[jorgemoralespou]

Summary

Refreshes educatesenv after 18 months, for v1.1.0: current toolchain and
dependencies, a GitHub token that is never stored or printed, release
listing by semver, install latest, uninstall, safer downloads, and a
release pipeline that cannot ship unsigned macOS binaries by accident.

What users see:

 educatesenv
   list-remote
-    --all                    # every release, pre-releases included, first 100 only
-    --recents                # the 10 most recently created
+    -n, --recent N           # the N newest stable releases by semver (default 10), with publish dates
+    --all                    # every stable release
+    --pre-releases           # add pre-releases; the old --all is --pre-releases --all
+    --by-date                # order by publish date instead of semver
+    --recents                # hidden, deprecated, changes nothing
   list                       # newest first by semver, develop on top
-  install <version>
+  install <version|latest>   # verified against checksums.txt, written to a temp file, stall timeout
+  uninstall <version>... [--force]
   use <version|develop>      # says what actually failed
   init [--download]          # --download installs the highest stable semver release
   config view                # shows where the token comes from, never the token

Where it lives:

pkg/
├── releases/    # new, pure: semver order, pre-release rule, selection, latest
├── token/       # new: EDUCATES_GITHUB_TOKEN, GH_TOKEN, GITHUB_TOKEN, gh auth token, config file (deprecated)
├── github/      # every page of releases, release assets, rate-limit and 401 messages
├── config/      # YAML without viper, read only from ~/.educatesenv, files created 0600
├── version/     # install, uninstall, active-binary handling, download timeouts
└── cmd/         # built by NewRootCommand, tested in-process
internal/
├── clitest/     # harness: temporary HOME, controlled PATH, fake gh
└── fakegithub/  # httptest GitHub: pages, assets, rate limits, cut and stalled downloads

Build and release:

• Go 1.26.0 language version with the go1.26.10 toolchain, read by every
  workflow from go.mod. go-github v93, cobra 1.10.2, testify 1.12.1;
  viper and oauth2 removed.
• Actions pinned by commit SHA to their latest release, kept current by
  Dependabot. golangci-lint pinned to v2.15.0 and run on pull requests,
  GoReleaser to v2.19.0.
• Release assets are named educatesenv-<os>-<arch>, so the download
  command in the release notes header works.
• MACOS_SIGNING switches macOS signing and notarization. The release
  workflow sets it to false for a manual run with skip-signing, or for
  every run while the MACOS_SIGNING repository variable is false, and
  annotates such runs. Otherwise the first step fails the run when any
  of the five MACOS_* secrets is empty, so GoReleaser can no longer sign
  without notarizing, or skip signing, and still succeed.
• The release checkout has the full history for the changelog, and a
  rerun replaces a draft left by a failed run.

Evidence

• Before: 7 test functions, none of them on the CLI or the GitHub
  client. After: 118, with go test ./... passing and golangci-lint
  v2.15.0 reporting 0 issues. A betterleaks scan of the new commits finds
  no leaks.

• Behavior tests written first, against the old code:

  init --download, the 12 newest releases all release candidates
    before: fails, no stable release among the 10 newest
    after:  installs the highest stable release
  install, connection cut mid-transfer, then a retry
    before: partial binary left, the retry says "already installed"
    after:  nothing left behind, the retry installs
  install, server stops sending mid-transfer
    before: hangs
    after:  fails after 60 seconds without data, nothing left behind
  list-remote over 250 releases
    before: the first 100 only
    after:  every page, 100 per request
  development symlink into a sibling directory such as bin2
    before: taken for the bin directory
    after:  outside it
  binary built with go install at a tag
    before: reports "develop"
    after:  reports the tag
  

• Signing switch, goreleaser build with every signing secret empty:

  Build	MACOS_SIGNING	Result
  snapshot	unset, empty, false	builds, signing skipped
  snapshot	true	tries to sign, fails on the empty certificate
  release	unset, empty, true	tries to sign, fails on the empty certificate
  release	false	builds, signing skipped

• Not verified: the workflow expressions only run on GitHub, so the first
  release run is their end-to-end test.

Merge Danger

Door: two-way

Reverting the merge restores v1.0.0's behavior. The one-way step is
tagging and publishing v1.1.0, which stays manual.

Blast Radius: CLI users and the release pipeline

• list-remote --all now means every stable release, and list-remote
  prints a table of the 10 newest by default. Scripts parsing the old
  output or relying on --all for pre-releases change.
• A config.yaml in the working directory is no longer read.
• A token in the config file still works but warns; init no longer
  writes one.
• The next tag push needs all five MACOS_* secrets, or the
  MACOS_SIGNING repository variable set to false, or it fails before
  creating a release.