Skip to content

v0.2.0 — source release

Latest
Latest

Choose a tag to compare

View all tags
@4alvit 4alvit released this 17 Oct 12:11
· 12 commits to main since this release
v0.2.0
This tag was signed with the committer’s verified signature.
4alvit alvit
SSH Key Fingerprint: QEunrABOZ59OMGRDPfo1Uo4UBKxvxtA1TuGmKbpW42w
Verified
Learn about vigilant mode.
135a27e
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

[0.2.0] - 2026-10-17

Security

  • Add the explicitly labelled GitHub provider 6.13.0-openssf.1 local derivative with Go 1.27.2 and patched x/net, x/text, x/crypto and grpc dependencies. This addresses source-reachable dependency findings including GO-2026-6607 and GO-2026-6629 in the supported independent local deployment; it does not replace the official provider in existing HCP deployments.
  • Document the separate, dated OpenTofu applicability assessment, strict transport checks and engine/provider integrity requirements. See the complete profile. No project CVE is assigned.

Changed

  • Require one approving review while preserving stale-review dismissal, CI requirements and existing resource identities.

  • Preserve existing GitHub policy during state reconciliation, keep private integration inputs protected, and manage the deployment endpoint as an Actions secret.

  • Persist the EPG Actions approval policy and correct the provider import identifier for the existing endpoint secret.

  • Document the verified strict Terraform/provider TLS profile and source-release scope.

  • Add governance, conduct and a one-year roadmap without changing live infrastructure.

Upgrade

This is a source-only release with governance and state-management changes, not an applied infrastructure plan. Review the changes from 0.1.0 before using the configuration. Preserve the existing state and workspace bindings; import or forget only the explicitly reviewed resource identities, and inspect a fresh state-aware plan before any apply. Never apply this source against an empty replacement state. Where documented, run the review-policy reconciliation command after Terraform to preserve the additional Copilot setting. The independently patched provider profile is opt-in and does not replace the official HCP provider automatically. Keep the prior source tag and a protected state backup for rollback.

Source qualification

Channel: stable. Source 135a27e7b43333745c1b01df2fc4ff744b9b510b, tree 88e86b5edb37e219473b599a049a004f3b28f8e9. This archive contains the reviewed public tracked source only. Its bytes are identical across this beta, RC and stable cycle; channel identity is recorded in the signed tag and manifest.

Archive SHA-256: 07c4ed273dad086ec9d3bd8f7fed4deccae12f0172192a762c721b1bf1681757.

No infrastructure plan, apply, production deployment or live-system acceptance was performed by this release.

Assets 5
Loading