Repository navigation
v0.28.0
Immutable
release. Only release title and notes can be modified.
0.28.0 (2026-10-24)
⚠ BREAKING CHANGES
- supply-chain: ci-terraform installs a pinned Terraform instead of the latest one, and ci-ansible pins ansible 14 (Python >= 3.12; set ansible-version on older interpreters).
- workflows: release.yml callers whose release PR edits .github/workflows/ files must set app-workflows-permission: true (the App token no longer carries every installation permission).
Features
- workflows: add rootless BuildKit deploy and scorecard scanning (088703d)
Bug Fixes
- ci: close fork skip bypass and add single CI gate check (52f9b69)
- security: stop changes from silencing their own Gitleaks findings (be7e1fc)
- supply-chain: pin third-party actions by SHA, examples by release (a74deb7)
- supply-chain: verify downloaded tools, pin tool versions (44f7bd0)
- update workflows to use self-repository syntax and remove deprecated token inputs (4387736)
- workflows: attest images, scope tokens and harden build inputs (9b9e897)
- workflows: harden security scanning and tool-install supply chain (eb9acb1)
- workflows: least-privilege tokens, no template injection, no persisted credentials (e7af922)