Skip to content

v0.5.0

Latest
Latest

Choose a tag to compare

View all tags
@github-actions github-actions released this 22 Jul 20:34
· 15 commits to main since this release
v0.5.0
b8ce1e2
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Changed

  • Versioning is now tag-driven via setuptools-scm. The package version is derived from the latest signed annotated vX.Y.Z git tag. pyproject.toml no longer has a hardcoded version = ...; it uses dynamic = ["version"]. iac_scanner.__version__ reads from _version.py (written at build time by setuptools-scm) and falls back to importlib.metadata for installed wheels.
  • Release flow is now make release-{patch,minor,major}. The new scripts/release.py promotes CHANGELOG.md [Unreleased] → [X.Y.Z], commits the change with DCO sign-off, and creates a GPG-signed annotated tag. Pushing the tag (git push --follow-tags) is the only step that triggers PyPI publish. The legacy scripts/bump_version.py, scripts/check_version.py, and the check-version pre-commit hook are removed.
  • CI workflows fetch full git history (fetch-depth: 0) where they build distributions, so setuptools-scm sees the tags it needs.

Added

  • .github/workflows/release.yml — auto-creates a GitHub Release from the matching CHANGELOG section when a vX.Y.Z tag is pushed. Rejects lightweight tags. The release: published event then triggers the existing publish-pypi.yml.
  • .github/workflows/scorecard.yml — OpenSSF Scorecard runs weekly + on push to main. Results posted to the Security tab and to scorecard.dev (badge in README).
  • .github/workflows/codeql.yml — CodeQL static analysis (Python, security-and-quality query suite) on PR + weekly cron.
  • GOVERNANCE.md — roles, decision-making, branch-protection policy, release authority.
  • MAINTAINERS.md — canonical maintainer list (mirrors .github/CODEOWNERS).
  • SUPPORT.md — routes users to bug/feature/security/discussion channels.
  • scripts/apply_branch_protection.sh — gh-based, idempotent applier for the main-branch protection rules described in GOVERNANCE.md. Run from any maintainer's machine.
  • README badges: Python versions, CodeQL, OpenSSF Scorecard, DCO.
  • Rule-engine plugin discovery. Third-party rule engines can now register themselves via the iac_scanner.rule_engines entry-point group. Install e.g. iac-scanner-cdk-nag and the cdk-nag engine is auto-discovered — no core changes required. Core engine dispatcher in src/iac_scanner/rules/engine.py. New available_engines() helper lists every usable engine (built-in + plugins).
  • Companion package: iac-scanner-cdk-nag (packages/iac-scanner-cdk-nag/). Independent PyPI package that shells out to cdk synth, parses AwsSolutions / HIPAA / NIST-800-53 / PCI-DSS nag annotations, and returns them as iac-scanner Findings. Released via a dedicated publish-nag-pypi.yml workflow on nag-v* tags.
  • PEP 561 py.typed marker on iac_scanner — downstream packages (like the nag extension) and mypy in other repos now recognize this package as fully typed.

Dependencies

This release rolls up a batch of Dependabot upgrades. None change runtime behavior, but consumers pinning by upper bound should be aware:

  • click>=8.3.3 (was >=8.1.0)
  • pydantic>=2.13.4 (was >=2.0.0)
  • mcp>=1.27.1 ([mcp] extra; was >=1.0.0)
  • Dev: pytest>=9.0.3, respx>=0.23.1, bandit>=1.9.4, pip-audit>=2.10.0, build>=1.5.0
  • Build: setuptools>=82.0.1 + setuptools-scm>=8 (new)
  • GitHub Actions majors: actions/checkout@v6, actions/setup-python@v6, actions/upload-artifact@v7, actions/download-artifact@v8, sigstore/gh-action-sigstore-python@v3.3.0
Assets 5
Loading