v2.3.0

Features

• Collapse buildcage's own run action output into log groups (#220)
  • Buildcage's own setup/lifecycle logging no longer clutters the step log alongside your run: command's output — it's now tucked into a collapsed group, matching how a plain run: step looks.

Refactoring

• Centralize the setup ↔ report contract and drop the dash14 label prefix (#224)
  • ⚠️ setup and report must be upgraded together — the internal contract they use to hand off report data changed, so pinning them to different versions will break.
  • Removes duplicated, drift-prone constants shared between the two actions, and drops repo-specific naming from an internal identifier.
• Adopt @actions/core for input/state/summary handling (#225)
  • Replaces hand-rolled input parsing, state handling, and summary writing with the standard GitHub Actions toolkit.
• Resolve lint warnings in shared test helpers (#226)
  • Minor internal cleanup.
• Reduce duplicated report logic and test-only parameters (#227)
  • Consolidates report pass/fail logic that had drifted into near-duplicate copies, and trims parameters kept only for testing convenience.
• Unify report rendering between run and report (#228)
  • Both actions now share one renderer for their Job Summary output instead of maintaining separate, divergence-prone copies.
• Group sandbox config options by role (#229)
  • Reorganizes the run sandbox's configuration into clearer identity/writable/runtime groupings.
• Fix misplaced utility files and a duplicate helper (#230)
  • Removes a redundant reimplementation of an existing helper and relocates a couple of small utilities to better-fitting homes.
• Split report generation into layered concerns (#231)
  • Reorganizes report-generation code by concern — shared types, rendering, per-engine data building, and pass/fail outcome — instead of one flat directory.
• Share Docker/Compose helpers between setup and run (#232)
  • Splits apart two unrelated Docker helpers that had shared a file, deduplicates an identical rule-logging helper, and lets setup reuse run's Compose argument builders.
• Split run's sandbox pipeline into focused modules (#233)
  • Breaks a large, multi-purpose sandbox-execution component into one module per pipeline stage.
• Extract named steps from run's main flow (#234)
  • Pulls proxy start/stop and command-execution logic out of one large function into clearly named steps.
• Split log parsing by source, relocate report aggregation (#235)
  • Separates a file that mixed several unrelated log-parsing responsibilities, and moves report-row-building logic into the report layer where it belongs.
• Separate pure logic from network I/O in provenance verification (#236)
  • Splits testable, pure logic out of the modules that also perform live registry/network calls.
• Relocate misplaced report files and rename a catch-all directory (#237)
  • Moves a data-shaping helper out of a directory meant for pass/fail decisions, and renames a vaguely-named shared directory to reflect what it holds.
• Shorten filenames and consolidate trivially small files (#238)
  • Drops naming that redundantly repeated its own directory, and merges several small, closely related files that gained little from being split.
• Introduce an import alias for deep relative paths (#239)
  • Multi-level ../../ imports were hard to read at a glance. Adds a native import alias that works consistently everywhere the code runs, including local/CI flows that execute source directly rather than through the bundled build.

CI / Maintenance

• Add unified linting, formatting, and commit hooks (#218)
  • The project had no formatter, linter, or pre-commit enforcement; adopts a single toolchain covering all three plus type-aware lint.
• Switch unit test runner to vitest (#223)
  • Unifies tests onto the same tooling already used for lint/format, replacing the previous runner.

Dependencies

• Bump google.golang.org/grpc to v1.83.0 in buildkit-proxy, adding a server-side mitigation for HTTP/2 control-frame flooding and fixing an xDS RBAC engine panic on unsupported fields inside NOT rules (#241)
• Bump rolldown, @types/node, fast-check, and @sigstore/verify via pnpm audit, and pull in brace-expansion's ReDoS fix ahead of the usual release-age policy (#222)
• Bump pnpm to v11.15.0 (#221)
• Bump rolldown to v1.2.0 (#216)
• Bump actions/attest to v4.2.0 (#214)
• Bump github.com/moby/buildkit module to v0.31.2 (#213)
• Bump moby/buildkit Docker tag to v0.31.2 (#212)
• Bump github/codeql-action to v4.37.1 (#211)
• Bump self-referential dash14/buildcage action pin to v2.2.5 (#210)

Full Changelog: v2.2.5...v2.3.0