Skip to content

ArtifactFlow v0.0.1

Choose a tag to compare

View all tags
@github-actions github-actions released this 16 Jul 11:58
v0.0.1
a6adb9f

Container image (pin by digest):

ghcr.io/gadsotek/artifactflow@sha256:c5fc09e8a568398559cd7d2243f04ec20b47d20c4961dfac5df848656d980a05

Verify build provenance and SBOM before running (needs the GitHub CLI):

gh attestation verify oci://ghcr.io/gadsotek/artifactflow@sha256:c5fc09e8a568398559cd7d2243f04ec20b47d20c4961dfac5df848656d980a05 --repo Gadsotek/artifactflow

SLSA build provenance and a CycloneDX SBOM are keyless-signed (Sigstore) and attested to the image digest, and pushed alongside it in the registry; the SBOM is also attached to this release as sbom.cdx.json.
The image was scanned with Trivy (vuln, secret, misconfig; HIGH/CRITICAL gate) before publishing.
Self-hosting docs: docs/OPERATIONS.md. AGPL Section 13 applies to network use; see COMMERCIAL.md for the commercial path.

Full Changelog: https://github.com/Gadsotek/artifactflow/commits/v0.0.1

Assets 3
Loading