v0.4.0

What's changed

• Refactor to fix number of args by @bact in #38
• Add sigstore and provenance attestation by @bact in #39
• Bump github/codeql-action/upload-sarif from 4.37.7 to 4.38.0 by @dependabot[bot] in #45
• Bump actions/attest-build-provenance from 3.0.0 to 4.2.2 by @dependabot[bot] in #40
• Bump sigstore/gh-action-sigstore-python from 3.0.1 to 3.5.0 by @dependabot[bot] in #41
• Bump bact/pitloom from 0.16.2 to 0.17.0 by @dependabot[bot] in #44
• Update dependencies by @bact in #46
• Refactor _normalize_single_id to cut McCabe/cognitive complexity by @bact in #47
• Refactor _detect_gpl_headers to cut cognitive complexity by @bact in #48
• Refactor matcher.py::match() by @bact in #49
• Refactor _detect_structured_format by @bact in #50
• Harden SPDX data fetching and caching; refactor fetch_popularity_data by @bact in #51
• Enforce type, lint and complexity checks in CI by @bact in #52
• Send diagnostics to stderr in one parseable format by @bact in #53
• Remove the Java (Tier 3) layer; add CLI matrix tool and coverage by @bact in #54
• Refuse an unready database with exit 2 and a clear message by @bact in #55
• Put upper bound for py-spdx-license by @bact in #56
• Reject unknown options in match() by @bact in #57
• Make the -only/-or-later tie-breaker consistent; split matcher.py by @bact in #58
• Read API file_path like the CLI, with one shared decoder by @bact in #59
• Stop reporting unknown SPDX tags as certain matches by @bact in #60
• Read a whole SPDX expression from a tag and from --id by @bact in #61
• Keep matching fast on files with long tokens or base64 by @bact in #62
• Bump bact/pitloom from 0.18.1 to 0.19.0 by @dependabot[bot] in #64
• Bump github/codeql-action/upload-sarif from 4.38.0 to 4.38.1 by @dependabot[bot] in #63
• Read license fields from any package manifest by @bact in #65
• Read SPDX tags in short inputs; redirect classpath ID by @bact in #66
• Read a lone SPDX expression as an ID from any input by @bact in #67
• Give every match the same keys, a 0-1 score and an exact flag by @bact in #68
• Match many tags and very long words faster by @bact in #69
• Never let a failed write or Ctrl-C pass for an answer by @bact in #70
• Use one description and keyword list in all metadata by @bact in #71
• Look up licence IDs without scanning a table by @bact in #72
• Word usage errors as every other diagnostic by @bact in #73
• Ship the SBOM the wheel is built with by @bact in #74
• Bump version to 0.4.0 by @bact in #75

Full Changelog: v0.3.7...v0.4.0