@runfile/cli 0.15.1 → 0.17.0

package/bin/darwin-arm64/README.md

@@ -146,7 +146,7 @@ AES-256-GCM secrets you can commit to git. Auto-decrypted at runtime, never writ
 tool, no wrapper.
 
 ```bash
-$ run :env init -p .env.production
+$ run :env init .env.production
 $ run :env set .env.production DB_PASS "s3cr3t"   # auto-encrypted
 $ run :env set .env.production DB_PASS            # omit value → read from stdin (no shell history, no escaping)
 ```
@@ -160,9 +160,17 @@ You can also use Runfile as a drop-in `dotenvx`/`dotenv` replacement to inject e
 any command — no Runfile needed:
 
 ```bash
-$ run :env inject -- node app.js                          # uses .env by default
-$ run :env inject -f .env -f .env.local -- pnpm dev       # multiple files, last wins; parent env always wins
-$ run :env inject -f .env.production -- ./deploy.sh       # encrypted values auto-decrypted
+$ run :env inject .env -- node app.js                     # one file
+$ run :env inject .env .env.local -- pnpm dev             # multiple files, last wins; parent env always wins
+$ run :env inject .env.production -- ./deploy.sh          # encrypted values auto-decrypted
+```
+
+In CI, the file path can be supplied via `RUNFILE_ENV_FILE_TARGET` (set automatically by the
+[setup action's `env-file-source` input](.github/actions/setup/action.yml) for open-source
+repos that keep their encrypted `.env` in a GitHub secret):
+
+```bash
+$ run :env inject -- node app.js                          # uses $RUNFILE_ENV_FILE_TARGET
 ```
 
 #### Powerful argument substitution
@@ -240,15 +248,17 @@ and work as full substitution bodies *or* as chain segments:
   //   trim      : trim, trim_start, trim_end
   //   inspect   : length, starts_with, ends_with, contains
   //   transform : escape, repeat, replace_all, remove_all
-  //   regex     : regex_replace, regex_remove, regex_matches
+  //   regex     : regex_replace, regex_remove, regex_matches, regex_capture
   //   build     : concat, join
   //   split     : nth, first, last, count_parts
+  //   math      : add, subtract, multiply, divide
+  //   validate  : one_of
   //   encoding  : base64_encode, base64_decode
   //   hashing   : sha256, md5
   //   files     : read_file, file_exists
   //   json      : json_get, json_set
   //   error     : try
-  //   shell     : shell_quote
+  //   shell     : shell_quote, capture
   //   variables : define
   //   cwd       : set_cwd
   "echo deploying-{{ to_upper(ARGS.env) }}",
@@ -259,6 +269,10 @@ and work as full substitution bodies *or* as chain segments:
   "go test {{ replace_all(ARGS.flags, ' ', ' -tag=') }}",
   // Strip every match of a regex (here: collapse whitespace runs to a single space):
   "echo {{ regex_replace(ARGS.text, '\\s+', ' ') }}",
+  // Pull a capture group out of the first regex match — no `(?s)^.*X(...)X.*$`
+  // greedy-replace trick needed. Group 0 is the whole match; group N is the
+  // N-th `(...)`. Out-of-bounds returns "" (same convention as `nth`).
+  "echo version={{ regex_capture(read_file('app/build.gradle.kts'), 'versionName = \"([^\"]+)\"', '1') }}",
   // Split-by-separator scalar accessors — string in, string out, no list type:
   // basename idiom (last segment after `/`); empty string when input ends in `/`.
   "echo basename={{ last(ARGS.path, '/') }}",
@@ -274,6 +288,26 @@ and work as full substitution bodies *or* as chain segments:
   // `shell_quote` picks the right quoting for the active shell:
   "some-tool --json {{ shell_quote(base64_decode(ENV.SECRET_BASE64)) }}",
 
+  // Slurp shell-command stdout straight into a substitution. `capture` runs
+  // the command through the platform's default shell (sh / cmd) and trims
+  // the trailing newline. Results are memoized per-target so the same
+  // capture in multiple commands runs once. `--dry-run` substitutes a
+  // readable placeholder instead of spawning the shell.
+  "echo built-at={{ capture('date -u +%Y-%m-%dT%H:%M:%SZ') }}",
+  "{{ define(sha, capture('git rev-parse HEAD')) }}",
+
+  // Arithmetic — variadic (2+ args), coerces strings to numbers, errors on
+  // non-numeric input. The result is formatted as an integer when whole and
+  // as a decimal otherwise (so `add('5', '3')` → "8", `add('5', '1.1')` →
+  // "6.1"). Divide-by-zero errors out.
+  "echo next-build={{ add(VARS.versionCode, '1') }}",
+  "echo half={{ divide(VARS.total, '2') }}",
+
+  // Validate a value against a fixed allow-list. Returns the value on
+  // match; lists every valid option in the error on mismatch. Collapses
+  // the four-case `match { major: define(part, 'major'), ... }` boilerplate.
+  "{{ define(part, one_of(ARGS, 'major', 'minor', 'patch', 'build')) }}",
+
   // Cache keys / content fingerprints. `sha256` for security-sensitive use,
   // `md5` for cheap fingerprinting (NOT cryptographically secure).
   "echo cache-key={{ sha256(read_file('package-lock.json')) }}",

package/bin/darwin-x64/README.md

@@ -146,7 +146,7 @@ AES-256-GCM secrets you can commit to git. Auto-decrypted at runtime, never writ
 tool, no wrapper.
 
 ```bash
-$ run :env init -p .env.production
+$ run :env init .env.production
 $ run :env set .env.production DB_PASS "s3cr3t"   # auto-encrypted
 $ run :env set .env.production DB_PASS            # omit value → read from stdin (no shell history, no escaping)
 ```
@@ -160,9 +160,17 @@ You can also use Runfile as a drop-in `dotenvx`/`dotenv` replacement to inject e
 any command — no Runfile needed:
 
 ```bash
-$ run :env inject -- node app.js                          # uses .env by default
-$ run :env inject -f .env -f .env.local -- pnpm dev       # multiple files, last wins; parent env always wins
-$ run :env inject -f .env.production -- ./deploy.sh       # encrypted values auto-decrypted
+$ run :env inject .env -- node app.js                     # one file
+$ run :env inject .env .env.local -- pnpm dev             # multiple files, last wins; parent env always wins
+$ run :env inject .env.production -- ./deploy.sh          # encrypted values auto-decrypted
+```
+
+In CI, the file path can be supplied via `RUNFILE_ENV_FILE_TARGET` (set automatically by the
+[setup action's `env-file-source` input](.github/actions/setup/action.yml) for open-source
+repos that keep their encrypted `.env` in a GitHub secret):
+
+```bash
+$ run :env inject -- node app.js                          # uses $RUNFILE_ENV_FILE_TARGET
 ```
 
 #### Powerful argument substitution
@@ -240,15 +248,17 @@ and work as full substitution bodies *or* as chain segments:
   //   trim      : trim, trim_start, trim_end
   //   inspect   : length, starts_with, ends_with, contains
   //   transform : escape, repeat, replace_all, remove_all
-  //   regex     : regex_replace, regex_remove, regex_matches
+  //   regex     : regex_replace, regex_remove, regex_matches, regex_capture
   //   build     : concat, join
   //   split     : nth, first, last, count_parts
+  //   math      : add, subtract, multiply, divide
+  //   validate  : one_of
   //   encoding  : base64_encode, base64_decode
   //   hashing   : sha256, md5
   //   files     : read_file, file_exists
   //   json      : json_get, json_set
   //   error     : try
-  //   shell     : shell_quote
+  //   shell     : shell_quote, capture
   //   variables : define
   //   cwd       : set_cwd
   "echo deploying-{{ to_upper(ARGS.env) }}",
@@ -259,6 +269,10 @@ and work as full substitution bodies *or* as chain segments:
   "go test {{ replace_all(ARGS.flags, ' ', ' -tag=') }}",
   // Strip every match of a regex (here: collapse whitespace runs to a single space):
   "echo {{ regex_replace(ARGS.text, '\\s+', ' ') }}",
+  // Pull a capture group out of the first regex match — no `(?s)^.*X(...)X.*$`
+  // greedy-replace trick needed. Group 0 is the whole match; group N is the
+  // N-th `(...)`. Out-of-bounds returns "" (same convention as `nth`).
+  "echo version={{ regex_capture(read_file('app/build.gradle.kts'), 'versionName = \"([^\"]+)\"', '1') }}",
   // Split-by-separator scalar accessors — string in, string out, no list type:
   // basename idiom (last segment after `/`); empty string when input ends in `/`.
   "echo basename={{ last(ARGS.path, '/') }}",
@@ -274,6 +288,26 @@ and work as full substitution bodies *or* as chain segments:
   // `shell_quote` picks the right quoting for the active shell:
   "some-tool --json {{ shell_quote(base64_decode(ENV.SECRET_BASE64)) }}",
 
+  // Slurp shell-command stdout straight into a substitution. `capture` runs
+  // the command through the platform's default shell (sh / cmd) and trims
+  // the trailing newline. Results are memoized per-target so the same
+  // capture in multiple commands runs once. `--dry-run` substitutes a
+  // readable placeholder instead of spawning the shell.
+  "echo built-at={{ capture('date -u +%Y-%m-%dT%H:%M:%SZ') }}",
+  "{{ define(sha, capture('git rev-parse HEAD')) }}",
+
+  // Arithmetic — variadic (2+ args), coerces strings to numbers, errors on
+  // non-numeric input. The result is formatted as an integer when whole and
+  // as a decimal otherwise (so `add('5', '3')` → "8", `add('5', '1.1')` →
+  // "6.1"). Divide-by-zero errors out.
+  "echo next-build={{ add(VARS.versionCode, '1') }}",
+  "echo half={{ divide(VARS.total, '2') }}",
+
+  // Validate a value against a fixed allow-list. Returns the value on
+  // match; lists every valid option in the error on mismatch. Collapses
+  // the four-case `match { major: define(part, 'major'), ... }` boilerplate.
+  "{{ define(part, one_of(ARGS, 'major', 'minor', 'patch', 'build')) }}",
+
   // Cache keys / content fingerprints. `sha256` for security-sensitive use,
   // `md5` for cheap fingerprinting (NOT cryptographically secure).
   "echo cache-key={{ sha256(read_file('package-lock.json')) }}",

package/bin/linux-arm64/README.md

@@ -146,7 +146,7 @@ AES-256-GCM secrets you can commit to git. Auto-decrypted at runtime, never writ
 tool, no wrapper.
 
 ```bash
-$ run :env init -p .env.production
+$ run :env init .env.production
 $ run :env set .env.production DB_PASS "s3cr3t"   # auto-encrypted
 $ run :env set .env.production DB_PASS            # omit value → read from stdin (no shell history, no escaping)
 ```
@@ -160,9 +160,17 @@ You can also use Runfile as a drop-in `dotenvx`/`dotenv` replacement to inject e
 any command — no Runfile needed:
 
 ```bash
-$ run :env inject -- node app.js                          # uses .env by default
-$ run :env inject -f .env -f .env.local -- pnpm dev       # multiple files, last wins; parent env always wins
-$ run :env inject -f .env.production -- ./deploy.sh       # encrypted values auto-decrypted
+$ run :env inject .env -- node app.js                     # one file
+$ run :env inject .env .env.local -- pnpm dev             # multiple files, last wins; parent env always wins
+$ run :env inject .env.production -- ./deploy.sh          # encrypted values auto-decrypted
+```
+
+In CI, the file path can be supplied via `RUNFILE_ENV_FILE_TARGET` (set automatically by the
+[setup action's `env-file-source` input](.github/actions/setup/action.yml) for open-source
+repos that keep their encrypted `.env` in a GitHub secret):
+
+```bash
+$ run :env inject -- node app.js                          # uses $RUNFILE_ENV_FILE_TARGET
 ```
 
 #### Powerful argument substitution
@@ -240,15 +248,17 @@ and work as full substitution bodies *or* as chain segments:
   //   trim      : trim, trim_start, trim_end
   //   inspect   : length, starts_with, ends_with, contains
   //   transform : escape, repeat, replace_all, remove_all
-  //   regex     : regex_replace, regex_remove, regex_matches
+  //   regex     : regex_replace, regex_remove, regex_matches, regex_capture
   //   build     : concat, join
   //   split     : nth, first, last, count_parts
+  //   math      : add, subtract, multiply, divide
+  //   validate  : one_of
   //   encoding  : base64_encode, base64_decode
   //   hashing   : sha256, md5
   //   files     : read_file, file_exists
   //   json      : json_get, json_set
   //   error     : try
-  //   shell     : shell_quote
+  //   shell     : shell_quote, capture
   //   variables : define
   //   cwd       : set_cwd
   "echo deploying-{{ to_upper(ARGS.env) }}",
@@ -259,6 +269,10 @@ and work as full substitution bodies *or* as chain segments:
   "go test {{ replace_all(ARGS.flags, ' ', ' -tag=') }}",
   // Strip every match of a regex (here: collapse whitespace runs to a single space):
   "echo {{ regex_replace(ARGS.text, '\\s+', ' ') }}",
+  // Pull a capture group out of the first regex match — no `(?s)^.*X(...)X.*$`
+  // greedy-replace trick needed. Group 0 is the whole match; group N is the
+  // N-th `(...)`. Out-of-bounds returns "" (same convention as `nth`).
+  "echo version={{ regex_capture(read_file('app/build.gradle.kts'), 'versionName = \"([^\"]+)\"', '1') }}",
   // Split-by-separator scalar accessors — string in, string out, no list type:
   // basename idiom (last segment after `/`); empty string when input ends in `/`.
   "echo basename={{ last(ARGS.path, '/') }}",
@@ -274,6 +288,26 @@ and work as full substitution bodies *or* as chain segments:
   // `shell_quote` picks the right quoting for the active shell:
   "some-tool --json {{ shell_quote(base64_decode(ENV.SECRET_BASE64)) }}",
 
+  // Slurp shell-command stdout straight into a substitution. `capture` runs
+  // the command through the platform's default shell (sh / cmd) and trims
+  // the trailing newline. Results are memoized per-target so the same
+  // capture in multiple commands runs once. `--dry-run` substitutes a
+  // readable placeholder instead of spawning the shell.
+  "echo built-at={{ capture('date -u +%Y-%m-%dT%H:%M:%SZ') }}",
+  "{{ define(sha, capture('git rev-parse HEAD')) }}",
+
+  // Arithmetic — variadic (2+ args), coerces strings to numbers, errors on
+  // non-numeric input. The result is formatted as an integer when whole and
+  // as a decimal otherwise (so `add('5', '3')` → "8", `add('5', '1.1')` →
+  // "6.1"). Divide-by-zero errors out.
+  "echo next-build={{ add(VARS.versionCode, '1') }}",
+  "echo half={{ divide(VARS.total, '2') }}",
+
+  // Validate a value against a fixed allow-list. Returns the value on
+  // match; lists every valid option in the error on mismatch. Collapses
+  // the four-case `match { major: define(part, 'major'), ... }` boilerplate.
+  "{{ define(part, one_of(ARGS, 'major', 'minor', 'patch', 'build')) }}",
+
   // Cache keys / content fingerprints. `sha256` for security-sensitive use,
   // `md5` for cheap fingerprinting (NOT cryptographically secure).
   "echo cache-key={{ sha256(read_file('package-lock.json')) }}",

package/bin/linux-x64/README.md

@@ -146,7 +146,7 @@ AES-256-GCM secrets you can commit to git. Auto-decrypted at runtime, never writ
 tool, no wrapper.
 
 ```bash
-$ run :env init -p .env.production
+$ run :env init .env.production
 $ run :env set .env.production DB_PASS "s3cr3t"   # auto-encrypted
 $ run :env set .env.production DB_PASS            # omit value → read from stdin (no shell history, no escaping)
 ```
@@ -160,9 +160,17 @@ You can also use Runfile as a drop-in `dotenvx`/`dotenv` replacement to inject e
 any command — no Runfile needed:
 
 ```bash
-$ run :env inject -- node app.js                          # uses .env by default
-$ run :env inject -f .env -f .env.local -- pnpm dev       # multiple files, last wins; parent env always wins
-$ run :env inject -f .env.production -- ./deploy.sh       # encrypted values auto-decrypted
+$ run :env inject .env -- node app.js                     # one file
+$ run :env inject .env .env.local -- pnpm dev             # multiple files, last wins; parent env always wins
+$ run :env inject .env.production -- ./deploy.sh          # encrypted values auto-decrypted
+```
+
+In CI, the file path can be supplied via `RUNFILE_ENV_FILE_TARGET` (set automatically by the
+[setup action's `env-file-source` input](.github/actions/setup/action.yml) for open-source
+repos that keep their encrypted `.env` in a GitHub secret):
+
+```bash
+$ run :env inject -- node app.js                          # uses $RUNFILE_ENV_FILE_TARGET
 ```
 
 #### Powerful argument substitution
@@ -240,15 +248,17 @@ and work as full substitution bodies *or* as chain segments:
   //   trim      : trim, trim_start, trim_end
   //   inspect   : length, starts_with, ends_with, contains
   //   transform : escape, repeat, replace_all, remove_all
-  //   regex     : regex_replace, regex_remove, regex_matches
+  //   regex     : regex_replace, regex_remove, regex_matches, regex_capture
   //   build     : concat, join
   //   split     : nth, first, last, count_parts
+  //   math      : add, subtract, multiply, divide
+  //   validate  : one_of
   //   encoding  : base64_encode, base64_decode
   //   hashing   : sha256, md5
   //   files     : read_file, file_exists
   //   json      : json_get, json_set
   //   error     : try
-  //   shell     : shell_quote
+  //   shell     : shell_quote, capture
   //   variables : define
   //   cwd       : set_cwd
   "echo deploying-{{ to_upper(ARGS.env) }}",
@@ -259,6 +269,10 @@ and work as full substitution bodies *or* as chain segments:
   "go test {{ replace_all(ARGS.flags, ' ', ' -tag=') }}",
   // Strip every match of a regex (here: collapse whitespace runs to a single space):
   "echo {{ regex_replace(ARGS.text, '\\s+', ' ') }}",
+  // Pull a capture group out of the first regex match — no `(?s)^.*X(...)X.*$`
+  // greedy-replace trick needed. Group 0 is the whole match; group N is the
+  // N-th `(...)`. Out-of-bounds returns "" (same convention as `nth`).
+  "echo version={{ regex_capture(read_file('app/build.gradle.kts'), 'versionName = \"([^\"]+)\"', '1') }}",
   // Split-by-separator scalar accessors — string in, string out, no list type:
   // basename idiom (last segment after `/`); empty string when input ends in `/`.
   "echo basename={{ last(ARGS.path, '/') }}",
@@ -274,6 +288,26 @@ and work as full substitution bodies *or* as chain segments:
   // `shell_quote` picks the right quoting for the active shell:
   "some-tool --json {{ shell_quote(base64_decode(ENV.SECRET_BASE64)) }}",
 
+  // Slurp shell-command stdout straight into a substitution. `capture` runs
+  // the command through the platform's default shell (sh / cmd) and trims
+  // the trailing newline. Results are memoized per-target so the same
+  // capture in multiple commands runs once. `--dry-run` substitutes a
+  // readable placeholder instead of spawning the shell.
+  "echo built-at={{ capture('date -u +%Y-%m-%dT%H:%M:%SZ') }}",
+  "{{ define(sha, capture('git rev-parse HEAD')) }}",
+
+  // Arithmetic — variadic (2+ args), coerces strings to numbers, errors on
+  // non-numeric input. The result is formatted as an integer when whole and
+  // as a decimal otherwise (so `add('5', '3')` → "8", `add('5', '1.1')` →
+  // "6.1"). Divide-by-zero errors out.
+  "echo next-build={{ add(VARS.versionCode, '1') }}",
+  "echo half={{ divide(VARS.total, '2') }}",
+
+  // Validate a value against a fixed allow-list. Returns the value on
+  // match; lists every valid option in the error on mismatch. Collapses
+  // the four-case `match { major: define(part, 'major'), ... }` boilerplate.
+  "{{ define(part, one_of(ARGS, 'major', 'minor', 'patch', 'build')) }}",
+
   // Cache keys / content fingerprints. `sha256` for security-sensitive use,
   // `md5` for cheap fingerprinting (NOT cryptographically secure).
   "echo cache-key={{ sha256(read_file('package-lock.json')) }}",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@runfile/cli",
-  "version": "0.15.1",
+  "version": "0.17.0",
   "description": "Runfile CLI — an easy-to-use, batteries-included task runner",
   "repository": "https://github.com/Skiley/runfile",
   "homepage": "https://github.com/Skiley/runfile",