v1.8.1

1.8.1 (2026-06-03)

Bug Fixes

• manifests: enforce securityScanPolicy on payments + analytics SCAs (eae614f)

v1.8.0

1.8.0 (2026-06-03)

Features

• supply-chain: add OSS Snyk-style security-scan attestation flow (89f44be)

v1.7.4

1.7.4 (2026-05-25)

Bug Fixes

• slsa: use dedicated trustedIssuers list for SLSA attestation verify (9b8f00f)

v1.7.3

1.7.3 (2026-05-25)

Bug Fixes

• ci: validate SBOM + retry cosign verify-attestation with backoff (0116bfc)

v1.7.2

1.7.2 (2026-05-20)

Bug Fixes

• ci: self-heal manifest when image is empty (post ae71674 regression) (0e6997a)

v1.7.1

1.7.1 (2026-05-20)

Bug Fixes

• bump job (1d7e2f0)

v1.7.0

1.7.0 (2026-05-20)

Features

• ci: bump manifests-repo on every signed build (1c0d258)

v1.6.1

1.6.1 (2026-05-20)

Bug Fixes

• vex: use full OpenVEX URI (https://openvex.dev/ns/v0.2.0) for cosign attest/verify (70ac902)

v1.6.0

1.6.0 (2026-05-20)

Features

• supply-chain: RFC 6962 Merkle + Audit-mode + webhook + CEL + VEX + KubeArmor + GUAC (defea24)

v1.5.2

1.5.2 (2026-04-16)

Bug Fixes

• ci: point demo app attestations to published manifests repo (3be14eb)