Changelog
- b101406: small fixes (@alexverify)
- 457812d: lint fixes (@alexverify)
- 08d5aa9: dashboard: split server into handlers, security, and view files (@alexverify)
- 026db99: ci: gate golangci-lint on pull requests with only-new-issues (@alexverify)
- 910f19e: fix: close proxy-test response bodies and run cleanup before exit (@alexverify)
- 4521642: cli: route command errors through a shared fail helper (@alexverify)
- e4cb16d: dashboard: split dto.go into wire types and the buildscan assembler (@alexverify)
- c1cb17e: add SECURITY.md vulnerability disclosure policy (@alexverify)
- 2986bc4: make: pin local lint to the CI golangci-lint version (@alexverify)
- 62855a4: ci: add dependabot for gomod, actions, and the web tree (@alexverify)
- 1cc004e: test: cover finding severity ranking and Max (@alexverify)
- 5babd24: test: cover artifact MakeID stability and MaxSeverity (@alexverify)
- 5e69028: test: cover hash determinism, sorting, and .git exclusion (@alexverify)
- 9ef0238: test: cover lockstore round-trip, missing file, and Exists (@alexverify)
- b03f075: test: cover JSON and text reporters for scan, verify, list (@alexverify)
- 0ca2c30: fix: surface Close errors on append-only write paths (@alexverify)
- bcd07b8: test: cover analyzer chain concatenation and error handling (@alexverify)
- f4e0a81: test: cover resolve router, local/inline resolvers, and git helpers (@alexverify)
- 6f00f2b: test: cover policystore load and save error paths (@alexverify)
- 9aac22e: test: cover semgrep severity mapping, OWASP, and relToRoot (@alexverify)
- 5664f0b: test: cover repstore read, parse, and null-corpus paths (@alexverify)
- 09cf941: test: cover sbom component type, version, and purl helpers (@alexverify)
- 1fd7509: test: cover notify default-client fallback and transport error (@alexverify)
- cbff603: test: cover cpstore corrupt-file handling and safeName sanitizing (@alexverify)
- 469987c: test: cover verify signature and signed-approval policy gates (@alexverify)
- ade7263: test: cover scan defaults, enrich error paths, and run failures (@alexverify)
- 93e5c18: test: cover client Gate and server-error fallback across endpoints (@alexverify)
- 2fc0793: test: cover provenance anchoring across all source kinds (@alexverify)
- 6fc8072: test: cover cli list, diff, freeze, and fleet export/show commands (@alexverify)
- b747349: test: cover cli key dispatch, sbom file output, and verify --server fallback (@alexverify)
- 82bd3ac: test: cover serve token errors, lifecycle, alerts guard, and server policy (@alexverify)
- 901ee4f: test: cover dashboard startup, keyring wiring, and graceful shutdown (@alexverify)
- 3eb0f98: test: pin trust scoring helpers across every weight ladder (@alexverify)
- c5ae6d0: test: cover posture approved-set rules and drift phrasing (@alexverify)
- c131b88: test: cover client transport and decode error paths (@alexverify)
- b82dea7: test: cover cli env/hostname/topN helpers and default fleet owner (@alexverify)
- 370ecae: test: cover audit push empty-log and bad-since guards (@alexverify)
- 1628a2d: test: exercise dashboard read endpoints end to end (@alexverify)
- 1528948: test: cover lockfile approval-signing and finding-safe helpers (@alexverify)
- 5359118: test: cover strict JSON parser (@alexverify)
- fbb5915: test: cover control-plane reputation endpoint (@alexverify)
- 25a0f73: feat(reputation): build and merge trust corpora from local approvals (@alexverify)
- c0e047f: feat(cli): add reputation export to build a corpus from approvals (@alexverify)
- a5bf050: feat(cli): add completion command for bash, zsh, and fish (@alexverify)
- c2ad8f9: feat(doctor): model an environment health-check report (@alexverify)
- f302c72: feat(cli): add doctor command reporting tools and lockfile state (@alexverify)
- 8002f88: feat(doctor): report OS sandbox availability (@alexverify)
- 54c0329: feat(doctor): report usage-telemetry hook installation status (@alexverify)
- 1150ebe: feat(doctor): check control-plane reachability when configured (@alexverify)
- 7391191: feat(doctor): add a JSON wire shape for the report (@alexverify)
- 3ac9f58: feat(cli): add doctor --json for machine-readable output (@alexverify)
- 777cd53: feat(sbom): render the lockfile as an SPDX 2.3 document (@alexverify)
- 3d7b7ae: feat(cli): add sbom --format to choose CycloneDX or SPDX (@alexverify)
- c8d407d: feat(discover): add a Claude Desktop MCP-server discoverer (@alexverify)
- 0f7ee6f: feat(discover): register Claude Desktop in the default tool set (@alexverify)
- 87f3187: feat(doctor): warn on quarantined artifacts and note frozen pins (@alexverify)
- 9b708df: feat(doctor): add --strict to exit non-zero on warnings for CI (@alexverify)
- 78c33cb: fix(cli): offer doctor in shell completion and refresh sbom description (@alexverify)
- e36ec75: test: cross-check shell completion against the help command list (@alexverify)
- 37769d5: feat(doctor): report local signing-key availability (@alexverify)
- b4bb77e: feat(artifact): add Types and IsType for type validation (@alexverify)
- 0c50cb7: feat(cli): filter list output by --tool and --type (@alexverify)
- efd5abc: refactor(digest): extract a structured digest report from the renderer (@alexverify)
- 225e265: feat(cli): add digest --json for machine-readable review summaries (@alexverify)
- 7e8b3a2: ci(release): attest build provenance for release artifacts (@alexverify)
Contributors
alexverify