Skip to content

v0.2.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 03 Nov 06:19
Immutable release. Only release title and notes can be modified.
v0.2.0
001f74b
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

0.2.0 (2026-11-03)

Features

  • add a timestamp tag that never moves, for Flux image automation (4bd6d43)
  • name no commit author in provenance by default (f00d31f)
  • push to any registry with a bearer token, and exit 4 on a refused credential (9cbe2cc)
  • skip known top-level files beside resources/ and raw/ (62a3262)

Bug Fixes

  • check every path at Build, read only up to the size limit, refuse stray directories (d207382)
  • the Action failed to load: an expression in an input description (d88fcd8)

Documentation

  • a README for someone who just wants to push and mount, and less history (b0e793e)
  • a walkthrough that copy-pastes, and say what happens to resources and Secrets (a229844)
  • design skipping top-level files and pushing to any registry (c940497)
  • plan a sortable tag for Flux, private-by-default provenance, and token fixes (73ff226)
  • the README says plainly that this is a Kubernetes-aware settings (d207382)
  • v0.1.0 is out, with binaries; record how its release was finished (bc3fd24)

GitHub Action

- uses: ConfigButler/settings-image@v0.2.0
  with:
    path: configs/shop
    repository: ghcr.io/acme/shop-settings

CLI

Binaries for linux/amd64, linux/arm64 and darwin/arm64, with a checksums file:

curl -fsSLO https://github.com/ConfigButler/settings-image/releases/download/v0.2.0/settings-image_linux_amd64
curl -fsSL https://github.com/ConfigButler/settings-image/releases/download/v0.2.0/settings-image.sha256sums | sha256sum -c --ignore-missing

Verify the checksums file was signed by this repository's release workflow:

curl -fsSLO https://github.com/ConfigButler/settings-image/releases/download/v0.2.0/settings-image.sha256sums.sigstore.json
cosign verify-blob settings-image.sha256sums \
  --bundle settings-image.sha256sums.sigstore.json \
  --certificate-identity-regexp '^https://github.com/ConfigButler/settings-image/\.github/workflows/release\.yml@' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

Each binary also carries SLSA provenance:

gh attestation verify settings-image_linux_amd64 --repo ConfigButler/settings-image
Assets 9
Loading