ArtifactFlow v0.0.4

Container image (pin by digest):

ghcr.io/gadsotek/artifactflow@sha256:5dd20eb5b48bbc88e55e6d01e2e149c36aa509427fe6b3748adac779b5434b85

Verify build provenance and SBOM before running (needs the GitHub CLI):

gh attestation verify oci://ghcr.io/gadsotek/artifactflow@sha256:5dd20eb5b48bbc88e55e6d01e2e149c36aa509427fe6b3748adac779b5434b85 --repo Gadsotek/artifactflow

SLSA build provenance and a CycloneDX SBOM are keyless-signed (Sigstore) and attested to the image digest, and pushed alongside it in the registry; the SBOM is also attached to this release as sbom.cdx.json.
The image was scanned with Trivy (vuln, secret, misconfig; HIGH/CRITICAL gate) before publishing.
Self-hosting docs: docs/OPERATIONS.md. AGPL Section 13 applies to network use; see COMMERCIAL.md for the commercial path.

What's Changed

• Harden authentication, MCP, and production security by @Gadsotek in #21
• Prepare v0.0.4 release by @Gadsotek in #22

Full Changelog: v0.0.3...v0.0.4