Skip to content

Release 2.1.162 (2026-07-24)

Documentation

  • align host dev-tree docs with single-.venv model (#2506)
  • docs(docs): align host dev-tree docs with single-.venv model

Features

  • emit language-aware explicit secrets map in cd.yml (#2509) Replace the blanket secrets: inherit in generated cd.yml with a language-keyed least-privilege secrets map so each repo forwards only the secrets its ecosystem's publisher needs to cd-release.yml.

New helper _cd_release_secrets(language) returns the exact secret set per ecosystem: rust -> CARGO_REGISTRY_TOKEN, ruby -> RUBYGEMS_API_KEY, java -> CENTRAL_USERNAME/CENTRAL_TOKEN/GPG_PRIVATE_KEY/GPG_PASSPHRASE. python (OIDC trusted publishing), go (no token), and any non-listed language forward nothing, so no secrets: block is emitted at all.

CI Evidence: All gates passed — full audit bundle available. Download →