Skip to content

v0.1.0-rc1

Pre-release
Pre-release

Choose a tag to compare

View all tags
@github-actions github-actions released this 28 Sep 23:55
· 40 commits to main since this release
v0.1.0-rc1
3781f1e

Known broken — superseded by v0.1.0. Do not use.

Changelog

Security

  • 7953625 fix(vuln): a merged advisory must not inherit a sibling's CVSS score
  • a9560ca security: audit the public repository with real scanners, and make it standing

Features

  • 842d9bc feat: SCRAM MVP — PR-native supply chain risk scanning
  • 7023590 feat: dependency blame (scram blame )
  • 23f99c5 feat: dependency blast radius (scram why)
  • ef1d8d8 feat: pyproject.toml support (PEP 621 + Poetry), and two bugs it exposed
  • 27d92cf feat: real npm v1 coverage, D25 fetcher regression tests, LIMITATIONS.md
  • 84ff639 feat: risk-score trend sparkline
  • 3dbea03 feat: self-score badge (scram badge)

Fixes

  • 6f837aa fix(action): actually produce and upload SARIF, and flag the release ref as pending
  • a33c1ba fix(blame): report a re-add after removal, and refuse to guess on a shallow clone
  • 7e8d2d0 fix: a second D25 false negative in the pyproject fetch path
  • 160f3e6 fix: detect and read the requirements filenames the resolver already claimed
  • 7f6aaf2 fix: enforce a silent-zero invariant across resolver, scan, and CLI
  • 4a9e582 fix: modern npm lockfiles with a top-level dependencies map resolved to zero
  • fa78884 fix: two release ldflags named symbols that do not exist

Other

  • bf96799 ci: cosign was installed after GoReleaser instead of before it
  • eff793b ci: nightly fuzz, Go/OS matrix, golangci-lint — and the bug the linter found
  • cd267de ci: replace the shell formatting check with a Go program, and add the C/F docs
  • 8d0176b ci: the Windows failure was CRLF, and it took the log to find out
  • b9e4d19 ci: the release job could never run, because the workflow had no tag trigger
  • acd109b ci: the secret-scan workflow failed on its first run, on a URL I guessed
  • e19c8f6 ci: windows-latest failed on a POSIX-only step, not on any code
  • d459449 launch: Marketplace branding check, issue templates, and a changelog that cannot drift
  • 3070c13 release: the first tag exposed three real bugs in the release path
  • 3781f1e release: the footer template used artifact-only keys in a release scope
  • 29ac2db release: verified GoReleaser, SECURITY.md, decision index, real coverage

Verifying this release

Every binary is checksummed and signed keyless, and the signature is
bound to this workflow's identity through the public Rekor log.

# 1. Checksums -- one file covers all five targets
sha256sum -c scram_0.1.0-rc1_checksums.txt

# 2. Signatures. The .pem and .sig files sit beside each binary, under
#    scram_<os>_<arch>/. This loop checks every one of them.
for f in scram-*/scram scram-*/scram.exe; do
  [ -f "$f" ] || continue
  cosign verify-blob \
    --certificate "$f.pem" \
    --signature    "$f.sig" \
    --certificate-identity-regexp 'https://github.com/0xsan7/SCRAM/' \
    --certificate-oidc-issuer https://token.actions.githubusercontent.com \
    "$f"
done

Built from commit 3781f1e on HEAD.

The CycloneDX and SPDX SBOMs ship as release assets, generated by
this project's own code from this repository, so you can enumerate
exactly what the released binary was built from without re-running
anything.

Assets 20
Loading