v0.15.0

Changelog

Features

• 436738d feat(ci): extend tool-version checker to docker image pins
• 10a4b8a feat(ci): integrate betterleaks secret scanning
• a7d81af feat(ci): integrate semgrep pattern-based SAST

Bug Fixes

• dab5809 fix(ci): chown workspace to container user for betterleaks scan
• 23a343e fix(ci): mark workspace as safe.directory in betterleaks container
• 71985ab fix(ci): use --system git config for betterleaks safe.directory
• e78ef59 fix(deps): bump golang.org/x/net to v0.55.0
• b644dc5 fix(deps): bump golangci-lint from v2.12.1 to v2.12.2

v0.14.1

Changelog

Bug Fixes

• 713ce3a fix(deps): bump go 1.26.3 + golang.org/x/net v0.53.0
• 32596b7 fix(tools): parse goreleaser version across multi-file pin in check-tool-versions.sh

v0.14.0

Changelog

Features

• a7e1ab6 feat(devshell): add direnv support for nix flake

v0.13.1

Changelog

Features

• 0e73366 feat(release): add optional kind parameter to release target
• c927939 feat(skills): add tool-version-update skill for automated Go tool pinning updates

Bug Fixes

• 15edbe9 fix(tools): include goreleaser-lint.yml in check-tool-versions.sh registry

Other

• 18e4b82 refactor(release): unify artifact naming to consistent underscore pattern

v0.13.0

Changelog

Features

• a4974d0 feat(release): add OpenVEX vulnerability assessment to release artifacts

Other

• 2891423 refactor: simplify verify-release script to attestation-only

v0.12.0

Changelog

Features

• 92d7d5e feat(ci): improve OpenSSF Scorecard checks
• 5d1720b feat(ci): switch to GitHub-native SLSA provenance
• f425677 feat: add tag ruleset, workflow permissions, and CODEOWNERS to hardening script
• 9effd68 feat: enforce branch integrity and tag rules for admins in hardening script

Bug Fixes

• 74c50b0 fix(ci): correct imposter commit SHA for github/codeql-action v3.28.18
• 10f75ac fix(ci): correct imposter commit SHA for ossf/scorecard-action v2.4.3
• 3cd387a fix(ci): correct pinned SHA for ossf/scorecard-action v2.4.3
• d1b1d5a fix: pin required status checks to GitHub Actions source
• 02dd85a fix: quote bracket arguments in harden-repo.sh to resolve shellcheck SC2102
• beec4fd fix: remove unused nolint directive in download.go

Other

• 6be51df ci(codeql): restrict triggers to Go code changes
• e97260d refactor: migrate branch protection to ruleset in harden-repo.sh

v0.11.1

Changelog

Bug Fixes

• 4cb917e fix: bump Go version to 1.26.1
• fcdee9e fix: silence justfile release recipe with @ prefix

v0.11.0

Changelog

Features

• 7c7fae7 feat: add build, test, lint, and CI targets to justfile
• e049f9e feat: add justfile targets and document development workflow
• 2457be4 feat: add justfile with release and flake-update targets
• 669bde0 feat: add release alias to justfile

Bug Fixes

• 770f0a6 fix: add tidy-check and license-check to justfile ci target
• 41117a3 fix: drop Version ldflags from Nix flake, add Date

v0.10.0

Changelog

Features

• 309c215 feat: add Nix flake for build, install, and dev shell
• 7009bdd feat: add man page generation to Nix flake

v0.9.1

Changelog

Bug Fixes

• 95cdbb2 fix: remove duplicate security vulnerability entry in issue templates
• e8adcab fix: use basename for archive lookup in verify-release.sh