OBAAF 0.3.0

OBAAF 0.3.0

Upgrading from 0.2.0: a gate that passed can fail without the workflows having
changed. Several changes make the checker report what it missed before.

Checker

• A job now gets the rules of every lane it belongs to. A job that runs an agent
  and publishes was checked for one of the two; it is now checked for both. A lane
  declaration adds rules and never removes a finding, and one that does nothing is
  listed in the report's notes.
• Secrets and outsider-written fields are read from an expression's tokens, not
  matched as text. secrets.*, a computed secret name and several spellings that got
  past OBAAF-GHA-010 are now reported. A file the checker cannot read is an error.
• New rule OBAAF-GHA-024: a secret listed under protected_secrets may only be used
  by jobs in the environment named for it.
• Baselines: --write-baseline records today's findings and --baseline fails only on
  new ones, or on entries that no longer match.
• obaaf check .github/workflows no longer checks zero files and passes.

Jenkins (advisory)

• obaaf check reads Jenkinsfiles alongside workflows, with fifteen advisory rules,
  OBAAF-JEN-001 to 015. Controller settings and shared-library code are reported as
  unknown, never as a pass.

OBAAF's own supply chain

• The PyPI release now runs obaaf verify release before upload: provenance, build
  record, environment approval by someone other than whoever created the tag, and
  agent history.
  Check a download yourself:
  gh attestation verify obaaf-0.3.0-py3-none-any.whl --repo Obaaf/OBAAF

Project

• Governance is adopted and outside contributions are accepted under CONTRIBUTING.md.
• New documents: docs/landscape.md compares OBAAF with other tools, and
  docs/egress-control.md is the design of an egress control for agent jobs.

Full changelog: CHANGELOG.md