v0.1.0

The central catalog of reusable attested workflows and org configuration for the
attested-delivery organization. Callers pin these by full commit SHA; this tag is
the v0.1.0 human-readable label.

Reusable workflows

Quality gates (→ SARIF → signed verdicts)
reusable-sast-codeql, reusable-sca-osv, reusable-trivy, reusable-checkov,
reusable-scorecard, reusable-shellcheck, reusable-semgrep, reusable-secrets,
reusable-manifest-review, reusable-zap, reusable-k6, reusable-vex.

Signing & verification seam
reusable-attest-scan (the attestation seam), reusable-verify-gates (fail-closed),
sign-and-attest (container SLSA Build L3), verify-attestation, reusable-cosign-sign.

CI & pinning
pin-check (enforces full 40-char SHA pins), reusable-actionlint, catalog-check.

Plugin catalog-updater

plugin-catalog-update-hub + the plugin-catalog-update composite action — a
verify-first, fail-closed analog to Dependabot for plugin marketplaces: fetch by
release, verify the release's attestations before re-pinning, zero-touch auto-merge
through the target's catalog-admission gate.

Policy & docs

SHA-pinned Actions allow-list policy, community-health defaults, and the ecosystem
documentation hub (docs/README.md → the Diátaxis docs site at
https://attested-delivery.github.io/docs/).

Verification standard: every gate verdict travels as a signed, digest-bound
in-toto attestation; re-verify independently with gh attestation verify pinning
--signer-workflow.