v0.28.3

What's Changed

• fix(sbom): describe the checkout, not the URL, for the primary component version by @bomly-guy in #514
• fix(assurance): fail the merged-document link check when the merge has no identity of its own by @bomly-guy in #517
• fix(matchers): OSV stays opt-in and the docs say so; Grype keeps its database fresh (ADR-0048) by @bomly-guy in #515
• fix(githubactions): publish the repository and ref as each action's origin by @bomly-guy in #518
• fix(scan): build the SBOM document once, encode it once per format by @bomly-guy in #519
• test: update smoke golden files by @github-actions[bot] in #520
• chore(deps): bump bomly-sdk to v0.14.8 by @bomly-guy in #521
• build(deps): bump the github-actions-patch group across 1 directory with 5 updates by @dependabot[bot] in #513
• build(deps): bump the github-actions-minor group across 1 directory with 3 updates by @dependabot[bot] in #512
• test: update smoke golden files by @github-actions[bot] in #522
• build(deps): bump the gomod-minor group across 1 directory with 3 updates by @dependabot[bot] in #511

Full Changelog: v0.28.2...v0.28.3

---

Release artifacts

• Full builtin bomly archives for Linux, macOS, and Windows.
• Alternate bomly-lite archives for users who prefer external Syft and Grype binaries.
• Linux packages for Debian, RPM, Alpine, and Arch-compatible package managers.
• Homebrew, Scoop, and WinGet package-manager manifests or publishing pull requests.
• SHA256SUMS for release artifact verification, signed keylessly with cosign (SHA256SUMS.sigstore.json).
• SLSA Build Level 3 provenance (multiple.intoto.jsonl) generated by slsa-github-generator.

Each archive includes LICENSE, NOTICE, and a licenses/ directory with third-party license texts. See Verify release checksums for signature and provenance verification commands.