v0.3.6

What's Changed

• docs: first-screen treatment for both READMEs by @9t29zhmwdh-coder in #34

Full Changelog: v0.3.5...v0.3.6

What's Changed

• docs: first-screen treatment for both READMEs by @9t29zhmwdh-coder in #34

Full Changelog: v0.3.5...v0.3.6

v0.3.5

What's Changed

• security: narrow the release token to the job that needs it by @9t29zhmwdh-coder in #33

Full Changelog: v0.3.4...v0.3.5

What's Changed

• security: narrow the release token to the job that needs it by @9t29zhmwdh-coder in #33

Full Changelog: v0.3.4...v0.3.5

v0.3.4

What's Changed

• chore(ci): bump the actions group across 1 directory with 3 updates by @dependabot[bot] in #29
• chore(deps): bump the cargo group across 1 directory with 7 updates by @dependabot[bot] in #31
• chore: version the merged dependency updates by @9t29zhmwdh-coder in #32

New Contributors

• @dependabot[bot] made their first contribution in #29

Full Changelog: v0.3.3...v0.3.4

What's Changed

• chore(ci): bump the actions group across 1 directory with 3 updates by @dependabot[bot] in #29
• chore(deps): bump the cargo group across 1 directory with 7 updates by @dependabot[bot] in #31
• chore: version the merged dependency updates by @9t29zhmwdh-coder in #32

New Contributors

• @dependabot[bot] made their first contribution in #29

Full Changelog: v0.3.3...v0.3.4

v0.3.3

What's Changed

• ci: CodeQL advanced setup, limit the cargo group to minor and patch by @9t29zhmwdh-coder in #30

Full Changelog: v0.3.2...v0.3.3

What's Changed

• ci: CodeQL advanced setup, limit the cargo group to minor and patch by @9t29zhmwdh-coder in #30

Full Changelog: v0.3.2...v0.3.3

v0.3.2

What's Changed

• docs: add OpenSSF Best Practices badge by @9t29zhmwdh-coder in #24
• Add release workflow for ghass CLI binaries by @9t29zhmwdh-coder in #25
• chore(ci): add dependabot, align action pins by @9t29zhmwdh-coder in #26
• fix: version 0.3.1 was already released, move to 0.3.2 by @9t29zhmwdh-coder in #28

Full Changelog: v0.3.1...v0.3.2

What's Changed

• docs: add OpenSSF Best Practices badge by @9t29zhmwdh-coder in #24
• Add release workflow for ghass CLI binaries by @9t29zhmwdh-coder in #25
• chore(ci): add dependabot, align action pins by @9t29zhmwdh-coder in #26
• fix: version 0.3.1 was already released, move to 0.3.2 by @9t29zhmwdh-coder in #28

Full Changelog: v0.3.1...v0.3.2

v0.3.1

Patch release: OpenSSF Scorecard workflow/badge, copilot-instructions.md, badge two-line rendering fix, and repo-specific fixes found during the portfolio audit. See CHANGELOG.md for details.

v0.3.0 — SARIF line numbers + test coverage

Added

• Full SARIF 2.1.0 output (ghass scan --format sarif): each result now includes a best-effort region.startLine, resolved by a new text-based line index (ghass_scan::line_index) that maps parsed jobs/steps back to their source line without needing a span-aware YAML parser. Results also carry a stable partialFingerprints hash so tools consuming this output (e.g. GitHub code scanning) can dedupe the same finding across repeated scans. This replaces the previous stub, which always emitted an empty results array.
• Job, Step, and Finding now carry a line: Option<usize> field.

Fixed

• The SARIF tool.driver.version field was hardcoded to "0.1.0" regardless of the actual release; it now reads env!("CARGO_PKG_VERSION") like the rest of the CLI.
• examples/hardened_workflow.yml's "expected findings: none" example workflow actually produced one UnpinnedAction finding, because its placeholder commit SHA was 41 hex characters instead of 40. Fixed the fixture; added a regression test (ghass-scan/tests/scan_examples.rs) asserting the hardened example stays clean.

Testing

• Added 78 unit/integration tests for the 6 previously-untested analyzer modules, the parser, and the report formatters (none of this had test coverage before this release cycle, aside from the custom rule engine).

v0.2.0 — Custom Rule Engine

Added

• Custom rule engine: ghass scan --rules <file.yml> evaluates org-specific policy rules from a YAML file alongside the built-in analyzers. Each rule matches at step, job, or workflow level (inferred from which condition it uses) via uses_matches, run_contains, env_key_contains, runs_on_contains, job_write_all, trigger_equals, workflow_write_all, and the combinators all/any/not. Matches show up in every existing output format tagged Custom Rule: <id>. See the new "Custom Rules" README section and examples/custom-rules.yml.

Fixed

• ghass --version now reads the crate version from Cargo.toml instead of a hardcoded string that had drifted out of sync with actual releases.

Full Changelog: v0.1.8...v0.2.0

v0.1.8

Removed em-dashes/en-dashes from GETTING_STARTED.md (Swiss German orthography rule). See CHANGELOG.md for details.

v0.1.7

Security

• Fixed two inaccurate claims in SECURITY.md: dtolnay/rust-toolchain was pinned to the mutable stable tag, not a commit SHA as claimed, and Cargo.lock was gitignored, not committed as claimed. Both fixed for real.
• Switched vulnerability reporting to GitHub Security Advisories.
• Added a cargo audit job to CI.