v0.13.0

This release introduces a redesigned CLI and API—a breaking change requiring updates to existing code and scripts. It also adds AI-model metadata enrichment and provenance tracking via SPDX 3's Annotation.

Finally, usage surfaces are expanded with a new GitHub Action, AI-agent Skills, and a Claude Code plugin.

Install/upgrade:

pip install -U pitloom

Report issues: https://github.com/bact/pitloom/issues

What's changed

• Add CISA-lifecycle SBOM generation by @bact in #96
• Bump actions/setup-node from 6 to 7 by @dependabot[bot] in #100
• Bump dieghernan/cff-validator from 5.0.1 to 5.1.1 by @dependabot[bot] in #99
• Bump actions/setup-python from 6 to 7 by @dependabot[bot] in #104
• Provenance annotation by @bact in #102
• Use hasConcludedLicense for detected licenses by @bact in #105
• Get DOI, arXiv, URL info from Hugging Face by @bact in #106
• Bump EndBug/add-and-commit from 0a145b91207725ab63102736ff2ddcf18f90cdb5 to 290ea2c423ad77ca9c62ae0f5b224379612c0321 by @dependabot[bot] in #98
• Map dataset creator metadata onto native SPDX 3 by @bact in #107
• Populate SpdxDocument.import_ for merged fragments by @bact in #108
• Express base-model lineage via descendantOf by @bact in #109
• Add integration test for provenance info by @bact in #112
• Fix loom SDK hyperparameter provenance + CLI doc staleness by @bact in #113
• Refactor CLI/API to input-centric design with sdist by @bact in #114
• Add Bandit workflow by @bact in #115
• Align loom generate with project-scoped Pitloom config precedence by @bact with @Copilot in #116
• Address Bandit findings in Hugging Face and environment extractors by @bact with @Copilot in #117
• Bump minimum mypy to 2.3.0 by @bact with @Copilot in #118
• Add OpenSSF Scorecard workflow and README badge by @bact with @Copilot in #119
• Add shared navigation bar across docs site pages by @bact with @Copilot in #120
• Fix license-conflict detection gaps in Hatchling, poetry, and setuptools paths by @bact in #121
• Rename AI skills to sbom-generate/sbom-enrich, add sbom-validate skill by @bact in #123
• SBOM enrichment by @bact in #124
• Let sbom-enrich asks info from SBOM author by @bact in #125
• Document PyPI wheel SBOM verification checklist by @bact in #126

New contributors

• @dependabot[bot] made their first contribution in #100

Full Changelog: v0.12.0...v0.13.0