v0.4.0

Changelog

Features

• c3af0e4 feat(cli): dynamically inject Version, Commit SHA, and BuildTime into CLI binary using compiler ldflags
• bc541c1 feat(examples): add security configuration blocks to all examples specs, and base frontend on alpine:3.20
• db0b3e0 feat(linter): implement build-time OPA config hardening linter with ignore-rules
• 820596f feat(reproducible): integrate SOURCE_DATE_EPOCH constraints on build-args and metadata creation timestamps
• ccb4634 feat(sbom): add support for declarative spdx and cyclonedx sbom formats via yaml
• 66041af feat(sbom): apply 'bhi-' brand prefix naming pattern for in-image SBOM directories
• 5c2f96e feat(sbom): implement automated CycloneDX SBOM generation via Syft
• b4df49e feat(security): integrate build-time vulnerability scanning via Grype CLI wrapper
• 0cc072b feat(signature): implement doko sign command for OCI signing and Cosign SBOM attestations
• bcea327 feat(signature): implement doko verify and doko keygen subcommands

Bug Fixes

• da13a2e fix(cli): add help and default fallback logic to prevent gRPC EOF preface crashes on standalone execution
• 5b2ee8f fix(deps): update github.com/tonistiigi/fsutil digest to 519e39a
• 4358a07 fix(deps): update github.com/tonistiigi/fsutil digest to 519e39a
• 3a5083e fix(deps): update github.com/tonistiigi/fsutil digest to 83cac42
• 7065f21 fix(deps): update github.com/tonistiigi/fsutil digest to 83cac42
• 17574c1 fix(deps): update module github.com/glebarez/go-sqlite to v1.23.0
• 4a3769d fix(deps): update module github.com/glebarez/go-sqlite to v1.23.0
• 1816d03 fix(deps): update module github.com/open-policy-agent/opa to v1.19.1
• 4b223db fix(deps): update module github.com/open-policy-agent/opa to v1.19.1
• dd83a6b fix(nginx): recursively update permission folders and disable user directive in config for nonroot container compatibility
• c1aa507 fix(signature): map spdx layout suffix specifically to spdxjson for cosign parsing compatibility
• a7259c4 fix(signature): resolve golangci-lint violations and gofmt
• 394b251 fix(test): resolve errorlint, noctx, and unparam lint warnings in main_test

Documentation

• b52323d docs: refactor SECURITY.md to open-source standards
• 28d4391 docs: update contributing prerequisites for go 1.26 and release tools

Other Changes

• 546ccf3 cleanup: remove all scanner implementation files and config block fields
• 8e8ef5c perf(dockerfile): revert final base stage to scratch to minimize frontend image footprint
• a35839e refactor: centralize fetchCACert logic into a shared HTTP utility package
• 4b5e673 refactor: remove custom SBOM generation and prune syft dependencies
• e90069f refactor: remove in-image SBOM generation and legacy signature subcommands
• 4a4ffa8 refactor: remove sbom configuration block from nginx spec and go schema config
• a00b431 refactor: standardize native SBOMs and clean up legacy code
• 2e42f55 security: pin base container image by digest to resolve scorecard warning
• 5a56bfb security: pin development environment base image and gofumpt version
• d41a7c3 security: pin gofumpt version to resolve scorecard warning
• a98f534 test: add mock subprocess tests to verify CLI and signature package coverage
• cfc9b5b test: improve internal/builder package test coverage to 84.8%
• c36c02e test: resolve codecov missing coverage on cmd, builder, sbom, and signature packages

v0.3.0

Changelog

Features

• 98e1be3 feat: add init and validate CLI subcommands with latest tag syntax template
• b397367 feat: fix apk multi-repository scoping, concurrent fetching, checksum validation, and package signing support

Bug Fixes

• adef6c7 fix(deps): update module github.com/moby/buildkit to v0.32.2
• d4181ff fix(deps): update module github.com/moby/buildkit to v0.32.2

Documentation

• 372ac4f docs/ci: remove snyk badge and add OpenSSF Scorecard workflow
• 4c91a95 docs: add OpenSSF Best Practices baseline badge to README
• 4872f1b docs: add SLSA 3 badge to README
• 3f52a68 docs: add Snyk badge and float it to the right
• ff0401d docs: add snyk vulnerability badge to README
• c86fab5 docs: format OpenSSF Scorecard badge as HTML for consistency
• 35f5cee docs: update snyk badge image asset

Build & CI

• 053eeed ci: consolidate build and verify workflows, enable setup-go caching
• 9d4f8f2 ci: optimize workflows and add Snyk badge to README
• a012bb5 ci: remove duplicate Snyk workflow file
• d9acef7 ci: remove redundant test-examples matrix workflow
• 2fdf00e ci: update workflow names for Snyk and Release
• 841fab6 ci: use atomic covermode and add codecov token

Other Changes

• fc8da1a Merge origin/main into develop
• 0b5d6f7 [StepSecurity] Apply security best practices
• f38ea05 test: improve codecov coverage from 44% to 68%

v0.2.0

Changelog

Features

• 70ab27f feat: harden Dockerfiles, expand CI matrix, add examples READMEs, enable SBOM/SLSA

Bug Fixes

• c680f99 fix(lint): resolve goimports and mapsloop issues in tests
• 99523fa fix: remove unsupported top-level provenance section from goreleaser config

Documentation

• 49610b0 docs(readme): capitalize badge labels for License and Release
• a5ac67b docs(readme): modernize README layout, add Mermaid diagram and callout blocks
• de596cb docs(readme): remove deprecated logo and simplify heading layout
• ff19726 docs(readme): restore Docker DHI column in the comparison matrix
• f1d2721 docs(readme): update Docker DHI comparison metrics based on open-source catalog findings
• 729a155 docs(readme): update Docker DHI declarative spec feature description

Build & CI

• 598a2c8 ci: install syft before running goreleaser in release workflow

Other Changes

• 1eabe30 test: add unit tests and document lockfile and GitHub Action

v0.1.0

Changelog

Features

• 9b7a559 feat(llb): coalesce build stages to reduce image layer count
• 4b7ee2a feat(llb): copy package install results via FileAction for cleaner layer naming
• 4639889 feat(llb): implement per-step caching and compliant apk package assembly
• dbb8802 feat: implement JSON Schema configuration validation and dynamic schema generation
• 0c9341a feat: make network request timeouts configurable via doko.yaml
• 9872f51 feat: support native BuildKit secrets and network mode constraints in pipelines
• efea0ee feat: use uniform build & install N packages via provider layer naming in history

Bug Fixes

• 3f56445 fix(lint): resolve all 47 golangci-lint issues
• 172154f fix: copy back accounts database and home directories natively to preserve add users and groups in docker history
• 28eec42 fix: dynamically configure package repositories based on OS base version and exclude community repo by default for APK
• 6c2be55 fix: export base layout using named Copy file operation to preserve add root layout in docker history
• 52f2cb3 fix: resolve tautological condition in accounts configuration check
• 8ea39d1 fix: resolve tautological condition in metadata files writing check
• 253c4d4 fix: resolve tautological condition in path setup and pipeline runs

Documentation

• 739bf34 docs: document new pipeline ssh option in schema.md
• 6cb07cf docs: document new timeout-seconds option in schema.md
• d7e733b docs: remove references to other package managers (apt, dnf)

Build & CI

• 8ba4a1e ci: switch to official go-task/setup-task action

Other Changes

• 69ee917 Implement native secrets/CA mounts, build-time arguments, and SSH agent socket forwarding
• 50e2ace Refactor to native BuildKit layering, clean docker history, and fix multi-platform Solve metadata
• 7c07a86 refactor(hack): rename scripts and consolidate commands into Taskfile
• 84a1963 refactor: centralize OS-to-provider detection logic into config.DetectProvider
• 4ead082 refactor: extract builder and utils, implement native buildkit caching
• b7eb850 refactor: focus Doko exclusively on Alpine Linux (APK) package provider
• fae735c refactor: remove security, policy, provenance, sbom, and vulnerability packages
• 9740edc refactor: remove unused sign package, modularize LLB package managers via registry, and resolve linter issues

v0.0.1

Changelog

Features

• e2deec5 feat: initialize doko codebase

Other Changes

• 08f1302 Initial commit