feat: add garble obfuscation for Windows builds and fix changelog generation

- Add garble tool installation to release workflow
- Configure garble obfuscation for Windows builds only
- Fix changelog walker to handle unreleased commits
- Update changelog database with latest changes
- Add mvdan to VSCode dictionary settings
- Implement boundary detection for released vs unreleased
- Keep newer commits as "Unreleased" until tagged

.github/workflows/release.yml

@@ -44,6 +44,8 @@ jobs:
         uses: actions/setup-go@v5
         with:
           go-version-file: ./go.mod
+      - name: Install garble
+        run: go install mvdan.cc/garble@latest
       - name: Run GoReleaser
         uses: goreleaser/goreleaser-action@v6
         with:

.goreleaser.yaml

@@ -11,14 +11,30 @@ before:
     # - go generate ./...
 
 builds:
-  - env:
+  - id: default
+    env:
       - CGO_ENABLED=0
     goos:
-      - linux
-      - windows
       - darwin
+      - linux
     main: ./cmd/fabric
     binary: fabric
+  - id: windows-garbled
+    env:
+      - CGO_ENABLED=0
+    goos:
+      - windows
+    main: ./cmd/fabric
+    binary: fabric
+    tool: garble
+    # From https://github.com/eyevanovich/garble-goreleaser-example/blob/main/.goreleaser.yaml
+    # command is a single string.
+    # garble's 'build' needs the -literals and -tiny args before it, so we
+    # trick goreleaser into using -literals as command, and pass -tiny and
+    # build as flags.
+    command: "-literals"
+    flags: [ "-tiny", "-seed=random", "build" ]
+    ldflags: [ "-s", "-w" ]
 
 archives:
   - formats: [tar.gz]

.vscode/settings.json

@@ -117,6 +117,7 @@
 		"modeline",
 		"modelines",
 		"mpga",
+		"mvdan",
 		"nicksnyder",
 		"nixpkgs",
 		"nometa",

CHANGELOG.md

@@ -103,7 +103,7 @@
 - Replace with correct div structure and styling
 - Use proper Warp image URL from brand assets
 
-- Add 'Special thanks to:' text and platform availability
+- Add "Special thanks to:" text and platform availability
 - Maintains proper spacing and alignment
 - Fix unclosed div tag in README causing display issues
 

cmd/generate_changelog/incoming/1773.txt

@@ -0,0 +1,7 @@
+### PR [#1773](https://github.com/danielmiessler/Fabric/pull/1773) by [ksylvan](https://github.com/ksylvan): Add Garble Obfuscation for Windows Builds
+
+- Add garble obfuscation for Windows builds and fix changelog generation
+- Add garble tool installation to release workflow
+- Configure garble obfuscation for Windows builds only
+- Fix changelog walker to handle unreleased commits
+- Implement boundary detection for released vs unreleased commits

cmd/generate_changelog/internal/git/walker.go

@@ -180,6 +180,15 @@ func (w *Walker) WalkHistory() (map[string]*Version, error) {
 		return nil, fmt.Errorf("failed to get commit log: %w", err)
 	}
 
+	// Get the latest tag to know the boundary between released and unreleased
+	latestTag, _ := w.GetLatestTag()
+	var latestTagHash plumbing.Hash
+	if latestTag != "" {
+		if tagRef, err := w.repo.Tag(latestTag); err == nil {
+			latestTagHash = tagRef.Hash()
+		}
+	}
+
 	versions := make(map[string]*Version)
 	currentVersion := "Unreleased"
 	versions[currentVersion] = &Version{
@@ -188,8 +197,18 @@ func (w *Walker) WalkHistory() (map[string]*Version, error) {
 	}
 
 	prNumbers := make(map[string][]int)
+	passedLatestTag := false
+	// If there's no latest tag, treat all commits as belonging to their found versions
+	if latestTag == "" {
+		passedLatestTag = true
+	}
 
 	err = commitIter.ForEach(func(c *object.Commit) error {
+		// Check if we've passed the latest tag boundary
+		if !passedLatestTag && latestTagHash != (plumbing.Hash{}) && c.Hash == latestTagHash {
+			passedLatestTag = true
+		}
+
 		// c.Message = Summarize(c.Message)
 		commit := &Commit{
 			SHA:     c.Hash.String(),
@@ -203,7 +222,12 @@ func (w *Walker) WalkHistory() (map[string]*Version, error) {
 		if matches := versionPattern.FindStringSubmatch(commit.Message); len(matches) > 1 {
 			commit.IsVersion = true
 			commit.Version = matches[1]
-			currentVersion = commit.Version
+
+			// Only change currentVersion if we're past the latest tag
+			// This keeps newer commits as "Unreleased"
+			if passedLatestTag {
+				currentVersion = commit.Version
+			}
 
 			if _, exists := versions[currentVersion]; !exists {
 				versions[currentVersion] = &Version{