fnox 1.25.1

A flexible secret management tool supporting multiple providers and encryption methods
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173

name: release

permissions: {}

on:
  push:
    tags:
      - v[0-9]+.*
  workflow_dispatch:
    inputs:
      version:
        description: "Version (without leading v)"
        required: true
        type: string

env:
  CARGO_TERM_COLOR: always
  GITHUB_TOKEN: ${{ secrets.FNOX_GH_TOKEN }}

jobs:
  build-binaries:
    runs-on: ${{ matrix.os }}
    permissions:
      contents: write
    strategy:
      fail-fast: false
      matrix:
        include:
          - target: aarch64-apple-darwin
            os: macos-latest
            build-tool: cargo
          - target: x86_64-apple-darwin
            os: macos-latest
            build-tool: cargo
          - target: x86_64-unknown-linux-gnu
            os: ubuntu-latest
            build-tool: cross
          - target: aarch64-unknown-linux-gnu
            os: ubuntu-latest
            build-tool: cross
          - target: x86_64-unknown-linux-musl
            os: ubuntu-latest
            build-tool: cross
          - target: aarch64-unknown-linux-musl
            os: ubuntu-latest
            build-tool: cross
          - target: x86_64-pc-windows-msvc
            os: windows-latest
            build-tool: cargo
          - target: aarch64-pc-windows-msvc
            os: windows-latest
            build-tool: cargo
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
        with:
          token: ${{ secrets.FNOX_GH_TOKEN }}
          persist-credentials: false
      - if: matrix.os == 'macos-latest'
        uses: apple-actions/import-codesign-certs@5142e029c445c10ffc7149d172e540235a065466 # v7
        with:
          p12-file-base64: ${{ secrets.CERTIFICATES_P12 }}
          p12-password: ${{ secrets.CERTIFICATES_P12_PASS }}
      - uses: taiki-e/upload-rust-binary-action@f0d45ae91ee7b8ee928de7a9d04d893a08bcbec6 # v1
        with:
          bin: fnox
          target: ${{ matrix.target }}
          build-tool: ${{ matrix.build-tool }}
          token: ${{ secrets.FNOX_GH_TOKEN }}
          codesign: "Developer ID Application: Jeffrey Dickey (4993Y37DX6)"
          codesign_prefix: dev.jdx.
          dry-run: true # Always dry-run to just build without uploading
      - name: Upload binary artifact
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: binary-${{ matrix.target }}
          path: |
            fnox-*.tar.gz
            fnox-*.tar.xz
            fnox-*.zip
          retention-days: 1

  create-release:
    needs: [build-binaries]
    runs-on: ubuntu-latest
    permissions:
      contents: write
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
        with:
          fetch-depth: 0
          token: ${{ secrets.FNOX_GH_TOKEN }}
          persist-credentials: false
      - name: Extract release notes from CHANGELOG.md
        run: |
          awk '/^## \[/{if(found) exit; found=1} found{print}' CHANGELOG.md > release-notes.md
      - name: Download all artifacts
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
        with:
          path: artifacts
      - name: Prepare release assets
        run: |
          mkdir -p release-assets
          find artifacts/binary-* -type f \( -name "*.tar.gz" -o -name "*.tar.xz" -o -name "*.zip" \) -exec mv {} release-assets/ \;
          ls -la release-assets/
      - name: Create release with all assets
        run: |
          if [[ -n "${INPUTS_VERSION}" ]]; then
            TAG_NAME="v${INPUTS_VERSION}"
          else
            TAG_NAME="${GITHUB_REF_NAME}"
          fi
          gh release create "$TAG_NAME" \
            --title "$TAG_NAME" \
            --notes-file release-notes.md \
            release-assets/*
        env:
          INPUTS_VERSION: ${{ inputs.version }}

  enhance-release:
    needs: [create-release]
    runs-on: ubuntu-latest
    permissions:
      contents: write
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
        with:
          fetch-depth: 0
          persist-credentials: false
      - uses: jdx/mise-action@1648a7812b9aeae629881980618f079932869151 # v4
        with:
          experimental: true
          cache: false
      - run: mise trust --all
      - name: Enhance release notes with communique
        run: |
          if [[ -n "${INPUTS_VERSION}" ]]; then
            TAG_NAME="v${INPUTS_VERSION}"
          else
            TAG_NAME="${GITHUB_REF_NAME}"
          fi
          communique generate "$TAG_NAME" --github-release
        env:
          ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
          INPUTS_VERSION: ${{ inputs.version }}
      - name: Append en.dev sponsor blurb
        env:
          GH_TOKEN: ${{ secrets.FNOX_GH_TOKEN }}
          INPUTS_VERSION: ${{ inputs.version }}
        run: |
          if [[ -n "${INPUTS_VERSION}" ]]; then
            TAG_NAME="v${INPUTS_VERSION}"
          else
            TAG_NAME="${GITHUB_REF_NAME}"
          fi
          # Strip any pre-existing "Sponsor fnox" section from the body so the
          # canonical block we append below isn't duplicated. Matches headings
          # like "## Sponsor fnox" or "## 💚 Sponsor fnox" and drops everything
          # through the next top-level heading.
          gh release view "$TAG_NAME" --json body --jq .body \
            | awk '
                /^## .*Sponsor fnox[[:space:]]*$/ { skip=1; next }
                skip && /^## / { skip=0; print; next }
                !skip { print }
              ' > /tmp/release-notes.md
          cat >> /tmp/release-notes.md <<'EOF'

          ## 💚 Sponsor fnox

          fnox is maintained by [@jdx](https://github.com/jdx) under [**en.dev**](https://en.dev) — a small independent studio building developer tooling like [mise](https://mise.jdx.dev/), [aube](https://aube.en.dev/), hk, and more. Keeping fnox secure, maintained, and free is funded by sponsors.

          If fnox is handling secrets or config for you or your team, please consider [sponsoring at en.dev](https://en.dev). Sponsorships are what let fnox stay independent and the project keep moving.
          EOF
          gh release edit "$TAG_NAME" --notes-file /tmp/release-notes.md