Sync to upstream v4.0.0-rc.4 + reapply @mention patch

.env.test.example

@@ -0,0 +1,6 @@
+# e2e test credentials template.
+# Copy to .env.test and fill in real tokens (that file is git-excluded).
+
+FIZZY_TEST_TOKEN=fizzy_your_token_here
+FIZZY_TEST_ACCOUNT=1234567
+FIZZY_TEST_API_URL=https://app.fizzy.do

.github/workflows/dependabot-auto-merge.yml

@@ -14,23 +14,11 @@ jobs:
     steps:
       - name: Fetch Dependabot metadata
         id: metadata
-        uses: dependabot/fetch-metadata@21025c705c08248db411dc16f3619e6b5f9ea21a # v2.5.0
+        uses: dependabot/fetch-metadata@25dd0e34f4fe68f24cc83900b1fe3fe149efef98 # v3.1.0
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
 
       # CI is the safety gate — auto-merging action updates is circular.
-      - name: Approve patch and minor updates (excluding actions)
-        if: >-
-          (
-            steps.metadata.outputs.update-type == 'version-update:semver-patch' ||
-            steps.metadata.outputs.update-type == 'version-update:semver-minor'
-          ) &&
-          steps.metadata.outputs.package-ecosystem != 'github_actions'
-        run: gh pr review --approve "$PR_URL"
-        env:
-          PR_URL: ${{ github.event.pull_request.html_url }}
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-
       - name: Enable auto-merge for patch and minor updates (excluding actions)
         if: >-
           (

.github/workflows/release.yml

@@ -41,7 +41,7 @@ jobs:
           persist-credentials: false
 
       - name: Set up Go
-        uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0 # zizmor: ignore[cache-poisoning] -- cache is branch-isolated; fork PRs cannot write to this cache
+        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0 # zizmor: ignore[cache-poisoning] -- cache is branch-isolated; fork PRs cannot write to this cache
         with:
           go-version-file: go.mod
 
@@ -79,18 +79,18 @@ jobs:
 
       - name: Generate GitHub App token
         id: app-token
-        uses: actions/create-github-app-token@f8d387b68d61c58ab83c6c016672934102569859 # v3.0.0
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
         with:
           app-id: ${{ vars.RELEASE_CLIENT_ID }}
           private-key: ${{ secrets.RELEASE_APP_PRIVATE_KEY }}
           repositories: homebrew-tap
           permission-contents: write
 
       - name: Install cosign
-        uses: sigstore/cosign-installer@ba7bc0a3fef59531c69a25acd34668d6d3fe6f22 # v4.1.0
+        uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
 
       - name: Install Syft
-        uses: anchore/sbom-action/download-syft@57aae528053a48a3f6235f2d9461b05fbcb7366d # v0.23.1
+        uses: anchore/sbom-action/download-syft@e22c389904149dbc22b58101806040fa8d37a610 # v0.24.0
 
       - name: Generate shell completions
         run: |
@@ -102,7 +102,7 @@ jobs:
           rm fizzy-tmp
 
       - name: Run GoReleaser
-        uses: goreleaser/goreleaser-action@ec59f474b9834571250b370d4735c50f8e2d1e29 # v7.0.0
+        uses: goreleaser/goreleaser-action@5daf1e915a5f0af01ddbcd89a43b8061ff4f1a89 # v7.2.2
         with:
           version: 'v2.14.1'
           args: release --clean
@@ -118,15 +118,16 @@ jobs:
       - name: Attest build provenance
         uses: actions/attest-build-provenance@a2bbfa25375fe432b6a289bc6b6cd05ecd0c4c32 # v4.1.0
         with:
-          subject-checksums-file: ./dist/checksums.txt
+          subject-checksums: ./dist/checksums.txt
 
   aur-publish:
     runs-on: ubuntu-latest
     needs: release
     environment: release
     permissions:
       contents: read
-    if: startsWith(github.ref, 'refs/tags/v')
+    # Only publish the normal AUR package for stable tags. Prereleases stay on GitHub Releases.
+    if: startsWith(github.ref, 'refs/tags/v') && !contains(github.ref_name, '-')
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:

.github/workflows/scorecard.yml

@@ -28,13 +28,13 @@ jobs:
           results_format: sarif
           publish_results: true
 
-      - uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: SARIF file
           path: results.sarif
           retention-days: 5
 
-      - uses: github/codeql-action/upload-sarif@0d579ffd059c29b07949a3cce3983f0780820c98 # v4.32.6
+      - uses: github/codeql-action/upload-sarif@7211b7c8077ea37d8641b6271f6a365a22a5fbfa # v4.36.0
         continue-on-error: true
         with:
           sarif_file: results.sarif

.github/workflows/security.yml

@@ -40,12 +40,12 @@ jobs:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: false
-      - uses: aquasecurity/trivy-action@57a97c7e7821a5776cebc9bb87c984fa69cba8f1 # 0.35.0
+      - uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
         with:
           scan-type: fs
           format: sarif
           output: trivy-results.sarif
-      - uses: github/codeql-action/upload-sarif@0d579ffd059c29b07949a3cce3983f0780820c98 # v4.32.6
+      - uses: github/codeql-action/upload-sarif@7211b7c8077ea37d8641b6271f6a365a22a5fbfa # v4.36.0
         with:
           sarif_file: trivy-results.sarif
           category: trivy
@@ -61,10 +61,10 @@ jobs:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: false
-      - uses: securego/gosec@bb17e422fc34bf4c0a2e5cab9d07dc45a68c040c # v2.24.7
+      - uses: securego/gosec@4a3bd8af174872c778439083ded7adbf3747e770 # v2.26.1
         with:
           args: -no-fail -exclude=G304,G401,G501 -exclude-dir=e2e -fmt sarif -out gosec-results.sarif ./...
-      - uses: github/codeql-action/upload-sarif@0d579ffd059c29b07949a3cce3983f0780820c98 # v4.32.6
+      - uses: github/codeql-action/upload-sarif@7211b7c8077ea37d8641b6271f6a365a22a5fbfa # v4.36.0
         with:
           sarif_file: gosec-results.sarif
           category: gosec
@@ -79,4 +79,4 @@ jobs:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: false
-      - uses: actions/dependency-review-action@2031cfc080254a8a887f58cffee85186f0e49e48 # v4.9.0
+      - uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5.0.0

.github/workflows/test.yml

@@ -20,7 +20,7 @@ jobs:
           persist-credentials: false
 
       - name: Set up Go
-        uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0
+        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
         with:
           go-version-file: go.mod
 
@@ -49,7 +49,7 @@ jobs:
           persist-credentials: false
 
       - name: Set up Go
-        uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0
+        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
         with:
           go-version-file: go.mod
 
@@ -60,7 +60,7 @@ jobs:
         run: go vet ./...
 
       - name: golangci-lint
-        uses: golangci/golangci-lint-action@1e7e51e771db61008b38414a730f564565cf7c20 # v9.2.0
+        uses: golangci/golangci-lint-action@82606bf257cbaff209d206a39f5134f0cfbfd2ee # v9.2.1
         with:
           version: v2.10
 
@@ -74,7 +74,7 @@ jobs:
           persist-credentials: false
 
       - name: Set up Go
-        uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0
+        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
         with:
           go-version: 'stable'
 
@@ -94,10 +94,10 @@ jobs:
           persist-credentials: false
 
       - name: Run actionlint
-        uses: rhysd/actionlint@393031adb9afb225ee52ae2ccd7a5af5525e03e8 # v1.7.11
+        uses: rhysd/actionlint@914e7df21a07ef503a81201c76d2b11c789d3fca # v1.7.12
 
       - name: Run zizmor
-        uses: zizmorcore/zizmor-action@71321a20a9ded102f6e9ce5718a2fcec2c4f70d8 # v0.5.2
+        uses: zizmorcore/zizmor-action@5f14fd08f7cf1cb1609c1e344975f152c7ee938d # v0.5.6
         with:
           advanced-security: false
 
@@ -111,7 +111,7 @@ jobs:
           persist-credentials: false
 
       - name: Set up Go
-        uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0
+        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
         with:
           go-version-file: go.mod
 

.gitignore

@@ -1,6 +1,7 @@
 # Build artifacts
 bin/
 /fizzy
+/fizzy-fork
 *.exe
 *.exe~
 *.dll
@@ -32,3 +33,6 @@ completions/
 # Profiling
 profiles/
 default.pgo
+
+# Local test credentials
+.env.test

.goreleaser.yaml

@@ -49,11 +49,12 @@ signs:
   - cmd: cosign
     artifacts: checksum
     output: true
+    signature: "${artifact}.bundle"
     args:
       - sign-blob
       - --yes
-      - --output-certificate=${certificate}
-      - --output-signature=${signature}
+      - --new-bundle-format=true
+      - --bundle=${signature}
       - ${artifact}
 
 notarize:
@@ -73,9 +74,16 @@ notarize:
 changelog:
   use: github-native
 
+release:
+  prerelease: auto
+  # Keep prerelease tags out of GitHub's latest release/install-script path.
+  make_latest: "{{ if .Prerelease }}false{{ else }}auto{{ end }}"
+
 homebrew_casks:
   - name: fizzy
     ids: [default]
+    # Do not update the normal tap for prerelease tags.
+    skip_upload: auto
     repository:
       owner: basecamp
       name: homebrew-tap
@@ -92,6 +100,8 @@ homebrew_casks:
 scoops:
   - name: fizzy
     ids: [default]
+    # Do not update the normal bucket manifest for prerelease tags.
+    skip_upload: auto
     repository:
       owner: basecamp
       name: homebrew-tap

Makefile

@@ -1,9 +1,17 @@
-.PHONY: test test-unit test-e2e test-go test-file test-run build clean tidy help \
+.PHONY: test test-unit test-e2e e2e test-go test-file e2e-file test-run e2e-run build clean tidy help \
 	check-toolchain fmt fmt-check vet lint tidy-check race-test vuln secrets \
 	replace-check security check release-check release tools \
-	surface-snapshot surface-check sync-skill lint-actions
+	surface-snapshot surface-check lint-actions
 
 BINARY := $(CURDIR)/bin/fizzy
+FIZZY_TEST_BINARY ?= $(BINARY)
+
+# Load local test credentials if present, but refuse tracked local secret files.
+ifneq ($(shell git ls-files --error-unmatch .env.test >/dev/null 2>&1 && echo tracked),)
+$(error .env.test is tracked by Git. Remove it from version control and keep local secret files untracked)
+endif
+-include .env.test
+export FIZZY_TEST_TOKEN FIZZY_TEST_ACCOUNT FIZZY_TEST_API_URL FIZZY_TEST_BINARY
 VERSION ?= $(shell git describe --tags --always --dirty 2>/dev/null || echo dev)
 LDFLAGS := -X main.version=$(VERSION)
 
@@ -20,10 +28,13 @@ help:
 	@echo "Usage:"
 	@echo "  make build          Build the CLI"
 	@echo "  make test-unit      Run unit tests (no API required)"
-	@echo "  make test-e2e       Run e2e tests (requires API credentials)"
-	@echo "  make test           Alias for test-e2e"
-	@echo "  make test-file      Run a specific e2e test file"
-	@echo "  make test-run       Run a specific e2e test by name"
+	@echo "  make e2e            Run owner-only CLI contract e2e tests"
+	@echo "  make test-e2e       Alias for e2e"
+	@echo "  make test           Alias for e2e"
+	@echo "  make e2e-file       Run a specific CLI contract e2e test file"
+	@echo "  make test-file      Alias for e2e-file"
+	@echo "  make e2e-run        Run a specific CLI contract e2e test by name"
+	@echo "  make test-run       Alias for e2e-run"
 	@echo "  make clean          Remove build artifacts"
 	@echo "  make tidy           Tidy dependencies"
 	@echo ""
@@ -45,17 +56,19 @@ help:
 	@echo "  make tools          Install dev tools"
 	@echo ""
 	@echo "Environment variables (required for e2e tests):"
-	@echo "  FIZZY_TEST_TOKEN   API token"
-	@echo "  FIZZY_TEST_ACCOUNT Account slug"
-	@echo "  FIZZY_TEST_API_URL API base URL (default: https://app.fizzy.do)"
-	@echo "  FIZZY_TEST_USER_ID User ID for user update/deactivate tests (optional)"
+	@echo "  FIZZY_TEST_TOKEN        API token"
+	@echo "  FIZZY_TEST_ACCOUNT      Account slug"
+	@echo "  FIZZY_TEST_API_URL      API base URL (default: https://app.fizzy.do)"
+	@echo "  FIZZY_TEST_BINARY       Prebuilt binary path (optional)"
+	@echo "  FIZZY_E2E_KEEP_FIXTURE  Set to 1 to skip final fixture teardown"
+	@echo "  FIZZY_E2E_TEARDOWN_DELAY  Delay teardown by N seconds"
 	@echo ""
 	@echo "Examples:"
 	@echo "  make build"
 	@echo "  make test-unit"
 	@echo "  export FIZZY_TEST_TOKEN=your-token"
 	@echo "  export FIZZY_TEST_ACCOUNT=your-account"
-	@echo "  make test-e2e"
+	@echo "  make e2e"
 
 # Toolchain guard — fails fast when PATH go and GOROOT go disagree
 check-toolchain:
@@ -80,28 +93,33 @@ test-unit: check-toolchain
 	go test -v ./internal/...
 
 # Run e2e tests (requires API credentials)
-test-e2e: build
+e2e: build
 	@if [ -z "$$FIZZY_TEST_TOKEN" ]; then echo "Error: FIZZY_TEST_TOKEN not set"; exit 1; fi
 	@if [ -z "$$FIZZY_TEST_ACCOUNT" ]; then echo "Error: FIZZY_TEST_ACCOUNT not set"; exit 1; fi
-	FIZZY_TEST_BINARY=$(BINARY) go test -v ./e2e/tests/...
+	go test -v -count=1 -timeout 10m ./e2e/cli_tests/...
 
-# Alias for test-e2e
-test: test-e2e
-test-go: test-e2e
+test-e2e: e2e
 
-# Run a single test file (e.g., make test-file FILE=board)
-test-file: build
-	@if [ -z "$(FILE)" ]; then echo "Usage: make test-file FILE=board"; exit 1; fi
+test: e2e
+test-go: e2e
+
+# Run a single test file (e.g., make e2e-file FILE=crud_board)
+e2e-file: build
+	@if [ -z "$(FILE)" ]; then echo "Usage: make e2e-file FILE=crud_board"; exit 1; fi
 	@if [ -z "$$FIZZY_TEST_TOKEN" ]; then echo "Error: FIZZY_TEST_TOKEN not set"; exit 1; fi
 	@if [ -z "$$FIZZY_TEST_ACCOUNT" ]; then echo "Error: FIZZY_TEST_ACCOUNT not set"; exit 1; fi
-	FIZZY_TEST_BINARY=$(BINARY) go test -v ./e2e/tests/$(FILE)_test.go
+	go test -v -count=1 ./e2e/cli_tests/$(FILE)_test.go
+
+test-file: e2e-file
 
-# Run a single test by name (e.g., make test-run NAME=TestBoardCRUD)
-test-run: build
-	@if [ -z "$(NAME)" ]; then echo "Usage: make test-run NAME=TestBoardCRUD"; exit 1; fi
+# Run a single test by name (e.g., make e2e-run NAME=TestBoardList)
+e2e-run: build
+	@if [ -z "$(NAME)" ]; then echo "Usage: make e2e-run NAME=TestBoardList"; exit 1; fi
 	@if [ -z "$$FIZZY_TEST_TOKEN" ]; then echo "Error: FIZZY_TEST_TOKEN not set"; exit 1; fi
 	@if [ -z "$$FIZZY_TEST_ACCOUNT" ]; then echo "Error: FIZZY_TEST_ACCOUNT not set"; exit 1; fi
-	FIZZY_TEST_BINARY=$(BINARY) go test -v -run $(NAME) ./e2e/tests/...
+	go test -v -count=1 -run $(NAME) ./e2e/cli_tests/...
+
+test-run: e2e-run
 
 # Format Go source
 fmt:
@@ -194,10 +212,6 @@ tools:
 surface-snapshot:
 	GENERATE_SURFACE=1 go test ./internal/commands/ -run TestGenerateSurfaceSnapshot -v
 
-# Sync embedded SKILL.md from canonical source
-sync-skill:
-	cp skills/fizzy/SKILL.md internal/skills/SKILL.md
-
 # CI check: SURFACE.txt is up to date
 surface-check:
 	go test ./internal/commands/ -run TestSurfaceSnapshot -v