# Development

```sh
go run ./cmd/lazysecrets
go run ./cmd/lazysecrets --demo                     # built-in sample data, no Azure needed
go test ./...
go test ./internal/ui/app -run TestGolden -update   # after intentional UI changes
```

In `--demo`, sharing env files works end to end: `S` → `f` on a demo
repo, pick `kv-shared-prod / env-share` (the second account's) as the
key, then paste the link back. The demo repos aren't on disk, so opening
asks where to save, as for a repo you haven't cloned.

A stripped binary is a third smaller:

```sh
go build -trimpath -ldflags "-s -w" -o lazysecrets ./cmd/lazysecrets
```

Development builds show `dev-<commit>` as their version (`-dirty` with
uncommitted changes); `go install …@v0.2.0` shows the tag, releases the
version they were built for.

## How changes land

Pull requests into `main` are squash-merged, so each is one commit titled
like the PR. The title is a [conventional commit](https://www.conventionalcommits.org)
subject, checked by `pr-title.yml`:

| Type | For | In the changelog |
|---|---|---|
| `feat` | a new feature | Added |
| `perf` | faster or smaller, same behaviour | Changed |
| `fix` | a bug fix | Fixed |
| `refactor`, `docs`, `test`, `ci`, `chore`, `build`, `style`, `revert` | everything users don't need to hear about | no |

`feat!:` marks a breaking change, `feat(scope):` names a part.
`[skip changelog]` in the description leaves a pull request out.

CI (`ci.yml`) runs gofmt, vet, staticcheck, the tests and a build for each
platform on pull requests into `main`. `main` is protected: a pull request
merges only when it's up to date with `main` (Gitea's "Update branch"
button, or a rebase, then CI again), so what lands on `main` is exactly
what its pull request tested, and CI doesn't run again there.

## Releasing

Merge as many pull requests as you like, then release `main`:

```sh
scripts/release.sh --dry-run minor    # the tag and notes the release would have
scripts/release.sh minor              # CHANGELOG.md, commit, tag, push
```

`patch`, `minor` and `major` bump the latest release (`v0.2.1` → `v0.2.2`,
`v0.3.0`, `v1.0.0`; pre-releases don't count); a tag (`v0.3.0`,
`v0.3.0-rc.1`) is taken as it is.

It refuses unless you're on a clean `main` that matches `origin/main`.
[git-cliff](https://git-cliff.org) (`cliff.toml`) writes `CHANGELOG.md`
from the pull request titles. The tag runs the release workflow
(`.gitea/workflows/release.yml`): it tests, then
[GoReleaser](https://goreleaser.com) (`.goreleaser.yaml`) builds the
archives and publishes a Gitea release with them and the release's
changelog section. Then `scripts/github-release.mjs` copies that release,
notes and files, to the GitHub mirror, with the `GH_RELEASE_TOKEN`
secret (a fine-grained token that can write the mirror's contents);
without the secret it skips that. `goreleaser release --snapshot
--clean` builds the same archives locally, into `dist/`, without
publishing.

A suffix (`v0.2.0-rc.1`) makes a pre-release, which leaves `CHANGELOG.md`
alone.