From aa331800cc550aed2053bee51e4fc070c56eac53 Mon Sep 17 00:00:00 2001
From: PiX <69745008+pixincreate@users.noreply.github.com>
Date: Sun, 2 Aug 2026 22:47:36 +0530
Subject: [PATCH 1/2] fix: make changelog release insertion portable

---
 .../action_validation/release_script_scenario.py  |  9 ++++++++-
 scripts/release.sh                                | 15 ++++++++++-----
 2 files changed, 18 insertions(+), 6 deletions(-)

diff --git a/scripts/action_validation/release_script_scenario.py b/scripts/action_validation/release_script_scenario.py
index 2b66b97..9859fc0 100644
--- a/scripts/action_validation/release_script_scenario.py
+++ b/scripts/action_validation/release_script_scenario.py
@@ -92,7 +92,14 @@ def run_release_scenario(root: Path) -> None:
         cargo_calls = cargo_capture.read_text(encoding="utf-8")
         require("version = \"2.0.0\"" in cargo, "release must update Cargo.toml")
         require("version = \"2.0.0\"" in lock, "release must update Cargo.lock")
-        require("## [2.0.0] -" in changelog, "release must promote the changelog")
+        require(
+            re.search(
+                r"(?m)^## \[Unreleased\]\n\n## \[2\.0\.0\] - \d{4}-\d{2}-\d{2}$",
+                changelog,
+            )
+            is not None,
+            "release must keep Unreleased and the release heading on separate lines",
+        )
         require(
             re.search(r"(?m)^    default: '2\.0\.0'$", action) is not None,
             "release must update the Action version",
diff --git a/scripts/release.sh b/scripts/release.sh
index f7d111f..fcc7e0c 100755
--- a/scripts/release.sh
+++ b/scripts/release.sh
@@ -102,11 +102,16 @@ update_version_files() {
         Cargo.toml
     rm Cargo.toml.bak
 
-    sed -i.bak \
-        -e "s/^## \[Unreleased\]$/## [Unreleased]\
-\
-## [$VERSION] - $DATE/" \
-        CHANGELOG.md && rm CHANGELOG.md.bak
+    local changelog_tmp
+    changelog_tmp=$(mktemp "${TMPDIR:-/tmp}/keywatch-changelog.XXXXXX")
+    awk -v version="$VERSION" -v release_date="$DATE" '
+        { print }
+        $0 == "## [Unreleased]" {
+            print ""
+            print "## [" version "] - " release_date
+        }
+    ' CHANGELOG.md > "$changelog_tmp"
+    mv "$changelog_tmp" CHANGELOG.md
 
     sed -i.bak \
         -e "/^  version:$/,/^  paths:$/ s/^    default: .*/    default: '$VERSION'/" \

From de9f000952a324179ca10d38fe7aedd00626ff77 Mon Sep 17 00:00:00 2001
From: PiX <69745008+pixincreate@users.noreply.github.com>
Date: Sun, 2 Aug 2026 22:48:32 +0530
Subject: [PATCH 2/2] release(KeyWatch): version 2.0.0

---
 CHANGELOG.md | 2 ++
 Cargo.lock   | 2 +-
 Cargo.toml   | 2 +-
 action.yml   | 2 +-
 4 files changed, 5 insertions(+), 3 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 22fb088..91f87a0 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -4,6 +4,8 @@ All notable changes to this project will be documented in this file.
 
 ## [Unreleased]
 
+## [2.0.0] - 2026-08-02
+
 ### Breaking Changes
 
 - Public Rust APIs now return module-local typed errors instead of `String` or boxed errors. This affects CLI validation, baseline, configuration, detector initialization, scanner, hook, and `run_cli()` return types and requires a major-version release.
diff --git a/Cargo.lock b/Cargo.lock
index 7ca8224..7fa98a0 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -305,7 +305,7 @@ checksum = "8f42a60cbdf9a97f5d2305f08a87dc4e09308d1276d28c869c684d7777685682"
 
 [[package]]
 name = "key-watch"
-version = "1.1.0"
+version = "2.0.0"
 dependencies = [
  "clap",
  "dirs",
diff --git a/Cargo.toml b/Cargo.toml
index ccb5566..e1c1fc7 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "key-watch"
-version = "1.1.0"
+version = "2.0.0"
 edition = "2024"
 rust-version = "1.85"
 authors = ["Pa1Nark <pa1nark@pixincreate.dev>"]
diff --git a/action.yml b/action.yml
index 907cc7d..a46a2cd 100644
--- a/action.yml
+++ b/action.yml
@@ -6,7 +6,7 @@ inputs:
   version:
     description: 'Exact KeyWatch release version to install'
     required: false
-    default: '1.1.0'
+    default: '2.0.0'
   paths:
     description: 'Paths to scan (space-separated, supports globs)'
     required: false