v0.2.0

Images (pin these digests, not the tag):

ghcr.io/maximo000/afterglow-api@sha256:6eed9590e0b810232f677b330d2556a6c8d8fd1ce97409c592cd2fe94d370158
ghcr.io/maximo000/afterglow-worker@sha256:d8776b1517462508ccd1be994ef34bfb5a72636fee4ea8f7978e317bfa04b945
ghcr.io/maximo000/afterglow-egress@sha256:13db4fe7d7637da5273b226be4afa49b85a4e7ef5eefccd7970ba9780c39bbc3

Every file and image has a build provenance attestation:
gh attestation verify <file> --repo MaXiMo000/afterglow or gh attestation verify oci://<image@digest> --repo MaXiMo000/afterglow

SBOMs are CycloneDX JSON. Security evidence: docs/SECURITY-EVIDENCE.md.

v0.1.0

Images (pin these digests, not the tag):

ghcr.io/maximo000/afterglow-api@sha256:84d237d7924e6fd6b5ef1f2ab47ca0e5a1ac71ab13e7c33165c90a2a10f65d79
ghcr.io/maximo000/afterglow-worker@sha256:a1c0666e11852b7444de6ab888c33989cb181faa92af5b9b6e1528d58a28b628
ghcr.io/maximo000/afterglow-egress@sha256:6e097d1b556d5e65573c1e866f911b2a442ea2b8df1f552cd6d755e4e42f3098

Every file and image has a build provenance attestation:
gh attestation verify <file> --repo MaXiMo000/afterglow or gh attestation verify oci://<image@digest> --repo MaXiMo000/afterglow

SBOMs are CycloneDX JSON. Security evidence: docs/SECURITY-EVIDENCE.md.