Release v1.14.0

Async Test Library v1.14.0

See CHANGELOG.md for what's new.

Maven

<dependency>
  <groupId>se.deversity.async-test-lib</groupId>
  <artifactId>async-test-lib</artifactId>
  <version>1.14.0</version>
  <scope>test</scope>
</dependency>

Gradle

testImplementation("se.deversity.async-test-lib:async-test-lib:1.14.0")

Maven plugin

Starts the test JVM with the agent through the argLine property, as jacoco:prepare-agent does:

<plugin>
  <groupId>se.deversity.async-test-lib</groupId>
  <artifactId>async-test-maven-plugin</artifactId>
  <version>1.14.0</version>
  <executions><execution><goals><goal>prepare-agent</goal></goals></execution></executions>
  <configuration><includes>com.example</includes></configuration>
</plugin>

Gradle plugin

se.deversity.async-test 1.14.0 was not published to the Gradle Plugin Portal by this run (no portal key configured); apply the plugin from source or attach the agent by hand as the README shows.

Verify a cosign signature

All attached jars (async-test-lib, async-test-agent, async-test-analysis,
async-test-maven-plugin) and both CycloneDX SBOM files (bom.xml, bom.json) carry
matching .sigstore.json bundles. Verify any file by substituting its name:

cosign verify-blob --bundle async-test-lib-1.14.0.jar.sigstore.json \
  --certificate-identity-regexp 'https://github.com/PIsberg/async-test-lib' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  async-test-lib-1.14.0.jar

Verify the build provenance

Every attached artifact has SLSA build provenance, recorded in this repository's
attestations and attached as async-test-lib-1.14.0.intoto.jsonl:

gh attestation verify async-test-lib-1.14.0.jar --repo PIsberg/async-test-lib

Verify the GPG signature

gpg --verify async-test-lib-1.14.0.jar.asc async-test-lib-1.14.0.jar