v0.2.0

[0.2.0] - Security hardening (pentest remediation)

Changed (upgrade impact)

• A policy file with an unknown or misspelled key now fails to load instead of
  silently ignoring it. If you were relying on a key that was quietly dropped
  (e.g. a typo'd allow-endpoints), the run now errors until you correct it -
  this is intentional: a silently-ignored key meant the rule was never in effect.
• The Action installer verifies the release signature when cosign is present.
  On a runner that already has cosign, a release whose SHA256SUMS.bundle
  signature doesn't verify is now rejected (fail closed). The new
  require-signature input additionally makes cosign's absence a hard failure.
• The report directory may no longer be a symlink, and a local extends: ref
  may no longer resolve (via symlink or ..) outside the policy directory.

Security

• Report artifacts are now tamper-resistant. report.json / .md / .sarif
  are written atomically (temp file + rename), and the build's descendants are
  reaped (the whole build cgroup in block mode, the command's process group in
  audit mode) BEFORE the report is written - so a process the build detaches can
  no longer race and overwrite the report that the SARIF upload, PR comment, and
  dashboard issue are generated from.
• Report cells can no longer be forged via hostile filenames. mdEscape now
  strips CR/LF (and caps cell length), so a captured filename like
  evil\n\n## No violations can't inject fake rows/headers into the Markdown
  report or job summary.
• Protected-path matching is canonicalized. File/process policy now resolves
  .. and symlinks on both sides before matching, closing the traversal and
  symlink-through bypasses. (Relative-path writes remain best-effort pending
  capture-time cwd resolution - documented in SECURITY.md.)
• extends: is confined to the policy directory. A local extends ref can
  no longer escape its base directory via .., an absolute path, or a symlink
  (containment is enforced on the symlink-resolved real path), so a crafted policy
  can't pull an arbitrary local file in as its base - which on a root-privileged
  runner would be an arbitrary file read.
• The report directory can't be a symlink. Egret refuses to write reports
  through a symlinked output-dir, so the monitored build can't swap the report
  directory for a symlink to an attacker-chosen location right before exiting.
• Policy files are strict-decoded. An unknown or misspelled key (e.g.
  allow-endpoints) now fails fast instead of silently disabling the intended
  rule.
• The DNS proxy refuses multi-question packets, closing a path where a denied
  name could ride along in a second question past the allowlist check.
• The Action installer verifies the release cosign signature. When cosign
  is present, SHA256SUMS.bundle is verified (fail closed) before trusting the
  checksum; a new require-signature input makes its absence a hard failure.
• CI/CD hardening: concurrency + per-job timeout-minutes across CI/Security
  workflows, zizmor tool-failure no longer hidden behind || true, and action.yml
  uses $GITHUB_ACTION_PATH instead of interpolating github.action_path into run:.

Documentation

• SECURITY.md gains a "Trust boundaries and known limitations" section: the
  policy file is read from the checked-out ref (attacker-editable on
  pull_request unless loaded from the base branch), and file/process policy is
  best-effort detection, not an enforcement boundary.
• Usage examples pin the Action to a commit SHA (floating tags noted as the
  convenience alternative).

v0.1.3

[0.1.3] - Action rename + Code Scanning cleanup

Changed

• Renamed the Marketplace Action to "Egret Security Action" (was "Egret
  Security"), so the Action is distinguished from the Egret Security App by tool
  type. Reference it unchanged as NX1X/Egret@v0 or a pinned @v0.1.3.
• Dogfood: our own CI test suites now run under the Egret Action in audit
  mode, so CI monitors the egress/exec/file behaviour of the toolchain and
  dependency code during the tests (audit never blocks the build).

Security

• Closed all CodeQL go/incorrect-integer-conversion findings in the
  block-mode credential path: build uid/gid are parsed as bounded 32-bit values
  and carried as uint32 end to end, with no unchecked int narrowing.
• Scoped the self-test App installation token to least privilege
  (checks / issues / pull-requests write, contents read) instead of the App's
  blanket installation permissions (zizmor github-app).
• Removed step-output template injection in the self-test enforcement
  assertion by passing step outputs through env (zizmor template-injection).

v0.1.2

[0.1.2] - Brand refresh

Changed

• New visual identity. The mark is now an egret in flight; the icon, app-icon,
  logo (a self-contained dark-card lockup), and social preview were all redrawn.
• Marketplace branding icon is now feather (the Actions Marketplace supports
  only a named Feather icon + color, so the egret artwork cannot be the listing tile).
• README now leads with the logo lockup.

v0.1.1

[0.1.1] - Marketplace listing + App-token publishing

Added

• GitHub Marketplace listing. The Action now lives at the repository root and is
  published as "Egret Security" on the Actions Marketplace. Reference it as
  NX1X/Egret@v0 (floating major) or a pinned @v0.1.1.
• App-token publish features. New action inputs github-token, check-run,
  pr-comment, and dashboard-issue: pass a GitHub App installation token to publish
  a branded pass/fail check, a sticky PR comment, and the Egret Security Dashboard
  issue as egret-security-app[bot] (each opt-in; falls back to GITHUB_TOKEN).

Fixed

• Action install checksum verification now hash-compares the downloaded binary
  directly, so install no longer fails closed on a valid release (the binary is
  saved under a different on-disk name than the SHA256SUMS entry).
• SARIF results always carry a location (fall back to a suggested policy path),
  which GitHub Code Scanning requires - SARIF uploads are no longer rejected.

Changed

• Go toolchain 1.26.5 (clears the crypto/tls, net/textproto, and x509 stdlib
  advisories); codeql-action v4, checkout v7, setup-go v6, refreshed base-image digests.
• Release notes are now sourced from this CHANGELOG.

v0.1.0

[0.1.0] — first release

Egret is a runtime security agent for CI/CD and Linux hosts:
eBPF-based egress filtering, network/process/file monitoring, and audit-mode policy
generation — shipped as a CLI and a GitHub Action, with no server and no phone-home.

Added

• Runtime monitoring (audit mode). eBPF probes record every outbound connection
  (IPv4/IPv6), the process tree, and writes to protected paths; evaluate them against
  a policy.yaml; and emit a Markdown/JSON report plus SARIF.
• Egress enforcement (block mode). A DNS proxy plus cgroup-scoped nftables
  default-deny confine a build to its allowlist, with the build run de-privileged so
  it can't escape the confinement. Validated on bare/VM hosts; on container CI runners,
  audit mode is recommended for now.
• Policy (policy.yaml): domain allowlist (allowed-endpoints, with *.
  wildcards), raw IP/CIDR allowlist (allowed-ips), block-raw-ip, protected paths,
  disallowed processes, and extends: for a shared base policy (local or org://).
• GitHub Action. Wrap a job command, upload SARIF to Code Scanning, and write the
  job summary. Inputs include command, policy, mode, disable-sudo, and an
  optional ingest-url to POST the run to a self-hosted dashboard.
• GitHub App integration (server-less): PR checks, sticky comments, a
  Renovate-style allowlist dashboard issue, and an audit → allowlist-PR loop — all
  work with a plain GITHUB_TOKEN or an App token.

Security

• Signed, verifiable releases: each release ships SHA256SUMS, SLSA build
  provenance, and a keyless cosign signature; the Action verifies the binary before
  running it.
• Hardened by default: no phone-home; egress/event records are metadata only
  (never payloads); block mode is fail-closed on teardown.