v0.2.2

0.2.2 (2026-11-03)

Bug Fixes

• admit a SOPS file whose only values are empty (c1d749f)

Documentation

• compare settings-image with every folder-to-registry tool (020132c)
• explain digests and provenance, add imgpkg as prior art (93bf52a)

GitHub Action

- uses: ConfigButler/settings-image@v0.2.2
  with:
    path: configs/shop
    repository: ghcr.io/acme/shop-settings

CLI

Binaries for linux/amd64, linux/arm64 and darwin/arm64, with a checksums file:

curl -fsSLO https://github.com/ConfigButler/settings-image/releases/download/v0.2.2/settings-image_linux_amd64
curl -fsSL https://github.com/ConfigButler/settings-image/releases/download/v0.2.2/settings-image.sha256sums | sha256sum -c --ignore-missing

Verify the checksums file was signed by this repository's release workflow:

curl -fsSLO https://github.com/ConfigButler/settings-image/releases/download/v0.2.2/settings-image.sha256sums.sigstore.json
cosign verify-blob settings-image.sha256sums \
  --bundle settings-image.sha256sums.sigstore.json \
  --certificate-identity-regexp '^https://github.com/ConfigButler/settings-image/\.github/workflows/release\.yml@' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

Each binary also carries SLSA provenance:

gh attestation verify settings-image_linux_amd64 --repo ConfigButler/settings-image

v0.2.1

0.2.1 (2026-11-03)

Miscellaneous Chores

• release 0.2.1 (d386ab6)

GitHub Action

- uses: ConfigButler/settings-image@v0.2.1
  with:
    path: configs/shop
    repository: ghcr.io/acme/shop-settings

CLI

Binaries for linux/amd64, linux/arm64 and darwin/arm64, with a checksums file:

curl -fsSLO https://github.com/ConfigButler/settings-image/releases/download/v0.2.1/settings-image_linux_amd64
curl -fsSL https://github.com/ConfigButler/settings-image/releases/download/v0.2.1/settings-image.sha256sums | sha256sum -c --ignore-missing

Verify the checksums file was signed by this repository's release workflow:

curl -fsSLO https://github.com/ConfigButler/settings-image/releases/download/v0.2.1/settings-image.sha256sums.sigstore.json
cosign verify-blob settings-image.sha256sums \
  --bundle settings-image.sha256sums.sigstore.json \
  --certificate-identity-regexp '^https://github.com/ConfigButler/settings-image/\.github/workflows/release\.yml@' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

Each binary also carries SLSA provenance:

gh attestation verify settings-image_linux_amd64 --repo ConfigButler/settings-image

v0.2.0

0.2.0 (2026-11-03)

Features

• add a timestamp tag that never moves, for Flux image automation (4bd6d43)
• name no commit author in provenance by default (f00d31f)
• push to any registry with a bearer token, and exit 4 on a refused credential (9cbe2cc)
• skip known top-level files beside resources/ and raw/ (62a3262)

Bug Fixes

• check every path at Build, read only up to the size limit, refuse stray directories (d207382)
• the Action failed to load: an expression in an input description (d88fcd8)

Documentation

• a README for someone who just wants to push and mount, and less history (b0e793e)
• a walkthrough that copy-pastes, and say what happens to resources and Secrets (a229844)
• design skipping top-level files and pushing to any registry (c940497)
• plan a sortable tag for Flux, private-by-default provenance, and token fixes (73ff226)
• the README says plainly that this is a Kubernetes-aware settings (d207382)
• v0.1.0 is out, with binaries; record how its release was finished (bc3fd24)

GitHub Action

- uses: ConfigButler/settings-image@v0.2.0
  with:
    path: configs/shop
    repository: ghcr.io/acme/shop-settings

CLI

Binaries for linux/amd64, linux/arm64 and darwin/arm64, with a checksums file:

curl -fsSLO https://github.com/ConfigButler/settings-image/releases/download/v0.2.0/settings-image_linux_amd64
curl -fsSL https://github.com/ConfigButler/settings-image/releases/download/v0.2.0/settings-image.sha256sums | sha256sum -c --ignore-missing

Verify the checksums file was signed by this repository's release workflow:

curl -fsSLO https://github.com/ConfigButler/settings-image/releases/download/v0.2.0/settings-image.sha256sums.sigstore.json
cosign verify-blob settings-image.sha256sums \
  --bundle settings-image.sha256sums.sigstore.json \
  --certificate-identity-regexp '^https://github.com/ConfigButler/settings-image/\.github/workflows/release\.yml@' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

Each binary also carries SLSA provenance:

gh attestation verify settings-image_linux_amd64 --repo ConfigButler/settings-image

v0.1.0

0.1.0 (2026-11-02)

⚠ BREAKING CHANGES

• layout v2. A folder must put its files under resources/ or raw/; the image paths objects/ and files/ become resources/, raw/ and configmaps/; --no-files and the Action's files input are removed; SOPS's default rule (encrypt every value) is refused for resources, because the identity must stay readable.

Features

• admit SOPS-sealed documents, add examples and a k3d mount test (467ef7e)
• align SOPS checks with getsops/sops, and add a pictures example (0089b7b)
• attach CLI binaries to releases, and show consumers a full CI setup (f859d07)
• build and push settings images, with a composite GitHub Action (2b60369)
• layout v2, a settings folder says what each file is (5bc760f)

Documentation

• plan, format v1, CLI, GitHub Action and the case for image volumes (2110251)

GitHub Action

- uses: ConfigButler/settings-image@v0.1.0
  with:
    path: configs/shop
    repository: ghcr.io/acme/shop-settings

CLI

Binaries for linux/amd64, linux/arm64 and darwin/arm64, with a checksums file:

curl -fsSLO https://github.com/ConfigButler/settings-image/releases/download/v0.1.0/settings-image_linux_amd64
curl -fsSL https://github.com/ConfigButler/settings-image/releases/download/v0.1.0/settings-image.sha256sums | sha256sum -c --ignore-missing

Verify the checksums file was signed by this repository's release workflow:

curl -fsSLO https://github.com/ConfigButler/settings-image/releases/download/v0.1.0/settings-image.sha256sums.sigstore.json
cosign verify-blob settings-image.sha256sums \
  --bundle settings-image.sha256sums.sigstore.json \
  --certificate-identity-regexp '^https://github.com/ConfigButler/settings-image/\.github/workflows/release\.yml@' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

Once the repository is public, a binary also carries SLSA provenance:

gh attestation verify settings-image_linux_amd64 --repo ConfigButler/settings-image