From f5d1d9fe0f07558c023365ac02416d17f2a4e4b8 Mon Sep 17 00:00:00 2001 From: Shinrai Date: Sat, 3 Oct 2026 20:51:45 -0700 Subject: [PATCH 1/2] docs: backfill changelogs for v1.0.2 through v1.0.10 --- docs/changelog/v1/v1.0.10.md | 25 +++++++++++++++ docs/changelog/v1/v1.0.2.md | 61 ++++++++++++++++++++++++++++++++++++ docs/changelog/v1/v1.0.3.md | 35 +++++++++++++++++++++ docs/changelog/v1/v1.0.4.md | 23 ++++++++++++++ docs/changelog/v1/v1.0.5.md | 23 ++++++++++++++ docs/changelog/v1/v1.0.6.md | 28 +++++++++++++++++ docs/changelog/v1/v1.0.7.md | 30 ++++++++++++++++++ docs/changelog/v1/v1.0.8.md | 38 ++++++++++++++++++++++ docs/changelog/v1/v1.0.9.md | 25 +++++++++++++++ 9 files changed, 288 insertions(+) create mode 100644 docs/changelog/v1/v1.0.10.md create mode 100644 docs/changelog/v1/v1.0.2.md create mode 100644 docs/changelog/v1/v1.0.3.md create mode 100644 docs/changelog/v1/v1.0.4.md create mode 100644 docs/changelog/v1/v1.0.5.md create mode 100644 docs/changelog/v1/v1.0.6.md create mode 100644 docs/changelog/v1/v1.0.7.md create mode 100644 docs/changelog/v1/v1.0.8.md create mode 100644 docs/changelog/v1/v1.0.9.md diff --git a/docs/changelog/v1/v1.0.10.md b/docs/changelog/v1/v1.0.10.md new file mode 100644 index 0000000..2db42ac --- /dev/null +++ b/docs/changelog/v1/v1.0.10.md @@ -0,0 +1,25 @@ +# @cldmv/envm v1.0.10 Changelog + +**Release Date**: October 2026 +**Release Type**: Patch +**Availability**: GitHub Release only ([v1.0.10](https://github.com/CLDMV/envm/releases/tag/v1.0.10)); not published to npm + +--- + +## Overview + +A CI-only release: the `βœ… Required PR Check` mirror job now runs on every path instead of being skipped on in-repo feature PRs. No library or CLI code changed. + +--- + +## πŸ”§ CI & tooling + +### Run the in-repo PR mirror job instead of skipping it ([#32](https://github.com/CLDMV/envm/pull/32)) + +The fix in [v1.0.9](./v1.0.9.md) gave the mirror job a conditional name so a skipped run would not report under the required name, but GitHub does not evaluate the `name:` of a skipped job, so the skipped run showed up under the raw expression text. The job now always runs (`if: always()`), so its name is always evaluated: on the paths that own the status it reports as `βœ… Required PR Check` and mirrors the test matrix's result, and on an in-repo feature PR's `pull_request` run it reports as `⏭️ Required PR Check (reported by the push run)` and exits as a no-op. + +--- + +## Upgrade notes + +- No runtime changes. diff --git a/docs/changelog/v1/v1.0.2.md b/docs/changelog/v1/v1.0.2.md new file mode 100644 index 0000000..c353583 --- /dev/null +++ b/docs/changelog/v1/v1.0.2.md @@ -0,0 +1,61 @@ +# @cldmv/envm v1.0.2 Changelog + +**Release Date**: August 2025 +**Release Type**: Initial release + +--- + +## Overview + +First release of `@cldmv/envm`, a cross-platform environment variable manager for Node.js. It is ESM-only and class-free: the API is a single `envManager` object of plain functions, and the package also ships an `envm` command-line tool. Windows is backed by the registry (via `reg`), POSIX by `~/.profile` and `/etc/environment`. This is the only version published to npm. + +On POSIX, reading a `user` or `system` scope value (`getRaw`, and therefore `getExpanded`, `path.get` and the verification step inside `set` / `unset`) is not implemented in this release and throws `Not implemented`; the `session` scope works everywhere, and the Windows adapter reads all three scopes. + +--- + +## ✨ Features + +### Node.js API + +`import { envManager } from "@cldmv/envm"` exposes: + +- `envManager.getRaw(name, { scope })` and `envManager.getExpanded(name, { scope })` read a variable; expansion handles `%VAR%` on Windows and `$VAR` / `${VAR}` on POSIX. +- `envManager.set(name, value, { scope, backup, verify, rollbackOnFail })` and `envManager.unset(name, { scope, backup, verify, rollbackOnFail })` write or remove a variable and resolve to a result object (`ok`, `scope`, `name`, `previous`, `next`, `verification`, `rollback`, `notes`). +- `envManager.path.{get,prepend,append,remove,sort,unique}` manipulate PATH-like variables (default name `PATH`, delimiter `;` on Windows and `:` elsewhere, overridable with `delim`); `prepend` and `append` accept `unique` and `validate`. +- `envManager.backup.{list,restore,setBackupDir,getBackupDir,purge}` manage backups. +- `envManager.platform` (`"win"` or `"posix"`) and `envManager.delim` report the active adapter. + +### Scopes + +- `session`: the current process only (`process.env`). +- `user`: `HKCU\Environment` on Windows, a managed `# envm-begin` / `# envm-end` block in `~/.profile` on POSIX. +- `system`: `HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment` on Windows, `/etc/environment` on POSIX. + +### CLI + +The `envm` binary (`dist/cli.mjs`, also exported as `@cldmv/envm/cli`) supports: + +- `envm get`, `envm set`, `envm unset` with `--name`, `--value` and `--scope` (default `session`); `get` takes `--raw` or expanded output. +- `envm path get|prepend|append|remove|sort|unique` with `--values` split on the platform delimiter, plus `--unique` and `--validate`. +- `envm backup list` and `envm backup restore `. +- `--backup false` and `--verify false` to turn those safeguards off, `--dry-run` to preview `set` / `unset`, and `envm version` / `--version`. + +### Safety and backups + +- Writes to the `user` and `system` scopes create a timestamped backup first (`--.bak`) unless backups are disabled. Windows backups are a `reg export` of the environment key; POSIX backups are the previous contents of the target file. +- After a write the value is read back for verification, and if verification fails and a backup exists the previous state is restored (`rollbackOnFail`, default true). +- Backups live in `.backup/.envm-backups` under the project directory by default; `backup.setBackupDir()` overrides it. +- `backup.purge({ maxPerScope = 20, maxAgeDays = 30 })` removes old backups, and the CLI purges on process exit and on `SIGINT` / `SIGTERM`. +- Windows variable names are normalized to upper case, and PATH de-duplication can be case-insensitive. + +--- + +## πŸ”§ CI & tooling + +- Build is esbuild minification of `src/` into `dist/` with `.mjs` output, run automatically by `prepublishOnly`; tests are written for vitest. The build and clean scripts use Windows `cmd` syntax in this release. + +--- + +## Upgrade notes + +- Initial release; nothing to upgrade from. diff --git a/docs/changelog/v1/v1.0.3.md b/docs/changelog/v1/v1.0.3.md new file mode 100644 index 0000000..31b0431 --- /dev/null +++ b/docs/changelog/v1/v1.0.3.md @@ -0,0 +1,35 @@ +# @cldmv/envm v1.0.3 Changelog + +**Release Date**: August 2026 +**Release Type**: Patch +**Availability**: GitHub Release only ([v1.0.3](https://github.com/CLDMV/envm/releases/tag/v1.0.3)); not published to npm + +--- + +## Overview + +A tooling release: the build now runs on any operating system, the dev toolchain is upgraded (esbuild 0.28, vitest 4), and the repository gains the CLDMV v4 CI/release workflows and a vitest runner. No runtime code under `src/` changed ([#5](https://github.com/CLDMV/envm/pull/5)). + +--- + +## πŸ”§ CI & tooling + +- The `clean` and `build` scripts no longer use Windows-only `cmd` syntax (`rmdir /s /q`, `for %f in ... ren`). `clean` removes `dist/` with Node, and `build` is a single esbuild call that writes `dist/*.mjs` and `dist/platform/*.mjs` using `--out-extension:.js=.mjs --outbase=src`, so the package can be built on Linux and macOS as well as Windows. The emitted file layout is unchanged. +- `test` now runs `node tests/run-vitest.mjs`, a wrapper around `@cldmv/vitest-runner` that runs each test file in its own process; new scripts are `test:watch`, `coverage`, `ci:coverage` and `build:ci`. Vitest settings live in `.configs/vitest.config.mjs`. +- The v4 workflow set (CI, publish, release PR opener and reset, CodeQL, dependency review, Scorecard, CLA, labeler, stale, and related workflows) and `.github/dependabot.yml` are added, and `.github/` is no longer git-ignored. +- One test assertion was corrected: `unique()` is case-sensitive unless told otherwise, so on POSIX `a` and `A` stay distinct (3 segments) and only collapse on Windows (2). + +## πŸ”§ Dependencies + +All changes are dev-only; `@cldmv/envm` still has no runtime dependencies. + +- `esbuild` `^0.19.0` to `^0.28.1` (dev-only). +- `vitest` `^1.0.0` to `^4.1.10` (dev-only). +- **NEW** `@vitest/coverage-v8` `^4.1.10` (dev-only). +- **NEW** `@cldmv/vitest-runner` `^1.2.0` (dev-only). + +--- + +## Upgrade notes + +- No runtime changes; the package's `main`, `exports` and `bin` are unchanged. diff --git a/docs/changelog/v1/v1.0.4.md b/docs/changelog/v1/v1.0.4.md new file mode 100644 index 0000000..116dd01 --- /dev/null +++ b/docs/changelog/v1/v1.0.4.md @@ -0,0 +1,23 @@ +# @cldmv/envm v1.0.4 Changelog + +**Release Date**: August 2026 +**Release Type**: Patch +**Availability**: GitHub Release only ([v1.0.4](https://github.com/CLDMV/envm/releases/tag/v1.0.4)); not published to npm + +--- + +## Overview + +A test-layout release: the test file is renamed to follow the CLDMV `*.test.vitest.mjs` convention. No runtime code changed ([#7](https://github.com/CLDMV/envm/pull/7)). + +--- + +## πŸ”§ CI & tooling + +- `tests/env-manager.test.mjs` is renamed to `tests/env-manager.test.vitest.mjs` (a pure rename, no content change). The vitest `include` glob in `.configs/vitest.config.mjs` and the `testFilePattern` in `tests/run-vitest.mjs` are updated to match. + +--- + +## Upgrade notes + +- No runtime changes. diff --git a/docs/changelog/v1/v1.0.5.md b/docs/changelog/v1/v1.0.5.md new file mode 100644 index 0000000..95de83f --- /dev/null +++ b/docs/changelog/v1/v1.0.5.md @@ -0,0 +1,23 @@ +# @cldmv/envm v1.0.5 Changelog + +**Release Date**: August 2026 +**Release Type**: Patch +**Availability**: Release commit on `master` only; not tagged and not published to npm + +--- + +## Overview + +A CI-only release: the concurrency policy of `ci.yml` changes so release-relevant runs are no longer cancelled. No runtime code changed ([#9](https://github.com/CLDMV/envm/pull/9)). + +--- + +## πŸ”§ CI & tooling + +- `ci.yml` derives the release base branch (the `CLDMV_RELEASE_BASE` variable, falling back to the repository's default branch) instead of hardcoding `master` / `main`. Pushes to the release base, to `next` and `hotfixes`, and `next` / `hotfixes` release PRs now each get a unique concurrency group per run, so a burst of release-time pushes no longer cancels a run and leaves a red cancelled check on the release PR. Feature branches still cancel superseded runs. + +--- + +## Upgrade notes + +- No runtime changes. diff --git a/docs/changelog/v1/v1.0.6.md b/docs/changelog/v1/v1.0.6.md new file mode 100644 index 0000000..cdc0417 --- /dev/null +++ b/docs/changelog/v1/v1.0.6.md @@ -0,0 +1,28 @@ +# @cldmv/envm v1.0.6 Changelog + +**Release Date**: August 2026 +**Release Type**: Patch +**Availability**: GitHub Release only ([v1.0.6](https://github.com/CLDMV/envm/releases/tag/v1.0.6)); not published to npm + +--- + +## Overview + +A maintenance release: an esbuild patch bump and bot-identity secret mappings in three release workflows. No runtime code changed ([#11](https://github.com/CLDMV/envm/pull/11)). + +--- + +## πŸ”§ CI & tooling + +- `feature-pr.yml`, `next-release.yml` and `hotfixes-release.yml` now pass `BOT_NAME` and `BOT_EMAIL` (from the `CLDMV_BOT_NAME` and `CLDMV_BOT_EMAIL` secrets) to the reusable workflows. + +## πŸ”§ Dependencies + +- `esbuild` 0.28.1 to 0.28.2, resolved in the lockfile within the existing `^0.28.1` range (dev-only). +- `vitest` and `@vitest/coverage-v8` 4.1.10 to 4.1.11 in the lockfile (dev-only). + +--- + +## Upgrade notes + +- No runtime changes. diff --git a/docs/changelog/v1/v1.0.7.md b/docs/changelog/v1/v1.0.7.md new file mode 100644 index 0000000..ed6f38a --- /dev/null +++ b/docs/changelog/v1/v1.0.7.md @@ -0,0 +1,30 @@ +# @cldmv/envm v1.0.7 Changelog + +**Release Date**: September 2026 +**Release Type**: Patch +**Availability**: GitHub Release only ([v1.0.7](https://github.com/CLDMV/envm/releases/tag/v1.0.7)); not published to npm + +--- + +## Overview + +A tooling release: vitest 5, the CLDMV bot's GPG secrets for redirected security PRs, and grouped Dependabot updates. No runtime code changed ([#18](https://github.com/CLDMV/envm/pull/18)). + +--- + +## πŸ”§ CI & tooling + +- `hotfix-redirector.yml` now maps `CLDMV_BOT_NAME`, `CLDMV_BOT_EMAIL`, `CLDMV_BOT_GPG_PRIVATE_KEY` and `CLDMV_BOT_GPG_PASSPHRASE` so security PRs redirected to `hotfixes` are cherry-picked as signed commits. +- `ci.yml` and `publish.yml` raise the Node test-matrix defaults: `min_node_version` from `22` to `22.12.0` (the floor vitest 5 runs on) and `max_node_major` from `22` to `26`. +- `.github/dependabot.yml` adds `vitest`, `eslint` and `prettier` update groups so peer-locked packages are bumped together. + +## πŸ”§ Dependencies + +- `vitest` `^4.1.10` to `^5.0.0` (dev-only). +- `@vitest/coverage-v8` `^4.1.10` to `^5.0.0` (dev-only). + +--- + +## Upgrade notes + +- No runtime changes; the package declares no `engines` field, and that is unchanged. diff --git a/docs/changelog/v1/v1.0.8.md b/docs/changelog/v1/v1.0.8.md new file mode 100644 index 0000000..ba48b8d --- /dev/null +++ b/docs/changelog/v1/v1.0.8.md @@ -0,0 +1,38 @@ +# @cldmv/envm v1.0.8 Changelog + +**Release Date**: October 2026 +**Release Type**: Patch +**Availability**: GitHub Release only ([v1.0.8](https://github.com/CLDMV/envm/releases/tag/v1.0.8)); not published to npm + +--- + +## Overview + +A maintenance release with no change to the library or CLI. Every source, test, config and workflow file now carries the uniform CLDMV file header from the shared `@cldmv/configs` fix-headers config, the `LICENSE` file is restored to the verbatim Apache-2.0 text, the workflows are synced with the `CLDMV/.github` v4.29.2 templates, and the vitest toolchain moves to 5.0.2. The only edits under `src/` are the new header comments. + +--- + +## πŸ”§ CI & tooling + +### Uniform file headers from the shared CLDMV config ([#26](https://github.com/CLDMV/envm/pull/26)) + +A new `fix:headers` script runs `@cldmv/fix-headers` against `.configs/fix-headers.json`, which extends `@cldmv/configs/fix-headers.json`. The first run stamped every file under `src/` and `tests/`, `eslint.config.mjs`, `jest.config.mjs` and `.configs/vitest.config.mjs` with a header, and rewrote the workflow headers to the same layout, with ISO 8601 dates. + +### v4 workflow sync with CLDMV/.github v4.29.2 ([#23](https://github.com/CLDMV/envm/pull/23), [#24](https://github.com/CLDMV/envm/pull/24)) + +The workflows are synced with the current templates, adding `bundle-size.yml`, `dependabot-recreate.yml`, `member-auto-merge.yml`, `pr-notify.yml`, `provenance.yml` and `release-merge.yml`, keeping the template's full `release-merge` workflow list, moving `master-commit-audit.yml` onto the reusable workflow, and correcting the template header metadata. + +## πŸ“š Documentation + +- `LICENSE` is restored to the verbatim Apache-2.0 text ([#22](https://github.com/CLDMV/envm/pull/22)): the Trademarks clause regains its "reasonable and customary use" wording. The license terms are unchanged. + +## πŸ”§ Dependencies + +- `vitest` 5.0.0 β†’ 5.0.2 ([#19](https://github.com/CLDMV/envm/pull/19), [#27](https://github.com/CLDMV/envm/pull/27)) and `@vitest/coverage-v8` 5.0.0 β†’ 5.0.2 ([#20](https://github.com/CLDMV/envm/pull/20), [#28](https://github.com/CLDMV/envm/pull/28)) β€” dev-only. +- **NEW** dev dependencies: `@cldmv/configs` `^1.2.0` and `@cldmv/fix-headers` `^2.1.1`, for the header tooling ([#26](https://github.com/CLDMV/envm/pull/26)). + +--- + +## Upgrade notes + +- No runtime changes. diff --git a/docs/changelog/v1/v1.0.9.md b/docs/changelog/v1/v1.0.9.md new file mode 100644 index 0000000..e9b7904 --- /dev/null +++ b/docs/changelog/v1/v1.0.9.md @@ -0,0 +1,25 @@ +# @cldmv/envm v1.0.9 Changelog + +**Release Date**: October 2026 +**Release Type**: Patch +**Availability**: Tagged [`v1.0.9`](https://github.com/CLDMV/envm/tree/v1.0.9); no GitHub Release and not published to npm + +--- + +## Overview + +A CI-only release: a skipped PR run can no longer satisfy the `βœ… Required PR Check` ruleset. No library or CLI code changed. + +--- + +## πŸ”§ CI & tooling + +### A skipped PR run no longer satisfies Required PR Check ([#30](https://github.com/CLDMV/envm/pull/30)) + +On an in-repo feature PR, the `pull_request` run skips the `required-check` mirror job because the push run on the head branch owns the status. GitHub still posts a check run for a skipped job and treats a skipped required check as passing, so the skipped job, named `βœ… Required PR Check`, could green-light the ruleset (and auto-merge) before the push run's real mirror existed. The job name is now an expression that evaluates to `βœ… Required PR Check` only on the paths that own the status. + +--- + +## Upgrade notes + +- No runtime changes. From 1ee36446b77f46dfb23453a9b9f337a69b1d5a89 Mon Sep 17 00:00:00 2001 From: Shinrai Date: Sat, 3 Oct 2026 20:51:46 -0700 Subject: [PATCH 2/2] docs: add the v1.0.11 changelog and update What's New --- README.md | 17 +++++++++++++++++ docs/changelog/v1/v1.0.11.md | 28 ++++++++++++++++++++++++++++ 2 files changed, 45 insertions(+) create mode 100644 docs/changelog/v1/v1.0.11.md diff --git a/README.md b/README.md index 92f52f8..71b6104 100644 --- a/README.md +++ b/README.md @@ -8,6 +8,23 @@ **@cldmv/envm** is a modern, cross-platform environment variable manager for Node.js projects. Designed for both developers and automation, it lets you safely read, write, and manipulate environment variables on Windows and POSIX systemsβ€”without ever touching a class. With robust backup and restore features, a powerful CLI, and a clean, ESM-first API, `envm` makes managing your environment variables simple, safe, and scriptable. Whether you're tweaking your PATH, rolling back a bad change, or automating setup across platforms, `envm` gives you the control and confidence you need. +## ✨ What's New + +### Latest: v1.0.11 (October 2026) + +- **Header tooling on fix-headers 2.1.4** β€” the `@cldmv/fix-headers` dev dependency moves to 2.1.4 and the header pass was re-run; every file already matched, so nothing was restamped. No library or CLI code changed (#34). +- **Complete version history** β€” every release from v1.0.2 onward now has a changelog under [docs/changelog/](https://github.com/CLDMV/envm/tree/master/docs/changelog/). v1.0.2 is the only version published to npm so far; v1.0.3 through v1.0.10 changed tooling, CI and documentation only, with no change to the library or CLI. +- [View full v1.0.11 Changelog](https://github.com/CLDMV/envm/blob/master/docs/changelog/v1/v1.0.11.md) + +### Recent Releases + +- **v1.0.10** (October 2026) β€” the CI `βœ… Required PR Check` mirror job runs on every path instead of being skipped on in-repo PRs (#32) ([Changelog](https://github.com/CLDMV/envm/blob/master/docs/changelog/v1/v1.0.10.md)) +- **v1.0.9** (October 2026) β€” a skipped PR run no longer satisfies the `βœ… Required PR Check` ruleset (#30) ([Changelog](https://github.com/CLDMV/envm/blob/master/docs/changelog/v1/v1.0.9.md)) +- **v1.0.8** (October 2026) β€” uniform file headers from the shared CLDMV config, the verbatim Apache-2.0 license text, a v4.29.2 workflow sync and vitest 5.0.2 (#19, #20, #22, #23, #24, #26, #27, #28) ([Changelog](https://github.com/CLDMV/envm/blob/master/docs/changelog/v1/v1.0.8.md)) +- **v1.0.7** (September 2026) β€” vitest 5, signed redirected security PRs and grouped Dependabot updates (#18) ([Changelog](https://github.com/CLDMV/envm/blob/master/docs/changelog/v1/v1.0.7.md)) + +πŸ“š **For complete version history, see [docs/changelog/](https://github.com/CLDMV/envm/tree/master/docs/changelog/) and the [GitHub Releases](https://github.com/CLDMV/envm/releases).** + ## Features - **Cross-platform:** Works on Windows (registry) and POSIX (dotfiles, /etc/environment) diff --git a/docs/changelog/v1/v1.0.11.md b/docs/changelog/v1/v1.0.11.md new file mode 100644 index 0000000..5d51044 --- /dev/null +++ b/docs/changelog/v1/v1.0.11.md @@ -0,0 +1,28 @@ +# @cldmv/envm v1.0.11 Changelog + +**Release Date**: October 2026 +**Release Type**: Patch +**Branch**: `release/1.0.11` + +--- + +## Overview + +A dev-dependency release: `@cldmv/fix-headers` moves to 2.1.4 and the header pass was re-run. Every header already matched what 2.1.4 writes, so no file was restamped. No library or CLI code, published file or dependency used at runtime changed. + +--- + +## πŸ“š Documentation + +- **NEW:** [docs/changelog/v1/v1.0.11.md](./v1.0.11.md) β€” this changelog, plus backfilled changelog files for every earlier release, [v1.0.2](./v1.0.2.md) through [v1.0.10](./v1.0.10.md). +- **NEW:** README **✨ What's New** section. + +## πŸ”§ Dependencies + +- `@cldmv/fix-headers` 2.1.1 β†’ 2.1.4 ([#34](https://github.com/CLDMV/envm/pull/34), dev-only). + +--- + +## Upgrade notes + +- No runtime changes β€” drop-in for v1.0.10.