anodizer v0.8.0

What's new in v0.8.0

Changelog

Features

• 189db08 add stage-appimage crate (AppDir + linuxdeploy + harvest) (@tj-smith47)
• bbd58fd wire AppImageStage into the pipeline + docs (@tj-smith47)
• 95b00f9 SLSA build-provenance for binaries + archives (@tj-smith47)
• a8f98fb add builder: prebuilt for imported binaries (@tj-smith47)
• aa11201 close B17 single-target build audit gaps (@tj-smith47)
• 2bb4266 make tag/bump changelog refresh opt-in via --changelog (@tj-smith47)
• c304c0e close B15 advanced + B16 preview audit gaps (@tj-smith47)
• dfa53d6 exclude version-sync bump commits from notes by default (@tj-smith47)
• a2489a7 route tag/bump changelog to root vs per-crate destination (@tj-smith47)
• bc670fd unify changelog into refresh/notes/json command (@tj-smith47)
• c8342c5 wire AI release-note enhancement end-to-end (@tj-smith47)
• 4d819db add check version-files drift guard (@tj-smith47)
• f937cae publish coverage badge from master CI runs (@tj-smith47)
• 70a3241 add --preflight, --no-preflight, --strict-preflight flags (@tj-smith47)
• 1ffda6f add --resume-release and --replace-existing release-stage overrides (@tj-smith47)
• 0152834 add resolve-tag subcommand for monorepo tag→crate mapping (@tj-smith47)
• 41b9b6f close B24 release workflow separation audit gaps (@tj-smith47)
• 13e9fbb config loading, pipeline assembly, and command stubs (@tj-smith47)
• 15bb0ed init, check commands, change detection, hooks, colored output (@tj-smith47)
• 96b24d8 wire token type resolution from config/env into Context (@tj-smith47)
• b28f64f anodize check determinism harness (@tj-smith47)
• 2a131ba restructure anodize check + add core::git::worktree (@tj-smith47)
• d5c7fdf add release-resilience flags (--no-gate-submitter, --rollback, --simulate-failure, --rollback-only, --from-run, --allow-nondeterministic, --summary-json) (@tj-smith47)
• 1d9a13e exit non-zero when required publishers fail (@tj-smith47)
• 08c8a36 WAVE 2 — defaults system foundation (path-mirror inheritance) (@tj-smith47)
• 19c4d2e WAVE 3 — cargo publisher rename + flag expansion (DEC-1/10, ITEM-3, FOLL-1) (@tj-smith47)
• bf5fb68 accept GR back-compat archive/snapshot/build aliases (F3) (@tj-smith47)
• 10af9cf conditional if: across publishers, hooks, announcers, archives, blob (@tj-smith47)
• 1868af6 deprecate publish.homebrew (Formula) — migrate to homebrew_casks (@tj-smith47)
• d0aff91 deprecation aliases for v2.12.6-v2.15.3 GR renames (@tj-smith47)
• 578c7c5 derive publisher metadata from Cargo.toml [package] (@tj-smith47)
• 42eb1ff recursive includes, strict template_vars, meta_ propagation, after.hooks alias (@tj-smith47)
• aeba670 reject GR V1 dockers: block with migration error (M3) (@tj-smith47)
• 6161409 rename docker_v2 -> dockers_v2 for GoReleaser parity (@tj-smith47)
• d37419c validate archives/universal_binaries id uniqueness (Q-arch2) (@tj-smith47)
• 1d42574 warn on legacy disable: alias; rename to skip: (@tj-smith47)
• 7de69a4 warn when required: true set on Submitter publishers (@tj-smith47)
• 891c4a9 wire defaults.env into per-crate env resolution (@tj-smith47)
• 4c6d86c Session L — config defaults, ANODIZE_FORCE_TOKEN, announce provider parity (@tj-smith47)
• b60e737 wire brontes path-dep for dogfooding (@tj-smith47)
• 40e55b9 --inject-drift test hook + --allow-nondeterministic end-to-end wiring (@tj-smith47)
• 684f465 --preserve-dist= copies run-0 dist + context.json (@tj-smith47)
• fe5aa28 auto-detect tag commits + project-version-aware hint (@tj-smith47)
• 5f6a49c run sign hermetically with ephemeral cosign + GPG keys (@tj-smith47)
• 9e6f452 close B21 podman support audit gaps (@tj-smith47)
• f61e0a4 publish anodizer's MCP server entry (@tj-smith47)
• ae7718b add GoReleaser env list form and env_files structured token files (@tj-smith47)
• 2335dae implement gemfury publisher (B8 net-new) + furies alias (@tj-smith47)
• 91527e8 wire GitConfig fields to tag discovery behavior (@tj-smith47)
• 6e02c24 docker BuildKit reproducibility stage (@tj-smith47)
• 8ae3fa5 installer-tool determinism sweep (D3) (@tj-smith47)
• ea1adb6 add --version-files enrollment flow (@tj-smith47)
• 3dec67d self-contained version updates via krew-release-bot webhook (@tj-smith47)
• a96cf29 Session M — missing stages, milestones, cross-cutting parity (@tj-smith47)
• 1e3c830 wire brontes as anodizer MCP server (@tj-smith47)
• 7842752 pre-flight repo resolution at validate time (@tj-smith47)
• 84b00fb close GR parity gaps (extra_files dir, hook scoping, format:binary) (@tj-smith47)
• 959fbdc add publish_repo + retention.keep_last config knobs (@tj-smith47)
• e261bec add stateless NightlyBuild + Base template vars (@tj-smith47)
• c49c879 unified logger, CI section grouping, Cargo-style theming (@tj-smith47)
• a1ece19 generate per-crate README.md so crates.io renders pages (@tj-smith47)
• f9ec8d5 GoReleaser v2.16 A3 deltas — nightly tag_name templates + srpm Format/Ext parity (@tj-smith47)
• c61640a remove npm publisher — Node-only, not for a Rust release tool (@tj-smith47)
• 6a62818 add --allow-rerun flag to anodizer publish (@tj-smith47)
• 0b0f2ad aursources install field, snapcraft command default, cask manpage shim (@tj-smith47)
• d1b2920 close B7/B9/B10/B11/B13 audit gaps (@tj-smith47)
• e1c4c08 retain_on_rollback, on_error hooks, anodizer notify (@tj-smith47)
• 11a10b2 add changelog + announce to publish-only pipeline (@tj-smith47)
• 9c13daf per-crate dist subdir layout for workspace release (@tj-smith47)
• 7389b93 runtime SHA256 verify of preserved-dist before re-sign (@tj-smith47)
• 52a04d7 --publish-only loads preserved dist + re-signs with prod keys (@tj-smith47)
• a33249f add --host-targets for host-scoped real prepush builds (@tj-smith47)
• bc35263 close B18 split/merge audit gaps (@tj-smith47)
• b314c59 close B22 nightly builds audit gaps (@tj-smith47)
• 3ee4886 eliminate redundant build job via --publish-only (@tj-smith47)
• 86f50ab fail loud when a binary-requiring crate produces no binary (@tj-smith47)
• d27aea1 guard templates before any irreversible publisher fires (@tj-smith47)
• a94ab91 per-artifact iteration + ids/artifacts filters for before_publish (@tj-smith47)
• 2e55c3f pre-publishing hooks (B12 net-new) (@tj-smith47)
• ae73269 validate anodize-only emissions in snapshot + auto-derive binstall metadata (@tj-smith47)
• c343841 inject buildx-version probe through DockerStage for test seam (@tj-smith47)
• 7c8cd03 implement --rollback-only --from-run replay (@tj-smith47)
• 376a762 poll chocolatey moderation + winget PR validation after publish (@tj-smith47)
• a5f7e3d swap PublishStage to Result + Submitter gate (@tj-smith47)
• 7911326 check rollback token scopes (@tj-smith47)
• c649b3e probe gpg --faked-system-time at pipeline start (@tj-smith47)
• 88e401d add --push flag family to push the bump commit atomically (@tj-smith47)
• 3a27f92 add tag rollback subcommand + fix all 596e1a3 review findings (@tj-smith47)
• 617e851 default default_bump to none; document bump precedence (@tj-smith47)
• a6665dd explicit --version override for autotag (@tj-smith47)
• 7d2315b make bump-commit [skip ci] opt-in via skip_ci_on_bump (@tj-smith47)
• 7735448 per-crate workspace-aware tag + release tags-at-HEAD default (@tj-smith47)
• dfbc248 pre-1.0 bump demotion (bump_minor_pre_major / bump_patch_for_minor_pre_major) (@tj-smith47)
• d6f0b9b refresh CHANGELOG.md on tag across all 3 config modes (@tj-smith47)
• 713b1f6 rewrite enrolled version_files in the bump commit (@tj-smith47)
• 2d3d0da scope change detection to crate path for monorepo workspaces (@tj-smith47)
• c1de526 version_sync Cargo.toml before tagging #none (@tj-smith47)
• a691cb2 add 8 Pro template variables for GoReleaser parity (@tj-smith47)
• 9e3e8ea add ArtifactExt, Target, Checksums, Outputs template variables (@tj-smith47)
• 0f0a384 add custom template variables (.Var.*) for user-defined values (@tj-smith47)
• 4e5187d add template_files config section and rendering stage (@tj-smith47)
• a37e23d wire stage as final pipeline step + skip + docs (@tj-smith47)
• 0c7d61d GoReleaser parity — Session 6 gap closures + specs (@tj-smith47)
• e41e6be README, config reference, GitHub Action, integration tests, dotfile config default (@tj-smith47)
• 1b9bee4 Session 5.5 observability + deep audit fixes across entire codebase (@tj-smith47)
• 19801c9 SkipMemento wiring + BinarySignStage + anodize build parity #none (@tj-smith47)
• 571de80 add --config / -f global flag to specify config file path (@tj-smith47)
• d711d39 add --nightly flag for automated rolling releases (@tj-smith47)
• 9e4cde8 add --timeout flag to release and build commands (@tj-smith47)
• afa159e add --workspace flag to build and check commands (@tj-smith47)
• 843fdb6 add E2E test infrastructure for integration testing (@tj-smith47)
• 10a9988 add UPX binary compression stage (@tj-smith47)
• 10388fb add anodize tag command for auto-tagging based on commit directives (@tj-smith47)
• ec6ad18 add cloud storage upload (S3/GCS/Azure) and split/merge CI fan-out (@tj-smith47)
• bdd2322 add completion, healthcheck commands and new CLI flags for release/build (@tj-smith47)
• e39f142 add config includes with deep merge support (@tj-smith47)
• 68e4930 add custom publishers for generic post-release artifact publishing (@tj-smith47)
• 6d8b2ad add filters.include, abbrev, and use: github-native to changelog config (@tj-smith47)
• 20fd04a add jsonschema command, env_files, config versioning, build ignore/overrides (@tj-smith47)
• 01030a6 add make_latest, changelog header/footer, and disable fields to config (@tj-smith47)
• a192a15 add monorepo workspace support for independent project roots (@tj-smith47)
• af16415 add platform-specific packaging stages — snapcraft, dmg, msi, pkg (@tj-smith47)
• 30d4392 add report_sizes, metadata.json output, and env config fields (@tj-smith47)
• 191b5c2 add sha1, sha224, sha384, blake2b, blake2s algorithms and extra_files/ids to checksum stage (@tj-smith47)
• 26a9e35 add shared test helpers module and mock GitHub client trait (@tj-smith47)
• 468c266 add source archive and SBOM generation stage (@tj-smith47)
• 9876572 anodize bump --commit bundles changelog + --strict version-pin gate #none (@tj-smith47)
• 2925006 auto-detect GitHub owner/name from git remote when release.github is omitted (@tj-smith47)
• cc098a9 complete Phase 1 parity tasks 1-9 (1,736 tests pass) (@tj-smith47)
• 1267439 comprehensive --strict mode across all stages (@tj-smith47)
• 9214ddb integration tests and README (@tj-smith47)
• 56bea2d migrate sign to signs[] array with backward compat and new fields (@tj-smith47)
• 009a145 populate all template variables from git info and time (@tj-smith47)
• 42117bb replace blob CLI-shelling with object_store SDK (@tj-smith47)
• 70a256f rewrite SBOM stage to subprocess model and update source archive (@tj-smith47)
• 18f300c scaffold workspace with core and stage crate stubs (@tj-smith47)
• 1c70bc9 shared parallelism + skip-memento + tag hooks + ignore_tags wiring #none (@tj-smith47)
• 3d1e30a split/merge rewrite for GoReleaser Pro parity (@tj-smith47)
• e575fa8 v0.1.0 release preparation (@tj-smith47)
• 809ddae wire NSIS and AppBundle stages into workspace, CLI, and pipeline (@tj-smith47)

---

Bug Fixes

• d55f3e5 plug 4 GoReleaser-parity gaps in announcers (@tj-smith47)
• 86ecb94 match GoReleaser report_sizes behavior with type filter and size storage (@tj-smith47)
• 41947cb SHA-derived branch, docker_v2, workflow hardening (part 2) (@tj-smith47)
• 5a1cb32 drain B20 review findings (@tj-smith47)
• 3952320 gate zigbuild routing on a reachable zig toolchain (@tj-smith47)
• 694d74a inject per-target builds[].env into build hooks (@tj-smith47)
• 5a7f94d preserve harness-injected RUSTFLAGS so Windows PE is reproducible (@tj-smith47)
• 95df109 drain Group D review findings (@tj-smith47)
• 8205e26 inference uses .anodize.yaml tag_template, not name-v fallback #none (@tj-smith47)
• c17643b route full-Config deserialization through an 8 MiB worker thread (@tj-smith47)
• 5140ceb bind AuthorUsername alias to Login for GR-default-format parity (@tj-smith47)
• 5a3a10c build multitrack root aggregate from config topology (@tj-smith47)
• a094286 bump resolves tag prefix from tag_template, not {crate}-v (@tj-smith47)
• 160ac82 collapse same-prefix crates to a flat aggregate (not multi-track) (@tj-smith47)
• 4ee2a4f correct preview truncation + lockstep tag prefix (@tj-smith47)
• ed0e57e derive per-crate scope from crate dirs; changelog.paths intersects not replaces (@tj-smith47)
• 05da6fd empty-from means full history; unify range across formats (@tj-smith47)
• fb74e89 forward-slash repo-relative paths in preview output (@tj-smith47)
• 6c06b41 honor --from as the range start (@tj-smith47)
• e7c061c honor the explicit upper bound in release-notes rendering (@tj-smith47)
• a271a53 lockstep root aggregate ignores the per-crate root filter (@tj-smith47)
• 14ec69b make standalone release-notes preview guard-free (@tj-smith47)
• 1a88c52 preserve multi-line commit bodies in --name-only parse (@tj-smith47)
• b56385f promote multitrack root under per-track tags at tag time (@tj-smith47)
• 80ca678 render lockstep release-notes preview from synthesized root (@tj-smith47)
• d4a9c60 render workspaces-multi-track preview + suppress preview dist write (@tj-smith47)
• 3e9333c share the changelog gate between bump and tag (@tj-smith47)
• 9164ce0 snapshot release-notes honors pending lower bound (@tj-smith47)
• a87b745 validate explicit --from ref before fetching (@tj-smith47)
• 4b8d5c8 fall back to GITHUB_REF_NAME for tag_override when triggered by tag push (@tj-smith47)
• 2895774 resolve version-files reference per layout, not always workspace (@tj-smith47)
• 7560d12 use workspace version when a non-member crate inherits it (@tj-smith47)
• 9ba2173 escape inner quotes in Windows before-hook YAML #none (@tj-smith47)
• 9177c1a host-agnostic cross-platform tests + real blocking determinism (@tj-smith47)
• 75c56d7 nfpm test gating, Windows test cross-platform, stage-release pkg dep #none (@tj-smith47)
• 4027c89 shard Determinism Harness 3-way + add --targets filter (@tj-smith47)
• a19af43 unblock v0.2.1 cut — 5 cross-platform test + workflow fixes (@tj-smith47)
• 2e13b61 WAVE 3 follow-up — wire FOLL-1 publisher skip names + parse rejection tests (@tj-smith47)
• 6274193 Win harness drops RUNNER_TEMP + GH/RUNNER namespace hermeticity (@tj-smith47)
• 1de3d97 add target triple validation and GPG/cosign env checks to check command (@tj-smith47)
• a2f0b4b address code review findings for token type wiring (@tj-smith47)
• d1bd9eb harness env on Windows inherits host with credential deny-list (@tj-smith47)
• 098e334 harness inherits host PATH + defaults RUSTUP_HOME, drop env-block bandaids (@tj-smith47)
• 7c76ae7 migrate std::env::var to ctx.env_var / EnvSource (@tj-smith47)
• 511e983 per-crate version reconcile in publish-only; subdir-safe file IO (@tj-smith47)
• 4a1e330 print help and exit 0 when no subcommand is given (@tj-smith47)
• 805b06b run the entry point on a large-stack worker thread (@tj-smith47)
• 81a842f teach --stages parser makeself + snapcraft (@tj-smith47)
• fe4838e wire retry policy through milestone close HTTP calls (@tj-smith47)
• 1ed1fc4 wire verbose/debug to ContextOptions, improve find_config error message (@tj-smith47)
• 341ec8f determinism harness — explicit env allow-list + single-source skip-list (@tj-smith47)
• 443d785 Win MSVC link.exe + macOS poller timeout robustness (@tj-smith47)
• 7fb1c7a sanitize --from-run against path traversal (@tj-smith47)
• e03d173 self-cycle detection, dockerhub meta_ fallback, shared template-file render (@tj-smith47)
• 777b2e1 source.prefix_template defaults to name_template (Q-src3) (@tj-smith47)
• 673571d upgrade all disable/skip_upload fields to Option (@tj-smith47)
• c04355e validate partial.by + strict packager configs with GR-import aliases (@tj-smith47)
• 9d27d89 tighten artifact dup-warn, debug-quote strip, layout fold (@tj-smith47)
• 41e481a MSVC /Brepro for reproducible Windows binaries (@tj-smith47)
• 80c672d MSVC link.exe full deterministic flag set + drift diagnostics (@tj-smith47)
• eb380fe address Phase 1 review — module split, basename lookup, atomic write, streaming hash (@tj-smith47)
• 598ab23 allow-list signatures, SBOMs, and the dist manifest (@tj-smith47)
• 99955f7 byte-identical artifacts.json across runs (@tj-smith47)
• 8e57810 close config.yaml/artifacts.json SDE gap; hash raw binary (@tj-smith47)
• 406f859 close sampler gap, prune-bin basename match, text-diff in summary (@tj-smith47)
• 7b84e3c default worktree root to /.det-worktrees, not /tmp (@tj-smith47)
• 9562bc3 drop redundant / append; harness does it (@tj-smith47)
• 184f845 key hash_artifacts by rel-path; fix workspace-only implicit-all (@tj-smith47)
• 5104477 kill 27-artifact drift surfaced by CI run 25975073213 (@tj-smith47)
• 33e6172 make Windows MSVC drift offsets visible in CI (@tj-smith47)
• b23ebee make inject_drift_byte process-local atomic counter (@tj-smith47)
• 725ed51 normalize Windows path separators in stage inference (@tj-smith47)
• 1192e29 pin ephemeral GPG key creation to SDE; normalize paths (@tj-smith47)
• 76cb613 preserve to // when --crate is set (@tj-smith47)
• 3efbe6a route determinism-fast through the action; scope inject-drift test (@tj-smith47)
• 9325b90 scope harness child build to its crate (@tj-smith47)
• 0a6cb56 skip makeself scratch dir during dist preservation (@tj-smith47)
• 27de44d skip non-diffed produce-stages in child subprocess (@tj-smith47)
• 2f49a66 strip PDB debug entries on MSVC; add MSVC flags to global RUSTFLAGS (@tj-smith47)
• 00fd062 strip content-hash keys from artifacts.json metadata; grow drift sample window (@tj-smith47)
• e7e8bdb strip worktree path + sort YAML keys in dist artifacts (@tj-smith47)
• 5bf3824 teach harness parse_stages source/upx/nfpm (@tj-smith47)
• 35b0422 tighten harness — worktree path, MSVC flags, tail sample (@tj-smith47)
• 1f7db90 use stable worktree path across runs (UTF-16 path leakage) (@tj-smith47)
• 2931169 vary inject_drift fallback byte by wall-clock nanos (@tj-smith47)
• 0abe046 PID-suffix worktree path so parallel tests don't collide (@tj-smith47)
• 087ff72 migrate all is_disabled/evaluates_to_true callers to fallible try_* variants (@tj-smith47)
• e18f274 address all code quality review findings for GitConfig (@tj-smith47)
• d0cf3c5 close 4 GoReleaser parity gaps in GitConfig wiring (@tj-smith47)
• 9f82e48 close B23 review findings (smartsemver dormancy, tag bypass, dead fallback) (@tj-smith47)
• 7fc2d8d drain B23 code-quality review findings (@tj-smith47)
• d948432 redirect LLVM_PROFILE_FILE out of worktree (@tj-smith47)
• 8155816 add tracing::debug at tag_override site + unit test for GITHUB_REF_NAME fallback (@tj-smith47)
• 5a16ed7 skip windows-msvc off non-Windows hosts (@tj-smith47)
• d757b6f address all code/spec review findings for config includes from URL (@tj-smith47)
• 2278136 correct header key expansion test assertion (@tj-smith47)
• 086af8d harden --version-files YAML writer + add post-write guard (@tj-smith47)
• d09bea6 address code quality review findings for MetadataConfig (@tj-smith47)
• 79197be correct metadata.json content and split artifact list into artifacts.json (@tj-smith47)
• 2e41172 single-pass repo resolve, log not-found, drop title from Gitea PATCH (@tj-smith47)
• c711791 address all code review findings for monorepo config feature (@tj-smith47)
• 637f8be wire apk-private-key + attach public key via anodizer-action (@tj-smith47)
• b25591a initialize tracing-subscriber so library warnings reach the user (@tj-smith47)
• 30f3467 surface swallowed fs/git/glob/log errors (@tj-smith47)
• 587d37e complete the unified logger — wire verb column, group all stages, DRY render, no leaks (@tj-smith47)
• f361a6c correct stage attribution, group config warnings, dedup git warning (@tj-smith47)
• 6996b31 tag stage bodies to their section; DRY status (@tj-smith47)
• 18689fe honor --skip=build in binary-presence guard (@tj-smith47)
• 725b450 D3/D4/D5/D6 + F1 contract tests + F2 README YAML validation (@tj-smith47)
• be18910 build docker images and scope mcp to its owning crate in publish-only (@tj-smith47)
• 90e8ced propagate template render errors in scoop/nix/krew homepage (@tj-smith47)
• 2a22c30 rehydrate sha256 via ChecksumStage in publish/continue pipeline (@tj-smith47)
• 7f26c9f scope selected_crates per-iteration; opt-in polling; silent changelog skip (@tj-smith47)
• 480616f accept any shard's recorded hash for cross-shard duplicates (@tj-smith47)
• 35217d5 address Phase 2 review — env-injection preflight, commit cross-check fail-closed, pipeline test, gpg-agent cleanup (@tj-smith47)
• c0c0472 address review #4/#5 — unified discovery, collision detection, version cross-check (@tj-smith47)
• aec8eef apply workspace overlay per iteration; quiet known-handled meta warnings (@tj-smith47)
• 41fbae5 auto-enable resume_release to bypass duplicate-release bail (@tj-smith47)
• d1a5147 close 5 critical findings from review (@tj-smith47)
• dd96d20 dedupe target=None cross-shard duplicates in registry (@tj-smith47)
• 65347ac exclude sibling manifests from preserved-artifact list (@tj-smith47)
• 58b4e7a propagate workspaces[].skip into per-iteration skip_stages (@tj-smith47)
• 76e766f re-anchor manifest paths onto per-crate dist root (@tj-smith47)
• 5981621 reorder strip-ephemeral, exempt Metadata from existence check (@tj-smith47)
• 89b2d26 revise Binary handling — keep in registry, suppress binary_signs (@tj-smith47)
• 7bfc972 round-2 review — allowlist, cleanup scope, binary_signs warn (@tj-smith47)
• d7fd094 skip ephemeral sig/cert paths in multi-shard hash-verify (@tj-smith47)
• 63503a3 tolerate merge-multiple round-trip variance when shards already disagreed (@tj-smith47)
• 461b885 address review findings on per-crate publish-only (@tj-smith47)
• 674ab02 align --prepare skip list and tighten workflow guards (@tj-smith47)
• 878f339 anchor auto-detected config path so project_root resolves cleanly (@tj-smith47)
• 5190554 apply workspace overlay when --crate matches a workspace (@tj-smith47)
• b9e8969 binary-artifact guard skips crates with no in-scope targets (@tj-smith47)
• d0c5962 drain B24 review code-quality findings (@tj-smith47)
• aaceb41 flatten workspaces for crate resolution (@tj-smith47)
• a50303d isolate per-crate config + harden destructive paths (@tj-smith47)
• 15bac60 pick the publisher-bearing crate as the release effective-crate (@tj-smith47)
• e8f9f87 resolve --all change-detection pathspecs at the workspace root (@tj-smith47)
• d37b991 restore harness build path — revert hooks env_clear, skip changelog in harness (@tj-smith47)
• ad83e1c restore per-crate Tag + metadata in publish-only (@tj-smith47)
• 04bcd26 root-cause snapcraft completer + winget sha256 backfill #none (@tj-smith47)
• f06d30b scrub audit-tag comments and stabilize flaky gitlab test (@tj-smith47)
• dc04ac6 treat --nightly like --snapshot in tag-resolution guards (@tj-smith47)
• 026c854 swap blob before snapcraft, drop double-publish, narrow test seam (@tj-smith47)
• e0fc1ba explicit shard-label, partial-shard guard, comment-hygiene sweep (@tj-smith47)
• cb0ec5d address code quality review findings (@tj-smith47)
• bbef82e expose canonical .src.rpm extension via .ArtifactExt (@tj-smith47)
• 64a81ab close review findings on post-publish polling (@tj-smith47)
• 3f7d26d correct chocolatey moderation discriminator + close preflight review (@tj-smith47)
• 65437a5 rerun guard + announce gate semantics + scope dedup (@tj-smith47)
• 64d737d plug remaining B3 binary-sign leak sites (@tj-smith47)
• 3ed0a45 deduplicate archivable_kinds const + migrate remaining env vars (@tj-smith47)
• e6a9ee9 .anodizer.yaml workspaces: takes precedence over [workspace.package].version (@tj-smith47)
• ee6fa4b accurate push wording, orphan hint, reject push on rollback (@tj-smith47)
• a4d55d5 append [skip ci] to bump commit subjects to break CI loop (@tj-smith47)
• 9eb8e9d apply workspace version sync when no --crate is given (@tj-smith47)
• 3d9e6fe classify same-tag-prefix flat crates as Lockstep (@tj-smith47)
• 57c0594 conflict-check version_files in dry-run, key on full (old,new) (@tj-smith47)
• 2e9f45d emit per-crate anodizer-output only after the atomic push (@tj-smith47)
• 475109e per-crate dispatch correctness + versions= output line (@tj-smith47)
• 50c46f3 preview version_files rewrite under single-crate dry-run (@tj-smith47)
• ba82aa1 propagate version bumps to intra-workspace dep pins (@tj-smith47)
• 890d345 propagate version_sync bump commit failure before tagging (@tj-smith47)
• 421f4c3 scope intra-workspace dep-pin propagation to the bumped crate's workspace (@tj-smith47)
• 5fa579d scope per-crate change detection + version inference to the workspace root (@tj-smith47)
• 5948253 address all 21 reviewer-2 findings on 3a27f92 (@tj-smith47)
• bb1a0a6 solaris/illumos OS + sparc64 arch mapping; RustcVersion template var (@tj-smith47)
• 0f44e2d address all code review findings (@tj-smith47)
• 13161a8 run gate in publish-only and merge pipelines too (@tj-smith47)
• 8207788 68 GoReleaser parity bugs across all stages (@tj-smith47)
• bf6489a CI failures — docs freshness, packaging, tests, snapshot (@tj-smith47)
• bf8f940 R5 audit — eliminate remaining raw eprintln, double env load, VERSION_PLACEHOLDERS copy (@tj-smith47)
• 79638da Windows hook tests, docs check diagnostic output (@tj-smith47)
• 0427353 action injection safety, nfpm docs, IsDraft template var, unused import, clippy warnings (@tj-smith47)
• c8ac32f add flatpak/notarize to workspace + fix ChangelogConfig construction (@tj-smith47)
• 73f8ec5 address all 10 code review findings for source archives + SBOM (@tj-smith47)
• f608424 address all 11 code review findings for Task 5M (CLI + Config) (@tj-smith47)
• aac46c4 address all 4 findings from Session 5 final review (@tj-smith47)
• 0334bdf address all code review findings from Task 3D documentation review (@tj-smith47)
• 0beb30e address all split/merge code review findings (@tj-smith47)
• d6607d0 address all v0.3.2 release failures across 4 workspace crates #none (@tj-smith47)
• 64cb703 address code review findings for monorepo workspace support (@tj-smith47)
• cbcf630 address code review findings from Tasks 3A and 3B (@tj-smith47)
• 2ce6848 address code review issues for Task 2A CLI completeness (@tj-smith47)
• 9244126 address code review issues for Task 2E sign stage (@tj-smith47)
• 230eab9 address code review issues for Tasks 2B, 2G, 2H (@tj-smith47)
• d64d366 address code review issues for Tasks 2I and 2J (@tj-smith47)
• 7e6c83b address deep review findings across template, artifact, util, helpers (@tj-smith47)
• 634c79c address final review findings — help text, mobile nav, aria, CI check (@tj-smith47)
• 7652618 anchor branch regex and make tag push conditional on remote (@tj-smith47)
• c0e6290 cargo fmt, clippy, and add CI auto-tag step (@tj-smith47)
• 9152ade cargo.toml override wins over bump=None short-circuit in tag #none (@tj-smith47)
• 85ad868 check-then-act publisher push + conventional-commit gate on tag #none (@tj-smith47)
• fbe8ddd clippy unnecessary_unwrap and fmt in nfpm test (@tj-smith47)
• 4ff610d copy binary artifacts into split dist for cross-machine merge (@tj-smith47)
• e84f0ec derive Clone on TemplateVars, replace fragile clone_template_vars (@tj-smith47)
• f7d483d docker_signs as separate stage post-docker, UploadableBinary filter for winget/homebrew/publisher util #none (@tj-smith47)
• 2cb51c5 drain known-bugs (W1+W2+S1-S4 safety, S1-S6 pro, S1-S5 dedup) #none (@tj-smith47)
• fe46c86 drop sign from harness default + correct if_condition Tera syntax (@tj-smith47)
• ca68e87 find_binary PATHEXT on Windows, workspace skip field #none (@tj-smith47)
• 86e4efe force color in CI; publish transitive workspace deps (@tj-smith47)
• d1bcc93 have resolve_git_context fall back to workspaces when crates empty (@tj-smith47)
• f3c1841 idempotent commit_and_push (skip when nothing staged), version_sync Cargo.lock #none (@tj-smith47)
• 128e003 krew default upstream + per-crate previous_tag prefix filter #none (@tj-smith47)
• 248c904 native nupkg (no choco CLI), skip before hooks on tag-triggered CI #none (@tj-smith47)
• 9687d2e nfpm mode serialization and initial tag version (@tj-smith47)
• a7d9766 parity sweep — 31 GoReleaser parity fixes across release/sign/changelog/publishers/packaging/announce #none (@tj-smith47)
• e4bac94 remove needless borrows in E2E tests to fix clippy warnings (@tj-smith47)
• 17bb8f7 resolve flaky tests, duplicated helpers, and unfalsifiable assertions (@tj-smith47)
• 7a3ade0 reverse config include merge order so base config overrides includes (@tj-smith47)
• 6d6ebe9 run formatter (@tj-smith47)
• 408e3db skip before hooks in split mode, gitignore zig cache (@tj-smith47)
• a049bcc skip dirty-dist check in merge mode (@tj-smith47)
• fbb83bb split/merge env poisoning — macOS HOME leaked into Linux docker builds #none (@tj-smith47)
• c0ebc5d stable docs default, Windows test compat, Zola deprecated field (@tj-smith47)
• 13eabef strengthen workspace E2E assertions and add change detection test (@tj-smith47)
• 91f7d7f strict-mode bulletproofing + targets subcommand + publisher safety #none (@tj-smith47)
• 94d9417 support Tera-native tag_template in tag matching, remove last TODO, run cargo fmt (@tj-smith47)
• 596e1a3 unblock cfgd release — publish-only, mcp, krew, cargo pin (@tj-smith47)
• 85108ea version_sync must regenerate Cargo.lock before committing, revert hook skip #none (@tj-smith47)
• ce3e396 version_sync updates workspace deps, respects Cargo.toml version, skips CI (@tj-smith47)
• 86faad2 whole-token #none + github-release size-match idempotency #none (@tj-smith47)
• c9f5cc3 wire TestContextBuilder into stage tests, add mock GitHub release test (@tj-smith47)
• 4f34bf8 wire nightly name_template, gate verbose output, guard snapshot+nightly (@tj-smith47)
• 5c62e6f wire up git variable population and CI improvements for Task 3E (@tj-smith47)
• a5a3042 write metadata.json before release stage for include_meta #none (@tj-smith47)

---

Performance

• 27c58cf reuse one tokio runtime across all close calls (@tj-smith47)

---

Others

• f782d89 Merge branch 'worktree-docsite' (@tj-smith47)
• 1e034ea Reapply "docs(comments): fix doc-orphan attribution and targeted comment hygiene" (@tj-smith47)
• c092573 Reapply "docs(core,cli): scrub GoReleaser/Go-source refs from comments" (@tj-smith47)
• 7c19077 Revert "chore(release): bump anodize → 0.2.0, ..." #none (@tj-smith47)
• 8302dd8 Revert "docs(comments): fix doc-orphan attribution and targeted comment hygiene" (@tj-smith47)
• f9e10f1 Revert "docs(core,cli): scrub GoReleaser/Go-source refs from comments" (@tj-smith47)
• a4ad745 Revert "fix(publish-only): tolerate merge-multiple round-trip variance when shards already disagreed" (@tj-smith47)
• 9505686 land 2026-04-config-gaps audits + batch 10/1/5 fixes (@tj-smith47)
• 6b30375 polish B8 — rustdoc parens + RUNNER_* symmetry test (@tj-smith47)
• 7bf6cc4 tighten --from-run rejection test + error UX (@tj-smith47)
• c7a898b determinism polish — sentinel allow-list, stage typo error, SDE bounds (@tj-smith47)
• 544a414 drain all 9 actionable items (@tj-smith47)
• 30fbff0 rollback v0.6.0 [skip ci] (anodize-rollback)
• 9beb7c1 polish --rollback-only error UX + help text (@tj-smith47)
• cf76718 polish B6 — rollback-only summary, conflict, doc walkthrough (@tj-smith47)
• ae370f9 emit head_samples_b64 in drift rows; add -C strip=symbols (@tj-smith47)
• 0783c05 log discovered artifacts when --inject-drift misses (@tj-smith47)
• d7e099e upload full drifted binaries alongside report (@tj-smith47)
• c7b05a8 correct manifest field doc to absolute path (@tj-smith47)
• 37cfd8d drain Stream 2 final review minors 1-3 (@tj-smith47)
• 6d7a7d1 correct stale rustdoc/comments across publish, loader, docker, release (@tj-smith47)
• 8136c64 fix doc-orphan attribution and targeted comment hygiene (@tj-smith47)
• fcd3f13 scrub GoReleaser/Go-source refs from comments (@tj-smith47)
• 06726f8 close 🚧 entries after final-four implementation (@tj-smith47)
• b51891b create feature matrix tracking release-resilience + determinism rollout (@tj-smith47)
• 6f27c90 integrate release-resilience + determinism rows into existing release tree (@tj-smith47)
• 4274139 link operator guides to rendered docsite (@tj-smith47)
• b763842 logo + badges + dogfood anodizer-action and anodize tag (@tj-smith47)
• 697c3b4 correct release_invocation_matrix stale comments (@tj-smith47)
• 8a592f9 split pipeline.rs into focused submodules (@tj-smith47)
• c496fe8 lift Command::new sites out of cli/commands per module-boundaries.md + update allow-list (@tj-smith47)
• 34c2ffd remove gobinary shim and make build config subtree strict (@tj-smith47)
• 061ebe2 single config/workspace load + harden coherence guard (@tj-smith47)
• 8310dce nest per_crate/root under changelog.files (@tj-smith47)
• 06a9fd5 extract shared render-and-stage helper from bump (@tj-smith47)
• bb88716 no-dot synthesized tag_template + share global prefix (@tj-smith47)
• 3bbb13c unify wire-format decoder; thread workspace_root into narrowed fetch (@tj-smith47)
• dd691be single-pass author + staged-name derivation; doc signature_suffix expansion gap (@tj-smith47)
• 5c1dd82 route default-resolution through resolved_*() accessors (@tj-smith47)
• ab17abb dedup determinism config probes onto cwd-free loader (@tj-smith47)
• bb4af7a route version-files guard through shared helpers (@tj-smith47)
• addcb5c DRY context setup + UX improvements #none (@tj-smith47)
• 9c62200 deep-audit batch 3 — dedup, size-cap, observability (@tj-smith47)
• b5d2af5 split release.rs into release/{mod,milestones,split}.rs #none (@tj-smith47)
• 52d303a extract per-check helpers from giant run_checks (@tj-smith47)
• 9d6fa32 extract per-section helpers from giant run() (@tj-smith47)
• 490ec2d restore IsPrepare rationale + explicit preflight return (@tj-smith47)
• c4265bd extract shared merge-mode context prelude (@tj-smith47)
• dde701b strip codebase-wide session-narrative labels (@tj-smith47)
• b3f37b4 strip session-narrative labels, add end-to-end determinism test, warn on crate-name collision (@tj-smith47)
• 1395876 DEC-5 hard-break — drop GR back-compat aliases + deprecation surface (@tj-smith47)
• ddaf840 WAVE 1 — DEC-6 skip rename + DEC-7 env Vec migration (@tj-smith47)
• 488fd62 WAVE 1.5 follow-up — drain remaining log strings + helper migrations (@tj-smith47)
• 77501c4 WAVE 1.5 mop-up — final vocabulary + helper consolidation (@tj-smith47)
• 5142346 WAVE 1.5 — vocabulary closure (skip rename + env helper) (@tj-smith47)
• 9fa0648 WAVE 2 mop-up — broader skip suppression + path-mirror cleanup (@tj-smith47)
• 9e01bcf WAVE 4 follow-up — enforce cask url-template precedence + nested-merge test (@tj-smith47)
• 2232e11 WAVE 5 mop-up — close 3 critical + 6 important + 3 minor review findings (@tj-smith47)
• 0188e45 WAVE 5.1 — type-coercion batch (SCH-1/3/7/15/25/29) (@tj-smith47)
• c203edf WAVE 5.5 — hard-break legacy-field batch (SCH-4/13/16/21/30, DEC-12/13) (@tj-smith47)
• c682102 address submitter-warning review findings (@tj-smith47)
• 70cc609 rename Go-named goos/goarch surfaces to os/arch (@tj-smith47)
• c5303ce deep-audit batch 1 — security, dedup, dead-code sweep (@tj-smith47)
• 4ee7c4c lift changelog stage outputs into Context::stage_outputs (@tj-smith47)
• 0d777b1 split harness into module dir; drop redundant cleanup (@tj-smith47)
• 0b72e19 finish T3 sweep — sde/template/installer/cli tests off unsafe env mutation (@tj-smith47)
• 8d5b8bc allow_empty is plain bool, not Option (@tj-smith47)
• 4d1d2af behavioral installer-gate tests + HashSet de-dup (@tj-smith47)
• bb48ea5 extract HookRunContext from run_hooks signature (@tj-smith47)
• e76ac9e left-align headers, tighten body indent, silence skips (@tj-smith47)
• 91ae9ad unify CLI output on the Cargo+release format (format B) (@tj-smith47)
• cf86448 route config-resolution failures through strict_guard (@tj-smith47)
• 01c7926 hoist tokio runtime out of loop to eliminate Option-init dance (@tj-smith47)
• 723cc40 address review findings (trim render, DRY tests) (@tj-smith47)
• 560f5f5 DRY error delegation + tag-prefix helper; fix comments (@tj-smith47)
• 92b4dfa share rustc -vV spawn; fold RustcVersion into runtime vars (@tj-smith47)
• 9f7bf4f WAVE 3 mop-up — dispatcher DRY + Linux test fix + docs sync (@tj-smith47)
• 050e0ec extract resolve_tag_to_crate + surface git errors (@tj-smith47)
• a34d847 use Context::retry_policy() everywhere (@tj-smith47)
• 9bacbbc apply review tweaks to root-discovery helpers (@tj-smith47)
• 62db912 hoist rollback tag regexes to LazyLock, drop expect(len 1) (@tj-smith47)
• a63f193 model flat-aggregate as its own RepoShape variant (@tj-smith47)
• 2e06d8d share the whole-word token matcher (@tj-smith47)
• bd7dd3f unify workspace-root discovery across bump/tag/changelog (@tj-smith47)
• 8a1c609 dedup ResolvedConfig clone, cargo-version read, tag-override resolver; warn on forward var ref (@tj-smith47)
• 3a33b40 centralize HTTP test responder; fix race across workspace (@tj-smith47)
• 0e8f60f RAII cwd/tempdir guards, drift notes, drop guard naming (@tj-smith47)
• ecd50ad deep dedup pass + wire all dead CLI flags and config fields (@tj-smith47)
• 2af0e4e extract CLI types to lib.rs for xtask introspection (@tj-smith47)
• 7cbfb9a remove session-narrative Step N: markers from production comments (@tj-smith47)
• f9ba2da rename anodize to anodizer (crates.io name clash) #none (@tj-smith47)
• da916fa reorder pipeline stages to match GoReleaser parity (@tj-smith47)
• 441b326 unwrap/expect -> ?/context (142 -> 0 non-test lib sites) + publisher cleanup #none (@tj-smith47)
• c4f7c1c cycle 14 MSVC kitchen-sink link flags (80c672d) (@tj-smith47)
• c7fd04f drop sign from harness default stages (fe46c86, partial) (@tj-smith47)
• 6c11bc7 eliminate all unsafe code from production (@tj-smith47)
• 5a51f78 lower redact threshold + redact log leaks (P7+Q13+Q14) (@tj-smith47)
• a6a2f98 harden unwrap paths, secret handling, path traversal, and regex injection (@tj-smith47)
• dfbc95d scrub session-narrative + assistant-pronoun violations #none (@tj-smith47)
• a55923d scrub our-pronoun in cargo-package doc comment (@tj-smith47)
• 621433c strip session-note markers + fix cloudsmith docstring (@tj-smith47)
• c7dc32d trim publish-only union-test docs to invariant statement (@tj-smith47)
• 8eb2026 close flat-aggregate coverage gaps (graft name, release-notes, bump/tag) (@tj-smith47)
• 2f20014 e2e matrix for root/per-crate/both destinations + chronology (@tj-smith47)
• d8d4e8b port range tests to positional syntax + cross-engine e2e (@tj-smith47)
• bfd0cc9 tighten tag-chronology divergence assert, drop plan marker (@tj-smith47)
• c37e86d repoint determinism-shape assertions at the reusable workflow (@tj-smith47)
• 4ca7cce add e2e test for release --prepare (@tj-smith47)
• e2e019b add smoke test for anodizer man roff output (@tj-smith47)
• 62d0ea8 assign unique archive ids in multi-format e2e test (Q-arch2 fixup) (@tj-smith47)
• b69e645 binary-level I14 regression - required-failure gates exit code (@tj-smith47)
• 032bcd1 real drift integration test + shared FakePublisher + drop empty-stubs (@tj-smith47)
• 5986593 pin find_config_in / load_repo_config candidate parity (@tj-smith47)
• 3209295 C-wave SDD harness application — 200+ tests, 80.7% to 82.5% line #none (@tj-smith47)
• 61b9aae tighten pre-flight coverage from review findings (@tj-smith47)
• 246ee75 update announce-ordering test for terminal verify-release stage (@tj-smith47)
• f5717e3 lock in shard-manifest union contract (@tj-smith47)
• 7640a5e assert binary_signs/before/after dont leak across per-crate overlays (@tj-smith47)
• 9ecf034 exercise non-required gate via a non-binary publisher (@tj-smith47)
• ee71e9d parse skip stages from the [stage] tag (new output format) (@tj-smith47)
• 5eb96f7 strengthen skip-matrix assertions and add missing docs-table rows (@tj-smith47)
• de9875e assert warn-log capture instead of helper string compare (@tj-smith47)
• b6a9455 cover announcers, srpm, release split + milestones (@tj-smith47)
• c33b614 close per-crate changelog test gaps + version_files cohesion (@tj-smith47)
• 4e40d60 cover --crate --push, --push-dry-run, rollback reject, ff hint (@tj-smith47)
• f8d1af2 prove --push lands the bump commit, no orphans on reject (@tj-smith47)
• a200115 add 22 E2E pipeline tests for multi-format, changelog, workspace, and round-trip scenarios (@tj-smith47)
• c8b1dd3 add 28 error path tests across config, template, build, release, and CLI (@tj-smith47)
• 0355b36 add Wave A behavioral coverage for uncovered helper paths (@tj-smith47)
• 3c1f06c add error path tests for config validation, failed builds, and unknown fields (@tj-smith47)
• 8098fc7 make Windows-host test fixtures path-portable (@tj-smith47)
• 362c62c raise coverage across publish/announce/cli (@tj-smith47)

---

Released with anodizer 🦀