pkg/build/builders/docker.go

@@ -187,7 +187,7 @@ func (b *DockerBuilder) Build(ctx context.Context, cfg *build.Config, targets []
 func (b *DockerBuilder) validateDockerCli() error {
 	cmd := exec.Command("docker", "--version")
 	if err := cmd.Run(); err != nil {
-		return coreerr.E("DockerBuilder.validateDockerCli", "docker CLI not found. Install it from https://docs.docker.com/get-docker/", nil)
+		return coreerr.E("DockerBuilder.validateDockerCli", "docker CLI not found. Install it from https://docs.docker.com/get-docker/", err)
 	}
 	return nil
 }
@@ -197,7 +197,7 @@ func (b *DockerBuilder) ensureBuildx(ctx context.Context) error {
 	// Check if buildx is available
 	cmd := exec.CommandContext(ctx, "docker", "buildx", "version")
 	if err := cmd.Run(); err != nil {
-		return coreerr.E("DockerBuilder.ensureBuildx", "buildx is not available. Install it from https://docs.docker.com/buildx/working-with-buildx/", nil)
+		return coreerr.E("DockerBuilder.ensureBuildx", "buildx is not available. Install it from https://docs.docker.com/buildx/working-with-buildx/", err)
 	}
 
 	// Check if we have a builder, create one if not

pkg/build/builders/wails.go

@@ -144,10 +144,10 @@ func (b *WailsBuilder) buildV2Target(ctx context.Context, cfg *build.Config, tar
 	// Simple copy using the medium
 	content, err := cfg.FS.Read(sourcePath)
 	if err != nil {
-		return build.Artifact{}, err
+		return build.Artifact{}, coreerr.E("WailsBuilder.buildV2Target", "failed to read artifact "+sourcePath, err)
 	}
 	if err := cfg.FS.Write(destPath, content); err != nil {
-		return build.Artifact{}, err
+		return build.Artifact{}, coreerr.E("WailsBuilder.buildV2Target", "failed to write artifact "+destPath, err)
 	}
 
 	return build.Artifact{

pkg/build/signing/codesign.go

@@ -42,7 +42,13 @@ func (s *MacOSSigner) Available() bool {
 // Sign codesigns a binary with hardened runtime.
 func (s *MacOSSigner) Sign(ctx context.Context, fs io.Medium, binary string) error {
 	if !s.Available() {
-		return coreerr.E("codesign.Sign", "codesign not available", nil)
+		if runtime.GOOS != "darwin" {
+			return coreerr.E("codesign.Sign", "codesign is only available on macOS", nil)
+		}
+		if s.config.Identity == "" {
+			return coreerr.E("codesign.Sign", "codesign identity not configured", nil)
+		}
+		return coreerr.E("codesign.Sign", "codesign tool not found in PATH", nil)
 	}
 
 	cmd := exec.CommandContext(ctx, "codesign",

pkg/build/signing/sign.go

@@ -90,7 +90,7 @@ func SignChecksums(ctx context.Context, fs io.Medium, cfg SignConfig, checksumFi
 
 	fmt.Printf("  Signing %s with GPG...\n", checksumFile)
 	if err := signer.Sign(ctx, fs, checksumFile); err != nil {
-		return coreerr.E("signing.SignChecksums", "failed to sign checksums", err)
+		return coreerr.E("signing.SignChecksums", "failed to sign checksums file "+checksumFile, err)
 	}
 
 	return nil

pkg/release/publishers/chocolatey.go

@@ -245,8 +245,9 @@ func (p *ChocolateyPublisher) pushToChocolatey(ctx context.Context, packageDir s
 		return coreerr.E("chocolatey.Publish", "choco pack failed", err)
 	}
 
-	// Push the package
-	cmd = exec.CommandContext(ctx, "choco", "push", nupkgPath, "--source", "https://push.chocolatey.org/", "--api-key", apiKey)
+	// Push the package — pass API key via environment variable to avoid exposing it in process listings
+	cmd = exec.CommandContext(ctx, "choco", "push", nupkgPath, "--source", "https://push.chocolatey.org/")
+	cmd.Env = append(os.Environ(), "chocolateyApiKey="+apiKey)
 	cmd.Stdout = os.Stdout
 	cmd.Stderr = os.Stderr
 	if err := cmd.Run(); err != nil {

pkg/release/publishers/github.go

@@ -148,14 +148,14 @@ func validateGhCli() error {
 	// Check if gh is installed
 	cmd := exec.Command("gh", "--version")
 	if err := cmd.Run(); err != nil {
-		return coreerr.E("github.validateGhCli", "gh CLI not found. Install it from https://cli.github.com", nil)
+		return coreerr.E("github.validateGhCli", "gh CLI not found. Install it from https://cli.github.com", err)
 	}
 
 	// Check if authenticated
 	cmd = exec.Command("gh", "auth", "status")
 	output, err := cmd.CombinedOutput()
 	if err != nil {
-		return coreerr.E("github.validateGhCli", "not authenticated with gh CLI. Run 'gh auth login' first", nil)
+		return coreerr.E("github.validateGhCli", "not authenticated with gh CLI. Run 'gh auth login' first", err)
 	}
 
 	if !strings.Contains(string(output), "Logged in") {

pkg/release/publishers/npm.go

@@ -91,7 +91,7 @@ func (p *NpmPublisher) Publish(ctx context.Context, release *Release, pubCfg Pub
 	}
 
 	if dryRun {
-		return p.dryRunPublish(release.FS, data, &npmCfg)
+		return p.dryRunPublish(release.FS, data)
 	}
 
 	return p.executePublish(ctx, release.FS, data, &npmCfg)
@@ -130,7 +130,7 @@ type npmTemplateData struct {
 }
 
 // dryRunPublish shows what would be done without actually publishing.
-func (p *NpmPublisher) dryRunPublish(m coreio.Medium, data npmTemplateData, cfg *NpmConfig) error {
+func (p *NpmPublisher) dryRunPublish(m coreio.Medium, data npmTemplateData) error {
 	fmt.Println()
 	fmt.Println("=== DRY RUN: npm Publish ===")
 	fmt.Println()

pkg/release/publishers/npm_test.go

@@ -161,12 +161,7 @@ func TestNpmPublisher_DryRunPublish_Good(t *testing.T) {
 			BinaryName:  "mycli",
 			Description: "My CLI",
 		}
-		cfg := &NpmConfig{
-			Package: "@myorg/mycli",
-			Access:  "public",
-		}
-
-		err := p.dryRunPublish(io.Local, data, cfg)
+		err := p.dryRunPublish(io.Local, data)
 
 		_ = w.Close()
 		var buf bytes.Buffer
@@ -199,12 +194,8 @@ func TestNpmPublisher_DryRunPublish_Good(t *testing.T) {
 			Repository: "org/repo",
 			BinaryName: "cli",
 		}
-		cfg := &NpmConfig{
-			Package: "@private/cli",
-			Access:  "restricted",
-		}
 
-		err := p.dryRunPublish(io.Local, data, cfg)
+		err := p.dryRunPublish(io.Local, data)
 
 		_ = w.Close()
 		var buf bytes.Buffer

pkg/release/publishers/scoop.go

@@ -255,9 +255,10 @@ func (p *ScoopPublisher) renderTemplate(m coreio.Medium, name string, data scoop
 	customPath := filepath.Join(".core", name)
 	if m != nil && m.IsFile(customPath) {
 		customContent, err := m.Read(customPath)
-		if err == nil {
-			content = []byte(customContent)
+		if err != nil {
+			return "", coreerr.E("scoop.renderTemplate", "failed to read custom template "+customPath, err)
 		}
+		content = []byte(customContent)
 	}
 
 	// Fallback to embedded template