# Changelog
All notable changes to EnvOrigin are documented here. The format follows
[Keep a Changelog](https://keepachangelog.com/), and this project adheres to
[Semantic Versioning](https://semver.org/).
## [1.8.0] - 2026-08-06
### Added
- `dotenv audit` applies `envorigin.toml` rules (`--config`): prefix,
forbidden, patterns, allowed, max_length on file entries. Invalid rules
files fail loudly.
## [1.7.0] - 2026-08-06
### Added
- `envorigin dotenv audit <files...>` — full security check matrix on
standalone `.env` files with no Compose context, plus `--fail-on` and
`--format` (including GitHub annotations).
## [1.6.0] - 2026-08-06
### Added
- Audit detects known secret formats by value shape (`AKIA…` AWS,
`ghp_…` GitHub PAT, `sk_live_…` Stripe, Slack, `sk-…` API keys) —
more reliable than name matching. All four backends.
## [1.5.0] - 2026-08-06
### Added
- Audit reports `private-key-in-value` (error) for any variable whose value
embeds a PEM private key block. All four backends.
## [1.4.0] - 2026-08-06
### Added
- Audit reports `credential-in-url` (error) for any variable whose value
embeds credentials in a URL (`scheme://user:pass@host`) — the most
common leak vector, usually under non-sensitive names like
`DATABASE_URL`. All four backends.
## [1.3.0] - 2026-08-06
### Added
- Audit flags unused sensitive interpolation variables: a plaintext secret
in `.env` gets the full sensitive-value / placeholder /
secret-manager-reference checks even when no service consumes it.
## [1.2.0] - 2026-08-06
### Added
- `envorigin init` — writes a commented rules template covering all six
rule types; never overwrites an existing file.
## [1.1.0] - 2026-08-06
### Added
- `audit --ignore <code>` (repeatable) — exempt issue codes across the
report, annotations, and `--fail-on` exit code, for onboarding legacy
projects and removing ignores as problems get fixed.
## [1.0.0] - 2026-08-06
### Added
- `explain --debug` — full resolution trace (every definition in the
interpolation context with precedence and order).
### Changed
- First stable release: the entire roadmap is implemented — four
backends (Docker Compose, GitHub Actions, GitLab CI, CircleCI) with
scan/explain/audit/diff/graph, a six-rule conventions engine, LSP +
VS Code extension, shell completions, JSON/GitHub-annotation audit
output, and an automated release pipeline (crates.io + Homebrew +
GitHub Releases), backed by 100 tests and real-repository validation.
## [0.9.0] - 2026-08-06
### Added
- Rules engine: `[allowed]` enum whitelists (`disallowed-value` error) and
`[max_length]` length caps (`value-too-long` error), alongside
required/prefix/forbidden/patterns.
## [0.8.0] - 2026-08-06
### Added
- `audit --format github` — GitHub Actions workflow commands; problems are
annotated on the offending file lines in pull requests
(severity maps to error/warning/notice; % and newlines escaped).
- CI integration guide in the README (GitHub Actions / GitLab CI /
CircleCI snippets).
## [0.7.0] - 2026-08-06
### Added
- `--format json` on all four audit commands: machine-readable issues
array (severity/code/message/path/line) for CI pipelines.
## [0.6.0] - 2026-08-06
### Added
- VS Code extension packaging verified (`npx @vscode/vsce package` +
`code --install-extension`), version synced with the CLI.
- LSP E2E coverage for all compose filename variants; performance
documentation (800-variable project scans in ~0.3s).
### Testing
- Unit coverage for graph rendering across all four backends (36 unit
tests total).
## [0.5.1] - 2026-08-06
### Fixed
- `completions` output piped into `head`/`grep` no longer panics on a
broken pipe.
## [0.5.0] - 2026-08-06
### Added
- `envorigin completions <shell>` — bash/zsh/fish completion scripts
(installed automatically by the Homebrew formula).
- Rules engine `[patterns]` — per-variable value format validation
(`pattern-mismatch` error; invalid regexes reported, not panicked).
- `scripts/release.sh` — one-command release pipeline (verified end to end
on 0.4.0 and 0.4.1).
- Real-world example in the README (outline production compose audit).
### Fixed
- LSP routed only `.yml` workflow files, silently dropping `.yaml`;
both suffixes now route. Step-level diagnostics (`GITHUB_ENV` writes)
now surface in the editor.
- Unnamed action steps displayed the 0-based internal index; now 1-based.
### Testing
- Unit coverage for the Compose, GitLab, and CircleCI analyzers, the
audit classification predicates, and LSP routing (28 unit tests total).
## [0.4.1] - 2026-08-06
### Fixed
- LSP routed only `.yml` workflow files, silently dropping `.yaml` files
(no diagnostics or hover in the editor); both suffixes now route.
- LSP now surfaces step-level diagnostics (`GITHUB_ENV` runtime writes were
invisible in the editor).
- Homebrew formula installs shell completions.
## [0.4.0] - 2026-08-06
### Added
- Rules engine: `[patterns]` per-variable value format validation
(`pattern-mismatch` error; invalid regexes reported, not panicked).
- `scripts/release.sh` — one-command release (tag, GitHub release,
crates.io, Homebrew formula update).
- LSP analyzes unsaved buffer edits in memory (all four backends via
`with_content` variants; relative references still resolve on disk).
- Audit reports `secret-manager-reference` (info) for values pointing at
Vault, AWS Secrets Manager/SSM, or secret templating.
## [0.3.0] - 2026-08-06
Released to crates.io, GitHub Releases, and the Homebrew tap.
### Added
- `envorigin gitlab` — GitLab CI variables analysis: `include: local` files <
file-global `variables:` < job-level `variables:`, `$VAR` reference
tracking, predefined `CI_*`/`GITLAB_*`/`RUNNER_*` variables, external
`include: remote`/`template` reporting.
- `envorigin circleci` — CircleCI environment analysis: executor
`environment:` < job `environment:`/`env:` list, `<< parameters.X >>`
reference tracking to the declaration, `context:`/`<< pipeline.X >>`
reported as external, `CIRCLE_*` predefined variables.
- `envorigin lsp` — Language Server Protocol server (hover, go-to-definition,
live diagnostics) plus a VS Code extension client under `vscode/`.
- `envorigin diff` — environment drift comparison across dotenv files
(sensitive values redacted by default).
- `envorigin audit` / `envorigin actions audit` — env health reports with
`--fail-on` CI gate: sensitive values (placeholder-aware), shadowed
dead-code lines, unused interpolation variables.
- `envorigin graph` / `envorigin actions graph` — mermaid provenance
visualization.
- `COMPOSE_ENV_FILES` expansion; shadowed dead-code annotations in `scan`;
`env_file format: raw` end-to-end coverage.
### Changed
- Interpolation engine (`InterpolationContext`) is now generic over the
source-reference type, shared by all four backends.
- Toolchain raised from Rust 1.85 to 1.86 (tower-lsp dependency).
- Audit placeholder detection: example-like values (`WordPress`, `changeit`)
downgrade to `sensitive-placeholder` warnings instead of errors.
### Fixed
- Interpolation-file variables referenced only through `$VAR`/`${VAR}` were
reported as unused by the audit; reference detection now scans raw source
files.
- Real-repository validation against all 39 `docker/awesome-compose` examples
(all parse and resolve; findings fixed the placeholder and unused-variable
checks). Real GitLab CI templates and a JSON-format CircleCI config also
parse and resolve correctly.
## [0.2.0] - 2026-08-06
### Added
- `envorigin actions` — GitHub Actions workflow environment analysis:
workflow/job/step `env:` layers, `env: file:` references, `${{ }}`
expression tracking, `GITHUB_ENV` runtime writes flagged, predefined
variables, `workflow_dispatch`/`workflow_call` inputs.
## [0.1.0] - 2026-08-06
### Added
- `envorigin scan` / `envorigin explain` — Docker Compose environment
variable provenance: shell, interpolation files, `env_file` layers,
`environment:` overrides, cross-checked against `docker compose config`.
- Default value redaction (SHA-256 fingerprint), `--show-values`,
`--format json`, `--host-env-file`, `--no-docker-check`.