Fix dry_run flag not passed to inline hooks

Inline per-certificate hooks were always executed even in dry-run mode
because the dry_run parameter was hardcoded to false.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

CHANGELOG.md

@@ -9,6 +9,8 @@
 
 ### Fixes
 
+- Fix inline hooks ignoring `--dry-run` flag
+
 ### Changes
 
 ## 0.5.0 (2026-04-13)

debian/changelog

@@ -2,6 +2,7 @@ certforge (0.6.0-1) unstable; urgency=low
 
   * Named hooks with per-certificate reference and cross-cert dedup
   * Multiple listen addresses for HTTP-01 and TLS-ALPN-01 solvers
+  * Fix inline hooks ignoring --dry-run flag
 
  -- Roman Kivalin <roman@shl.dev>  Mon, 14 Apr 2026 00:00:00 +0000
 

src/renew.rs

@@ -274,7 +274,7 @@ async fn renew_certificate(
 
     // Run inline (per-certificate) hooks
     if !cert_config.inline_hooks.is_empty() {
-        let hook_results = hooks::run_hooks(&cert_config.inline_hooks, false).await;
+        let hook_results = hooks::run_hooks(&cert_config.inline_hooks, dry_run).await;
         for result in &hook_results {
             if let Err(e) = result {
                 tracing::warn!(error = %e, "inline hook failed (non-fatal)");