v0.1.2

Patch release over v0.1.1 — catalog-updater engine fixes.

Changes

• Re-pin targets the entry by its own top-level name (#24): brace-matched,
  JSON-confirmed _entry_span so a nested author.name equal to a plugin name
  can no longer mis-segment the re-pin.
• Attestation evidence is captured (#25): verify with gh attestation verify --format json (the human summary is suppressed headless) and distil
  predicate/signer/issuer into the PR body; hardened against malformed JSON.
  Re-verify commands in the PR body now include --format json.

This release is itself attested (see the attested-delivery-0.1.2.tar.gz asset).

v0.1.1

Patch release over v0.1.0.

Changes

• Attested releases — new attest-release.yml: every release (incl. a source
  archive) ships a SLSA build-provenance + CycloneDX SBOM attestation bound to an
  uploaded tarball, independently re-verifiable with gh attestation verify.
• catalog-updater engine — resolve the source repo from a git url (claude's
  canonical git-subdir/url schema), not only a repo field, with URL
  normalization (https / git@ / ssh, trailing slash, .git).

This release is itself attested (see the attested-delivery-0.1.1.tar.gz asset).

v0.1.0

The central catalog of reusable attested workflows and org configuration for the
attested-delivery organization. Callers pin these by full commit SHA; this tag is
the v0.1.0 human-readable label.

Reusable workflows

Quality gates (→ SARIF → signed verdicts)
reusable-sast-codeql, reusable-sca-osv, reusable-trivy, reusable-checkov,
reusable-scorecard, reusable-shellcheck, reusable-semgrep, reusable-secrets,
reusable-manifest-review, reusable-zap, reusable-k6, reusable-vex.

Signing & verification seam
reusable-attest-scan (the attestation seam), reusable-verify-gates (fail-closed),
sign-and-attest (container SLSA Build L3), verify-attestation, reusable-cosign-sign.

CI & pinning
pin-check (enforces full 40-char SHA pins), reusable-actionlint, catalog-check.

Plugin catalog-updater

plugin-catalog-update-hub + the plugin-catalog-update composite action — a
verify-first, fail-closed analog to Dependabot for plugin marketplaces: fetch by
release, verify the release's attestations before re-pinning, zero-touch auto-merge
through the target's catalog-admission gate.

Policy & docs

SHA-pinned Actions allow-list policy, community-health defaults, and the ecosystem
documentation hub (docs/README.md → the Diátaxis docs site at
https://attested-delivery.github.io/docs/).

Verification standard: every gate verdict travels as a signed, digest-bound
in-toto attestation; re-verify independently with gh attestation verify pinning
--signer-workflow.