v0.3.2

Docs

• README's Provider/Store interface snippet was out of date — missing
  the loc *time.Location parameter on Put/Latest/Has,
  Provider.Location(), and Store.ListPoints.
• Help text now lists get (not just list-points/fetch) among the
  commands SMARTMETER_PASSPHRASE/SMARTMETER_DATA_DIR fall back for.
• README now lists raw as a valid -sample value (it's the default).

CI

• The three github/codeql-action pins (init/autobuild/analyze) must
  move together — CodeQL refuses to run when they're on different versions.
  Dependabot opened three separate PRs for the v4.37.9 bump, each breaking
  the analyze job on its own; bumped all three in one commit instead and
  closed the individual PRs.

Internal

• Added a test covering exitCodeForParseErr, the last untested function
  turned up by this pass's coverage check.

Dependencies

• docker/login-action 3.7.0 → 4.6.0
• docker/setup-buildx-action 4.2.0 → 4.3.0
• github/codeql-action (init/autobuild/analyze) 4.37.8 → 4.37.9

Full diff: v0.3.1...v0.3.2

v0.3.1

Fixed

• Stale main.go package comment claiming internal/api wasn't implemented
  yet — it has been since serve shipped in v0.3.0.

Docs

• SMARTMETER_ADDR (the serve -addr default) is now documented among
  the other environment variables.

Internal

• config.SaveSecrets now reuses atomicfile.WriteFile instead of a
  hand-rolled temp-file-plus-rename, so there's one atomic-write
  implementation instead of two.
• Added a test covering atomicfile.WriteFile's MkdirAll error path.

Dependencies

• golang.org/x/crypto 0.54.0 → 0.55.0
• goreleaser/goreleaser-action 6.4.0 → 7.2.3
• docker/setup-buildx-action 3.12.0 → 4.2.0
• docker/setup-qemu-action 3.7.0 → 4.2.0
• trufflesecurity/trufflehog 3.96.0 → 3.97.1
• CodeQL Action pins kept in sync (v4.37.8)

Full diff: v0.3.0...v0.3.1

v0.3.0

New: serve command and versioned HTTP API

• smartmeter-fetch serve runs the /v1 query API against a -data-dir —
  GET /v1/points and GET /v1/readings?point=<id>&since=<RFC3339>,
  spec at GET /openapi.json. This is the contract
  hass-smartmeter will consume.
• Store.ListPoints enables point discovery straight from stored data,
  without portal credentials.

New: container image

• smartmeter-fetch is now published to ghcr.io/welworx/smartmeter-fetch
  as a distroless, multi-arch (amd64/arm64) image on every release. Its
  entrypoint is serve; new data is pulled in via
  podman exec <container> /smartmeter-fetch fetch -since-latest on a host
  cron schedule.

New: upgrade command

• smartmeter-fetch upgrade checks GitHub for a newer release and can
  download, verify, and install it in place (-y to skip the confirmation
  prompt).

New: .deb packages

• Releases now ship a .deb package (via nfpm) alongside the plain
  binaries, for apt install-based installs on Debian/Ubuntu.

Fixed: path traversal in the store (CodeQL CWE-22)

• Provider/point names are validated and confined under Store.Dir before
  any filesystem access, closing a path-traversal alert CodeQL flagged in
  Store.Get.

Docs

• README documents the serve command, container deployment, upgrade,
  and all environment variables; adds Coverage and Release badges.

Full diff: v0.2.0...v0.3.0

v0.2.0

New: get command

• smartmeter-fetch get ensures the requested range is fetched, then reads it
  back and prints/writes it — no separate fetch step needed.
• Output as text, JSON, or CSV.
• -sample aggregation: hour/day/week/month/quarter.
• -out path templating with per-path file grouping, date placeholders
  rendered in the provider's local time (Vienna for EVN).
• Fails loudly if the underlying fetch errors, instead of silently
  returning stale or empty data.

Fixed: day-boundary bucketing

Stored days are now bucketed by the provider's own timezone
(Provider.Location()), not UTC — a reading near midnight no longer risks
landing in the wrong day's file.

CI/CD hardening

• pre-commit now runs golangci-lint and a gitleaks secret scan, not just
  fmt/vet/test.
• New govulncheck workflow (weekly + on PR), separate from CodeQL.
• Releases are now built with goreleaser instead of a hand-rolled
  cross-compile loop; a goreleaser-check job catches a broken release
  config on every PR, before a tag is pushed.
• All GitHub Actions pinned to commit SHAs instead of mutable tags.
• trufflehog secret scan added to CI as a backstop.
• go.mod/go.sum tidiness and .golangci.yml's rule set are checked more
  thoroughly (bodyclose, gosec, errname, unconvert, dupword, misspell,
  whitespace).
• Added CODEOWNERS.

Full diff: v0.1.0...v0.2.0

v0.1.0

Initial release: logs into the Netz NÖ (EVN) smart meter web portal and fetches quarter-hourly consumption/production readings, storing them locally as JSON.

Features

• EVN/Netz NÖ provider: portal login, list metering points, fetch a day's quarter-hourly readings
• JSON file store: one file per provider/point/day (data/<provider>/<point>/<date>.json), written atomically
• CLI: list-points, fetch (single day, date range, or -since-latest to resume from the last stored day), profile (add/list/update/verify/remove/passphrase)
• Passphrase-encrypted credential store (argon2id + AES-256-GCM), no OS keyring dependency — or plain -user/-password/env vars for a single login
• Days already stored are skipped by default (-force to re-fetch, since the portal may revise a day after the fact)
• Portal data-quality codes (L2/L3, substitute values) surfaced per reading

CI: gofmt/vet/golangci-lint/race-tested build on every push/PR; CodeQL analysis on push/PR and weekly schedule; tagged releases build darwin/linux/windows x amd64/arm64 binaries via GitHub Actions.

Known gaps

• The versioned query API (/v1/points, /v1/readings) isn't implemented yet — this release only covers fetch + local storage
• Only the EVN/Netz NÖ provider exists; other grid operators aren't supported
• Only the JSON file store backend exists; a database backend isn't built until a real need shows up

Disclaimer

Unofficial, independent, educational-use tool, not affiliated with or endorsed by Netz NÖ or any other grid operator. Check the portal's Terms of Service before use.