Changelog

All notable changes to this project are documented in this file.

The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.

[Unreleased]

envaudit install-hook command that installs a pre-commit hook running envaudit scan (--force overwrites an existing hook).
Allowlist/baseline support in .envaudit.yml to suppress accepted findings by file, rule, line, or key.
13 new built-in secret patterns: OpenAI, Anthropic, Google, SendGrid, Twilio, npm, Telegram, Discord, Hugging Face, GitLab, Shopify, DigitalOcean, and Slack webhooks.
Config validation: an unknown severity_exit_code, negative entropy threshold, or invalid custom regex now fails fast with a clear message.
--flag=value syntax for --format/--config, and rejection of unknown flags instead of silently ignoring them.
.dockerignore to keep the Docker action build context lean.

.gitignore matching rewritten to support negation (!), **, directory-only (secrets/), path-containing (config/.env), and anchored (/.env) patterns, with git's "closest file / last rule wins" precedence.
Git tracking resolved with a single git ls-files call instead of one subprocess per .env file.
CheckPermission now reports missing files on every platform instead of silently succeeding on Windows.
The version baked into the binary is now injectable at build time via -X main.version=...; build.sh derives it from git tags.

GitHub Action failed with exit code 1 on repos with no findings: the grep-based finding counter exited non-zero and tripped set -euo pipefail in entrypoint.sh.
Windows test suite: permission checks are skipped where the bits aren't meaningful, and the full-integration test no longer expects a permission finding on Windows.

Initial release: .env hygiene linting.
Checks: gitignore coverage, files already committed to git, too-open file permissions, and secret-like values vs. placeholders.
Commands: envaudit scan, envaudit init, envaudit version.
Text and JSON output formats with severity-based exit codes (--strict, --no-strict, --no-color, --format).
Zero-dependency .envaudit.yml configuration: entropy threshold, ignore patterns, custom secret patterns, and the severity exit threshold.
Docker-based GitHub Action with step summary and machine-readable outputs.