ArtifactFlow v0.0.5

Container image (pin by digest):

ghcr.io/gadsotek/artifactflow@sha256:351a9381376d66fc0827143c0b3db2a4ffe28d386f1a378977f1ba54a8a5c656

Verify build provenance and SBOM before running (needs the GitHub CLI):

gh attestation verify oci://ghcr.io/gadsotek/artifactflow@sha256:351a9381376d66fc0827143c0b3db2a4ffe28d386f1a378977f1ba54a8a5c656 --repo Gadsotek/artifactflow

SLSA build provenance and a CycloneDX SBOM are keyless-signed (Sigstore) and attested to the image digest, and pushed alongside it in the registry; the SBOM is also attached to this release as sbom.cdx.json.
The image was scanned with Trivy (vuln, secret, misconfig; HIGH/CRITICAL gate) before publishing.
Self-hosting docs: docs/OPERATIONS.md. AGPL Section 13 applies to network use; see COMMERCIAL.md for the commercial path.

What's Changed

• Harden artifact preview against declarative-shadow-DOM context smuggling by @Gadsotek in #23
• ci: exempt Dependabot from the DCO sign-off gate by @Gadsotek in #28
• chore(deps): Bump php from e2b5f24 to 58b996c by @dependabot[bot] in #25
• chore(deps-dev): Bump the npm-minor-patch group across 1 directory with 3 updates by @dependabot[bot] in #27
• chore(deps): Bump the composer-minor-patch group across 1 directory with 4 updates by @dependabot[bot] in #26
• chore(deps): Bump actions/checkout from 7.0.0 to 7.0.1 by @dependabot[bot] in #24
• Add the public project website and tighten sandbox honesty in docs by @Gadsotek in #29
• test: re-enable cross-engine e2e on the artifact-security corpus by @Gadsotek in #30
• Prepare v0.0.5 release by @Gadsotek in #31

Full Changelog: v0.0.4...v0.0.5