Skip to content

Releases: Gadsotek/artifactflow

Release list

ArtifactFlow v0.0.6

ArtifactFlow v0.0.6 Latest
Latest

Choose a tag to compare

View all tags
@github-actions github-actions released this 25 Jul 14:26
v0.0.6
3c262e3

Container image (pin by digest):

ghcr.io/gadsotek/artifactflow@sha256:913bceb62f0acd22a2ab67a1103c3c4cbd29f53fc0dfae956a37c6c8a4d7a6f3

Verify build provenance and SBOM before running (needs the GitHub CLI):

gh attestation verify oci://ghcr.io/gadsotek/artifactflow@sha256:913bceb62f0acd22a2ab67a1103c3c4cbd29f53fc0dfae956a37c6c8a4d7a6f3 --repo Gadsotek/artifactflow

SLSA build provenance and a CycloneDX SBOM are keyless-signed (Sigstore) and attested to the image digest, and pushed alongside it in the registry; the SBOM is also attached to this release as sbom.cdx.json.
The image was scanned with Trivy (vuln, secret, misconfig; HIGH/CRITICAL gate) before publishing.
Self-hosting docs: docs/OPERATIONS.md. AGPL Section 13 applies to network use; see COMMERCIAL.md for the commercial path.

Full Changelog: v0.0.5...v0.0.6

Assets 3
Loading

ArtifactFlow v0.0.5

ArtifactFlow v0.0.5

Choose a tag to compare

View all tags
@github-actions github-actions released this 23 Jul 10:25
v0.0.5
ac713f2
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Container image (pin by digest):

ghcr.io/gadsotek/artifactflow@sha256:351a9381376d66fc0827143c0b3db2a4ffe28d386f1a378977f1ba54a8a5c656

Verify build provenance and SBOM before running (needs the GitHub CLI):

gh attestation verify oci://ghcr.io/gadsotek/artifactflow@sha256:351a9381376d66fc0827143c0b3db2a4ffe28d386f1a378977f1ba54a8a5c656 --repo Gadsotek/artifactflow

SLSA build provenance and a CycloneDX SBOM are keyless-signed (Sigstore) and attested to the image digest, and pushed alongside it in the registry; the SBOM is also attached to this release as sbom.cdx.json.
The image was scanned with Trivy (vuln, secret, misconfig; HIGH/CRITICAL gate) before publishing.
Self-hosting docs: docs/OPERATIONS.md. AGPL Section 13 applies to network use; see COMMERCIAL.md for the commercial path.

What's Changed

  • Harden artifact preview against declarative-shadow-DOM context smuggling by @Gadsotek in #23
  • ci: exempt Dependabot from the DCO sign-off gate by @Gadsotek in #28
  • chore(deps): Bump php from e2b5f24 to 58b996c by @dependabot[bot] in #25
  • chore(deps-dev): Bump the npm-minor-patch group across 1 directory with 3 updates by @dependabot[bot] in #27
  • chore(deps): Bump the composer-minor-patch group across 1 directory with 4 updates by @dependabot[bot] in #26
  • chore(deps): Bump actions/checkout from 7.0.0 to 7.0.1 by @dependabot[bot] in #24
  • Add the public project website and tighten sandbox honesty in docs by @Gadsotek in #29
  • test: re-enable cross-engine e2e on the artifact-security corpus by @Gadsotek in #30
  • Prepare v0.0.5 release by @Gadsotek in #31

Full Changelog: v0.0.4...v0.0.5

Contributors

Gadsotek and dependabot
Loading

ArtifactFlow v0.0.4

ArtifactFlow v0.0.4

Choose a tag to compare

View all tags
@github-actions github-actions released this 22 Jul 16:26
v0.0.4
436b97f
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Container image (pin by digest):

ghcr.io/gadsotek/artifactflow@sha256:5dd20eb5b48bbc88e55e6d01e2e149c36aa509427fe6b3748adac779b5434b85

Verify build provenance and SBOM before running (needs the GitHub CLI):

gh attestation verify oci://ghcr.io/gadsotek/artifactflow@sha256:5dd20eb5b48bbc88e55e6d01e2e149c36aa509427fe6b3748adac779b5434b85 --repo Gadsotek/artifactflow

SLSA build provenance and a CycloneDX SBOM are keyless-signed (Sigstore) and attested to the image digest, and pushed alongside it in the registry; the SBOM is also attached to this release as sbom.cdx.json.
The image was scanned with Trivy (vuln, secret, misconfig; HIGH/CRITICAL gate) before publishing.
Self-hosting docs: docs/OPERATIONS.md. AGPL Section 13 applies to network use; see COMMERCIAL.md for the commercial path.

What's Changed

Full Changelog: v0.0.3...v0.0.4

Contributors

Gadsotek
Loading

ArtifactFlow v0.0.3

ArtifactFlow v0.0.3

Choose a tag to compare

View all tags
@github-actions github-actions released this 21 Jul 13:02
v0.0.3
fae2dee
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Container image (pin by digest):

ghcr.io/gadsotek/artifactflow@sha256:8bbf9a1b300c4a004b0624907d078bfa2e7fd90eedb72562151bd696d4c86d8b

Verify build provenance and SBOM before running (needs the GitHub CLI):

gh attestation verify oci://ghcr.io/gadsotek/artifactflow@sha256:8bbf9a1b300c4a004b0624907d078bfa2e7fd90eedb72562151bd696d4c86d8b --repo Gadsotek/artifactflow

SLSA build provenance and a CycloneDX SBOM are keyless-signed (Sigstore) and attested to the image digest, and pushed alongside it in the registry; the SBOM is also attached to this release as sbom.cdx.json.
The image was scanned with Trivy (vuln, secret, misconfig; HIGH/CRITICAL gate) before publishing.
Self-hosting docs: docs/OPERATIONS.md. AGPL Section 13 applies to network use; see COMMERCIAL.md for the commercial path.

What's Changed

Full Changelog: v0.0.2...v0.0.3

Contributors

Gadsotek
Loading

ArtifactFlow v0.0.2

ArtifactFlow v0.0.2

Choose a tag to compare

View all tags
@github-actions github-actions released this 20 Jul 10:21
v0.0.2
3c2dc5d
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Container image (pin by digest):

ghcr.io/gadsotek/artifactflow@sha256:5f09cfc2041c22a1f1201c0409937304ecbd10be54453d97cc51242f470fa25a

Verify build provenance and SBOM before running (needs the GitHub CLI):

gh attestation verify oci://ghcr.io/gadsotek/artifactflow@sha256:5f09cfc2041c22a1f1201c0409937304ecbd10be54453d97cc51242f470fa25a --repo Gadsotek/artifactflow

SLSA build provenance and a CycloneDX SBOM are keyless-signed (Sigstore) and attested to the image digest, and pushed alongside it in the registry; the SBOM is also attached to this release as sbom.cdx.json.
The image was scanned with Trivy (vuln, secret, misconfig; HIGH/CRITICAL gate) before publishing.
Self-hosting docs: docs/OPERATIONS.md. AGPL Section 13 applies to network use; see COMMERCIAL.md for the commercial path.

What's Changed

  • Bump nunomaduro/collision from 8.9.4 to 8.9.5 in the composer-minor-patch group by @dependabot[bot] in #1
  • Bump dunglas/frankenphp from bb85482 to 070d9a3 by @dependabot[bot] in #2
  • Bump vite from 8.1.4 to 8.1.5 in the npm-minor-patch group by @dependabot[bot] in #3
  • feat(security): authenticate and content-bind the pre-save draft preview by @Gadsotek in #5
  • chore(ai-hooks): broaden coverage of the best-effort guard hooks by @Gadsotek in #7
  • fix(realtime): keep content saves succeeding when the after-commit broadcast fails by @Gadsotek in #8
  • fix(security): prevent nested browsing contexts and WebRTC egress in artifact preview by @Gadsotek in #6
  • fix(security): harden artifact-preview nested-context neutralization against parser differentials by @Gadsotek in #10
  • fix(security): require artifact storage root outside the public web root by @Gadsotek in #12
  • fix(security): close comment and declaration parser differentials in artifact preview by @Gadsotek in #11
  • security: persistent rate-limiter cache gate + hashed invitation tokens by @Gadsotek in #13
  • security: alpha hardening + 2FA enrollment freshness + installation gating by @Gadsotek in #14

New Contributors

Full Changelog: https://github.com/Gadsotek/artifactflow/commits/v0.0.2

Contributors

Gadsotek and dependabot
Loading

ArtifactFlow v0.0.1

ArtifactFlow v0.0.1

Choose a tag to compare

View all tags
@github-actions github-actions released this 16 Jul 11:58
v0.0.1
a6adb9f

Container image (pin by digest):

ghcr.io/gadsotek/artifactflow@sha256:c5fc09e8a568398559cd7d2243f04ec20b47d20c4961dfac5df848656d980a05

Verify build provenance and SBOM before running (needs the GitHub CLI):

gh attestation verify oci://ghcr.io/gadsotek/artifactflow@sha256:c5fc09e8a568398559cd7d2243f04ec20b47d20c4961dfac5df848656d980a05 --repo Gadsotek/artifactflow

SLSA build provenance and a CycloneDX SBOM are keyless-signed (Sigstore) and attested to the image digest, and pushed alongside it in the registry; the SBOM is also attached to this release as sbom.cdx.json.
The image was scanned with Trivy (vuln, secret, misconfig; HIGH/CRITICAL gate) before publishing.
Self-hosting docs: docs/OPERATIONS.md. AGPL Section 13 applies to network use; see COMMERCIAL.md for the commercial path.

Full Changelog: https://github.com/Gadsotek/artifactflow/commits/v0.0.1

Loading