Skip to content

v0.6.2

Choose a tag to compare

View all tags
@IkarusAILabs IkarusAILabs released this 23 Oct 22:16
· 468 commits to main since this release
v0.6.2
390c251
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Adds the GitHub Action. Intelligence schema 0.5.0 and evidence contract v1.1 are unchanged.

Upgrade notes

  • check --fail-on now exits 1 when the threshold is breached without --digest too. If your CI used --fail-on without --digest, it may start failing on findings it used to pass.
  • The action is used as IkarusAILabs/OpenPulse@<sha>. Its metadata file is the root action.yml, and its docs are in docs/GITHUB_ACTION.md.

Added

  • GitHub Action (root action.yml, Phase C3). A composite action runs openpulse attest on manifests, lockfiles, SBOMs and image lists, or discovers them in the repository. It writes a job summary, a SARIF 2.1.0 log for Code Scanning and the evidence-contract JSONL. It fails only on the fail-on threshold (default action). Coverage other than COMPLETE is a warning, never a pass. CI dogfoods the action against data/fixtures on Linux and Windows.
  • attest --sarif PATH, --summary PATH and --fail-on. Every SARIF result cites its evidence URLs and the contract's content_hash. NOT_AFFECTED results are omitted. A dependency that no event applies to is reported once as an UNKNOWN note.

Security

  • CI build tooling moves to setuptools 84.1.0 (GHSA-xmj3-9gf7-h52w: a crafted wheel could write an __init__.py outside the install directory on Windows). The build requirement is now setuptools>=84.1.0.

Fixed

  • check --fail-on was ignored without --digest. The threshold only gated the digest output, so check --fail-on action exited 0 on an ACTION finding. It now gates both output shapes.

Use the action

- uses: IkarusAILabs/OpenPulse@390c251f7557442d01788e11dbf049471bd15bee # v0.6.2
  with:
    manifest: requirements.txt
    fail-on: action

Inputs, permissions and example workflows: docs/GITHUB_ACTION.md.

Full changelog: v0.6.1...v0.6.2

Assets 2
Loading