to support extracting entire archives to a directory (37bddb9)
• archive: add xz compression support (0ac0329)
• archive: implement symlinks, hardlinks, and best-effort uid/gid chown restoration (3e69a82)
• archive: modularize archive package with compression support (12fcc4a)
• archive: preserve file modification timestamps during compression and extraction (ca911cf)
• archive: support injecting advanced metadata (PAX, Zip Comment, Uid/Gid) during compression (e916786)
• cd: sync release orchestration enhancements from base repo (b00fee8)
• ci: add centralized Harden Runner endpoints configuration (5389a6e)
• ci: add GitHub API rate limit info to summary reports (8c4293a)
• ci: enable auto-merge for ALL dependabot updates including major (9c8bae2)
• ci: improve release-please configuration and remove fixed version (e1fcd64)
• ci: sync Harden Runner endpoints from centralized config (48b4221)
• cli: align global flags with UniRTM (02a3d8f)
• cli: enhance completion command with auto-detect and install (680cb47)
• cli: enhance doctor with proactive system environment checks (853677c)
• cli: port and adjust doctor command from UniRTM (67a4e8a)
• cli: port cache command from UniRTM with SQLite support (c941bad)
• cli: remove unused generate command (b0828ab)
• cli: remove unused license command and internal addlicense module (a961e45)
• cmd: add support for bzip2, xz, zstd, and lz4 archives in self-update (b688cd8)
• cmd: enhance self-update with checksum verification and smart archive extraction (ad0a163)
• core: atomic integration of GPG, Pterm logging and test coverage (c92795e)
• deps: consolidate all dependabot updates into single PR (e753902)
• deps: optimize dependabot configuration and grouping strategy (900f3af)
• devcontainer: add volume cache for osv-scanner (95891da)
• devcontainer: add volume cache for trivy (9f931a1)
• devcontainer: add vscode extension customizations for auto-installation (efae646)
• devcontainer: forward common development and web ports (35ff5f6)
• docker: add docker-compose file detection for hadolint and dockerfile-utils (836880d)
• enable remote.SSH.allowLocalServerDownload to improve connection reliability (8a6c80d)
• implement lightweight doctor, config, cache, and generate commands (ab5863e)
• implement TOML and YAML parsing via go-toml/v2 and yaml.v3 (50c0b2d)
• initialize unigo go module and basic cobra structure (1f987db)
• integrate slog and wire up with debug and quiet flags (beffd4c)
• lint: add two-pass auto-fix mechanism to make lint (9fba0f1)
• make: add sync-harden-runner target for workflow endpoint management (d24708d)
• port completion command (37c7b94)
• port database infrastructure and cgo-free sqlite driver (e2dde4f)
• port download infrastructure module from unirtm (0392664)
• port env command (11a6d81)
• port envpath and version infrastructure modules from unirtm (dd30534)
• port errors package from unirtm for robust categorization and exit codes (db2dbd9)
• port gpg verification infrastructure module from unirtm (68d0fff)
• port http client and utils modules from unirtm for solid foundation (d67ebb3)
• port internal env package from unirtm (0ca1202)
• port internal/updater with pterm and wire into root cmd (d1379bb)
• port license command (f82a5b1)
• port license management tool from unirtm (b063334)
• port missing general commands (doctor, config) and global flags (--cd, --verbose, --yes, --jobs) from unirtm (84864df)
• port self-update command (ba0c607)
• port sysinfo and global command flags (adc2585)
• port version command (a246ec8)
• pypi: implement multi-architecture python wheel packaging (59c1e4a)
• release: add separate-pull-requests for future manifest mode (a543dde)
• release: configure extra-files to auto-update docker.yml version (585003e)
• release: enable manifest mode and native component support (8bfe724)
• release: revert manifest mode to global versioning (6eeeaa3)
• release: switch docker.yml version updates to x-release-please marker mode (7e25e93)
• scripts: add tool to remove Windows wrapper scripts (5bfd3ef)
• security: add CDN and download mirror endpoints to harden runner (3ff8a5d)
• security: add DockerHub endpoints to harden runner (48b6416)
• security: add sigstore wildcard endpoint to harden runner (2e26b98)
• trigger release 0.2.0 (cfed56b)
• update vscode settings with enhanced editor, explorer, and terminal configurations (44230bc)
• updater: force github proxy prefix on asset downloads to ensure stability (e403747)

🐛 Bug Fixes

• archive: preserve file permissions during compression (b4605c6)
• cd: delete remote tag before re-push to trigger downstream docker build (be75906)
• cd: disable persist-credentials to ensure WORKFLOW_SECRET PAT is used for tag push (bedf7bf)
• ci: adapt docker build workflow and context for golang project (2c8f487)
• ci: add GITHUB_TOKEN to all make commands for API rate limit prevention (2060bca)
• ci: add missing endpoints for trivy and sigstore (115a19d)
• ci: detect docker-compose files in dependabot generator (530ca75)
• ci: disable gpg signing and sync unirtm lockfile (cf1ef48)
• ci: disable gpg signing in workflow commit steps (43f266e)
• ci: disable shellcheck integration in actionlint to prevent Windows hang (1d711d8)
• ci: ensure npm install includes devDependencies in pages workflow (4795ca3)
• ci: explicitly specify checkmake mise tool spec to avoid aqua registry lookup (acefebb)
• ci: remove unsupported signoff parameter and add release-as 0.5.0 (d01b2df)
• ci: replace head -n -1 with sed for macOS compatibility (67aaa95)
• ci: resolve Docker Buildx container restart race condition (01a1c2d)
• ci: restrict release-please to main branch only (0db8a91)
• ci: skip DCO check for snowdream user in release-please PRs (dde607b)
• ci: use GITHUB_TOKEN for release-please to prevent tag creation issues (73266aa)
• ci: use WORKFLOW_SECRET for release-please to enable chain-triggering (9339b9c)
• cli: disable global help shorthand to allow -h for subcommands (e734417)
• cli: resolve df command shorthand flag conflict (1f0d147)
• deps: bump golang.org/x/crypto from 0.55.0 to 0.56.0 (c0f017b)
• deps: correct devcontainers directory to root (9d83806)
• deps: correct indentation in test script for editorconfig compliance (0a44088)
• deps: exclude .devcontainer from docker ecosystem detection (67e96c3)
• deps: set valid golangci-lint version to v1.64.8 (625796e)
• docs: resolve npm vulnerabilities by pinning exact dependency versions (d628640)
• lint: ensure pre-commit runs exactly 2 times, not 3 (4085676)
• lint: ignore CHANGELOG.md in all directories for markdownlint (ebe338c)
• lint: restore color output in Pass 1 auto-fix stage (fe3d523)
• make version regex robust against initial release in cd.yml (f560288)
• make version regex robust against initial release in cd.yml (b6c115f)
• mise: disable attestation checks in sync-lock to prevent false positives (3f09708)
• mise: remove provenance fields from lockfile to prevent attestation errors (f7790b5)
• mise: workaround for GitHub attestation verification failures (2911054)
• pypi: remove unsupported loongarch64 and riscv64 architectures (e96b285)
• release: set separate-pull-requests to false for unified PR (07054f5)
• resolve govulncheck and yamllint errors reported by unirtm verify (04b3889)
• scripts: ensure summary table displays by default (a0d1b69)
• scripts: install PyYAML via pip instead of pipx in sync-harden-runner (16285a8)
• scripts: prevent sync-harden-runner from deleting workflow content (32a4228)
• security: add docker.yml to zizmor ignore rules (66e35cf)
• security: add template-injection rule to zizmor config (92396c1)
• security: resolve postcss vulnerability and fix gh issue creation label (d1a10c0)
• tasks: make osv-scanner recursive and allow missing lockfiles (fc5913d)
• trigger release workflow (13c6e34)
• unirtm: add missing macos platform entries for editorconfig-checker@4.0.0 (30c33f1)
• update goreleaser brew template key from unigo to template (ffb7377)
• update nanoid to 3.3.18 in package-lock.json (728158e)
• update nanoid to 3.3.18 in package-lock.json (7411de0)
• updater: add network retries and implement atomic binary replacement for Windows (9909391)

🛠 Refactoring

• apply black formatting style to all pre-commit hook scripts (b9fe7ff)
• ci: deduplicate *.githubusercontent.com:443 in Harden Runner (ee235af)
• ci: deduplicate harden runner endpoints using wildcards (542b6e4)
• ci: remove redundant VENV environment variable (72c4af5)
• cli: remove empty placeholder flags (ce93a29)
• cli: remove unsupported flags and environment options (f1dffff)
• cmd,updater,archive: extract GitHub API logic and archive extraction (61c720c)
• completely remove pnpm configuration and lockfiles (d6a7e6d)
• devcontainer: remove redundant chown command (5f79cc6)
• devcontainer: remove redundant trivy cache settings (1ffa32d)
• flatten internal/pkg directory into internal (df339d8)
• lint: merge Pass 1 and auto-fix into single step (7cd02aa)
• mise: use sed instead of perl for better POSIX compatibility (80059f0)
• pre-commit: clean up redundant exclude fields and optimize filtering (d95b727)
• pre-commit: optimize configuration and extract python scripts (f712d68)
• remove unnecessary whitespace in manpage generation command (0b6a549)
• remove Windows wrapper scripts (19820e4)
• rename root.go to 0.root.go for ordering (6ba7c02)
• scripts: remove MISE_GITHUB_TOKEN in favor of GITHUB_TOKEN (ec135c4)
• security: deduplicate harden runner endpoints (29c4faa)
• split GoReleaser job into core and third-party release steps to improve reliability and fault tolerance (6e760fb)
• switch Go download mirror to go.dev, remove harden-runner from GitHub workflows, and update vite to 8.1.3 (5b38466)
• test: remove PowerShell test support (eaf7e6c)
• update pre-commit hooks to use unirtm hook-exec instead of lint-wrapper.sh (ea80e6c)
• use slog and pterm for diagnostic logs instead of fmt.Printf (cadec57)

📖 Documentation

• adapt UniRTM documentation to UniGo template (adb7cbb)
• add GitHub API rate limit monitoring documentation (05b8fdf)
• add internal/pkg/README.md for unigo (841ec8f)
• add PyPI and NPM installation instructions to README (886e70c)
• add Windows shell migration guide (1d44801)
• changelog: replace MISE_GITHUB_TOKEN with GITHUB_TOKEN (7cffbd9)
• ci: improve dependabot auto-merge workflow documentation (c47f53e)
• clean up broken and dead markdown links (4a14786)
• clear root CHANGELOG.md (38ccfc4)
• replace mise and make with unirtm across all documentation (139c952)
• replace remaining UniRTM mentions with UniGo in documentation and specs (7f26d17)
• revert .unigo.toml back to .unirtm.toml in documentation (a19c849)
• scripts: update Chinese README to reflect removal of Windows wrappers (2aac80a)
• scripts: update README to reflect POSIX-only strategy (8b72ab6)
• scripts: update README to reflect removal of Windows wrappers (b4c0341)
• security: add comprehensive asdf supply chain risk analysis (515eea1)
• security: add mise supply chain security analysis and mitigation (c0c72f8)
• security: fix broken mise documentation links (8c3f625)
• update README to reflect UniGo project details (e22031b)
• update READMEs to reflect migration from mise to unirtm (39386e5)

♻️ Miscellaneous Chores

• add .release-please-manifest.json (9601e06)
• add egress network allowlist entries to all GitHub Actions workflows (9616592)
• add numbering prefix to newly ported commands (1e4ce06)
• add unigo binary to .gitignore (7b5ae61)
• bump version to 0.0.2 in release-please configuration (197b72c)
• bump version to 0.0.3 (652f05d)
• bump version to 0.0.4 (95b7ede)
• ci: align debian build matrix with upstream supported architectures (b88eaa4)
• ci: disable goreleaser workflow (b3b83bf)
• clean up .bak files and update dependabot-sync workflow (9475a55)
• clear placeholder readme files in npm packages (06ceb45)
• configure root package for manifest mode (8b1c28b)
• correct sequential numbering for newly ported commands (093f326)
• deps: bump @commitlint/cli in the all-dependencies group (0a3d231)
• deps: bump mise to v2026.4.14 (2bf29e3)
• deps: bump postcss (7badf33)
• deps: bump the all-dependencies group in /docs with 2 updates (64b0880)
• deps: bump the all-dependencies group in /docs with 3 updates (3e4b847)
• deps: bump the all-dependencies group in /docs with 3 updates (8c8ffd9)
• deps: bump the all-dependencies group with 2 updates (5f6a1b3)
• deps: bump the all-dependencies group with 2 updates (f390fc0)
• deps: bump the all-dependencies group with 2 updates (43cddbb)
• deps: bump the all-dependencies group with 2 updates (76dac5a)
• deps: bump unirtm version to 0.25.3 (49f7888)
• deps: bump vite in /docs in the all-dependencies group (91cdab1)
• deps: bump vite in /docs in the all-dependencies group (6cccd02)
• deps: bump vite in /docs in the all-dependencies group (bcad411)
• deps: bump vite in /docs in the all-dependencies group (f3e5f8f)
• deps: bump vite in /docs in the all-dependencies group (8ed895d)
• deps: fix vulnerabilities reported by osv-scanner and update go modules (e99bbbe)
• deps: merge upstream/dev into dev (831c7a2)
• deps: regenerate unirtm.lock with v0.25.0 format (9227ed1)
• deps: remove unirtm.lock (56539a0)
• deps: sync dependabot config and mise toolchain [skip ci] (b1f5025)
• deps: sync dependabot config and mise toolchain [skip ci] (99a5407)
• deps: sync dependabot config and mise toolchain [skip ci] (d11dc23)
• deps: sync dependabot config and mise toolchain [skip ci] (7bcbf01)
• deps: sync dependabot config and mise toolchain [skip ci] (f647663)
• deps: sync dependabot config and mise toolchain [skip ci] (cc12ad8)
• deps: sync dependabot config and mise toolchain [skip ci] (894db7f)
• deps: sync dependabot config and mise toolchain [skip ci] (c0de47a)
• deps: sync dependabot config and mise toolchain [skip ci] (3a449a5)
• deps: sync dependabot config and mise toolchain [skip ci] (3048ce8)
• deps: sync dependabot config and mise toolchain [skip ci] (060e7f0)
• deps: sync dependabot config and mise toolchain [skip ci] (c25be9a)
• deps: sync dependabot config and mise toolchain [skip ci] (51ca272)
• deps: sync dependabot config and mise toolchain [skip ci] (96489e5)
• deps: sync dependabot config and mise toolchain [skip ci] (cd4628a)
• deps: sync dependabot config and mise toolchain [skip ci] (4b105cd)
• deps: sync dependabot config and mise toolchain [skip ci] (7bdfbef)
• deps: sync dependabot config and mise toolchain [skip ci] (6078b1b)
• deps: sync dependabot config and mise toolchain [skip ci] (443e9f5)
• deps: sync dependabot config and mise toolchain [skip ci] (ad7782e)
• deps: sync dependabot config and mise toolchain [skip ci] (74e1355)
• deps: sync dependabot config and mise toolchain [skip ci] (6c009ed)
• deps: sync dependabot config and mise toolchain [skip ci] (5668326)
• deps: sync dependabot config and mise toolchain [skip ci] (816f2d1)
• deps: sync dependabot config and unirtm toolchain (bb56138)
• deps: sync dependabot config and unirtm toolchain (c244660)
• deps: sync dependabot config and unirtm toolchain (886b3fa)
• deps: sync dependabot config and unirtm toolchain (25d590a)
• deps: sync dependabot config and unirtm toolchain (df5bc0f)
• deps: sync dependabot config and unirtm toolchain (4f74adf)
• deps: sync dependabot config and unirtm toolchain (eabf483)
• deps: sync dependabot config and unirtm toolchain (70cd8d9)
• deps: sync dependabot config and unirtm toolchain (f561c65)
• deps: sync dependabot config and unirtm toolchain (59628d4)
• deps: sync dependabot config and unirtm toolchain (5169535)
• deps: sync dependabot config and unirtm toolchain (465c551)
• deps: sync dependabot config and unirtm toolchain (b70d42e)
• deps: sync dependabot config and unirtm toolchain (2de6141)
• deps: sync dependabot config and unirtm toolchain [skip ci] (c193711)
• deps: sync dependabot config and unirtm toolchain [skip ci] (629f2b2)
• deps: sync dependabot config for PyPI (e1533a8)
• deps: sync upstream dependency updates for CI actions and docs tooling (841e790)
• deps: update Go toolchain version to 1.27.0 (c93b0ec)
• deps: update go version to 1.26.5 (91349d4)
• deps: update go version to 1.27.0 (3b7cac1)
• deps: update golangci-lint to v2.13.2 with /v2 module path and remove lockfile (2199c57)
• deps: update govulncheck tool version to v1.7.0 for Go 1.27 AST support (54e84b9)
• deps: update unirtm tool dependencies to latest versions (c1606f7)
• deps: update unirtm toolchain version to 0.28.0 (b24cb8e)
• deps: update unirtm toolchain versions (23e763a)
• deps: upgrade alpine builder base image to golang 1.26.4 (252a2be)
• deps: upgrade golang version to 1.27.0 in template (8559102)
• deps: upgrade golang.org/x and core dependencies to address security advisories (dcceb88)
• deps: upgrade mise from 2026.4.14 to 2026.4.15 (df1e37e)
• devcontainer: replace MISE_ variables with UNIRTM_ and remove redundant HOST_HOME (26e7368)
• devcontainer: update devcontainer image to latest (5988d66)
• dev: release 0.4.0 (eced437)
• docker: remove default VERSION and release-please markers (5d5e128)
• docs: explicitly add esbuild and vite to devDependencies for tracking (ea50d16)
• docs: rename package name from template to unigo (fc32058)
• docs: resolve esbuild and vite vulnerabilities via overrides (f39d782)
• docs: update postcss to v8.5.25 to fix vulnerability GHSA-fxqj-rqcc-2cmp (101abfe)
• downgrade go version from 1.26.4 to 1.26.3 (ff7c3e2)
• downgrade Go version to 1.24.0 and update asset download URLs (355d9d8)
• downgrade shfmt to v3.12.0 in unirtm.lock (2651bda)
• exclude addlicense testdata from generic pre-commit validations (14093f8)
• fine-tune pre-commit config to perfectly match UniRTM configuration (286f118)
• fix UniRTM reference in golangci-lint config comment (d1e15a6)
• formatting fixes and workflow updates (34fbbe8)
• generate package-lock.json files after migrating from pnpm to npm (972f7e8)
• main: release 0.10.0 (1139f92)
• main: release 0.11.0 (7e03bfd)
• main: release 0.12.0 (04ca93f)
• main: release 0.13.0 (0f9dd47)
• main: release 0.13.1 (07dea06)
• main: release 0.14.0 (0626ae4)
• main: release 0.14.0 (775a72f)
• main: release 0.14.0 (043d2a4)
• main: release 0.15.0 (6093285)
• main: release 0.4.0 (1c66ecb)
• main: release 0.5.0 (2e24c34)
• main: release 0.6.0 (f3c6b45)
• main: release 0.6.1 (c66f36b)
• main: release 0.7.0 (8b56095)
• main: release 0.7.0 (ae017c0)
• main: release 0.7.1 (907dec7)
• main: release 0.8.0 (de253c8)
• main: release 0.8.1 (661f828)
• main: release 0.8.2 (bdbb873)
• main: release 0.9.0 (2e6cf66)
• main: release 0.9.1 (bacb8c0)
• main: release 0.9.2 (748e5a8)
• merge upstream dev branch to sync dependency updates (0ed315d)
• merge upstream template updates (e52934d)
• merge upstream/dev into dev (0300147)
• merge: merge upstream/dev into dev (43b9e62)
• merge: merge upstream/dev into dev (4d905fc)
• merge: merge upstream/dev into dev (0be753e)
• mise: add PyYAML to core tools for YAML processing (fdfd2ee)
• pre-commit: remove duplicate online zizmor hook (0124b68)
• pypi: add missing docstring to init.py (7f597b1)
• regenerate unirtm.lock with algorithm prefix (de2b74b)
• release 0.6.1 (f6fc042)
• release 0.7.1 (5535492)
• release main (1fa1601)
• release main (91fc3d6)
• release main (700980f)
• release main (d0658c7)
• release main (f194b67)
• release main (55a97dd)
• release main (67d4810)
• release main (ac32ddd)
• release main (a3848c6)
• release main (e0b6eaf)
• release main (f77a412)
• release main (ae2ad23)
• release main (e72b6de)
• release main (7290dad)
• release main (40863d5)
• release main (f912256)
• release main (e0a7459)
• release main (5e48a77)
• release main (e715f5d)
• release main (14e1633)
• release main (cecfa9b)
• release main (f3d1a03)
• release main (d2b694c)
• release main (47bc9d2)
• release main (201d5db)
• release main (13ea78a)
• release main (88b235c)
• release main (782aa1a)
• release main (76bafd6)
• release: align .goreleaser.yaml with unirtm (1af870e)
• release: bump version to 0.0.5 across Dockerfiles and VERSION (8f6298d)
• release: bump version to 0.0.6 across manifest, VERSION, and Dockerfiles (24ddfda)
• release: configure root package in config (6d6254d)
• release: deduplicate CHANGELOG headers (53eabcf)
• release: deduplicate CHANGELOG headers (ece82fa)
• release: deduplicate CHANGELOG headers (639b069)
• release: force release-please to use 0.0.5 via release-as config (fef7d1d)
• release: remove hardcoded release-as version (105dc81)
• release: remove legacy manifest file (64d599e)
• release: remove release-as override to enable automatic semver (bd95dda)
• release: remove unused sub-package CHANGELOG files under docker/ (82d292e)
• release: reset versions to 0.0.1 (08f9eec)
• release: set bump-patch-for-minor-pre-major to false (1e47e29)
• release: synchronize lockfiles for version bump (ad0ea63)
• release: synchronize lockfiles for version bump (ea5dc5d)
• release: update packages to use docker prefix and add rocky support (81f21b2)
• release: update release-as version to 0.0.6 in release-please-config.json (713e552)
• release: update version to 0.0.6 in docker.yml (11f08b5)
• release: v0.4.0 - Fix Dependabot docker-compose detection (e91f7d8)
• remove .kiro/specs and update test command in unirtm.toml (d76deb8)
• remove harden-runner security audit from docker workflow (c376f0e)
• remove Makefile and mise.lock (4b63962)
• remove redundant generic go.yml workflow (3c21b25)
• remove unirtm.lock (2da4f50)
• remove unused package.json from project root (7648e2b)
• reset release-as versions to 0.0.1 and update docker.yml for unigo (cb5aa7b)
• security: configure osv-scanner ignoring uncalled GO-2026-5932 (f641c6d)
• set manifest version to 0.0.0 to allow release-please to trigger v0.0.1 release (07f31c8)
• sync unirtm updates (v0.29.1, dependabot lock flags, lint bumps, dead code cleanup) (6d0c3b7)
• sync upstream template changes for pre-commit and CI improvements (3ceda78)
• sync version numbers and add release-please markers for auto-update (6b40857)
• update base images to alpine 3.24.1 and debian 13.6.0 (a1096c2)
• update cd workflow configuration (e06ee75)
• update dependencies in go.mod and go.sum (6b6f5ca)
• update Trivy scan skip-dirs from unirtm_data to unigo_data (f9771d3)
• update UniRTM template, IDE agent rules, and disable Goreleaser snap publishing (ff5d293)
• update zizmor configuration [skip ci] (9b58403)
• upgrade actions/checkout to v7.0.0 in goreleaser workflow (1330789)
• upgrade Go to 1.26.4 and shfmt to v3.13.1 (5f1a4a5)
• upgrade setup-unirtm action to v0.6.0 and UniRTM to v0.25.7 in workflows (1088902)