Changelog

1.5.0 — 2026-09-02

Added repo sync for credential-safe, fast-forward-only branch and tag updates with dry-run and divergence protection. (#23).
Added guided proposal and triage work-order forms, with the contributor guide linking directly to proposal intake. (#50).

Enforced the exact Forgejo ceremony source and version across governance records and workflow pins. (#36).
Publish release assets and the matching changelog section through stoke's credential-safe CLI. (#54).

Keep package-lock metadata aligned with the package version and guard against future drift. (#43).
Cover every governed repository surface and reject unmapped tracked paths or divergent scope names. (#48).

Added repo clone with branch, depth, remote-name, and destination options; credentials stay in ephemeral Git configuration instead of command arguments, remotes, or repository configuration. (#13, #14).
Added the stoke brand system and a package file allowlist so published packages include the CLI, README, license, design guide, and vector logo without tests or generated binary assets. (#12, #16).
Added CI for pull requests and pushes to main. (#17).
Added issue show, issue comment, raw --json output for read commands, and commit-pinned pr review --commit. (#20).
Added repeatable labels to issue create, with label validation before issue creation. (#26, #29).
Added ceremony governance automation, vendored role doctrine, configuration validation, the reviewer panel, and path-based scope labels. (#30, #31).
Added repo create --owner for organization-owned repositories while preserving the authenticated-user default. (#24, #35).
Added release create --asset and release upload, including streamed uploads, single-asset renaming, release IDs, attached-file listings, backpressure handling, and partial-failure reporting. (#25, #37).
Added private Debian registry credentials without exposing them in source URLs. (#1, #38).

auth login now requests least-privilege scopes by default; use --full-scopes for the former broad set or --scopes for an explicit set. This is a behavior change. (#9, #19).
Bumped the ceremony workflow pin from 0.6.1 to 0.6.3, re-vendored all six doctrine files from that release, and updated the mirror's pin record. (#39).

install-apt now fails clearly when registry metadata is absent instead of continuing into an opaque apt failure. (#18).
Debian installs preserve signature verification across transient failures, refuse unverifiable registries by default, and allow an HTTPS-only bypass solely through the explicit opt-in for the known sqv failure. (#1, #38).