Release v3.0.2 · buildcage/docker

CI / Maintenance

Name and describe the actions for the Marketplace (#270)
- Setup Builder and Report were internal working names — too generic to be unique on the Marketplace, and neither said what the action does. They're now Buildcage for Docker and Buildcage Report, with a Marketplace description and branding. Steps that don't set their own name: will show the new label in workflow logs.
Ignore reachability-verified CVEs in the monthly image scan (#268)
- Trivy's binary scan flags CVEs against the Go toolchain and stdlib baked into each vendored binary whether or not the vulnerable path is reachable. Nine were triaged against the threat model in docs/security.md (and, for the explicit engine, against buildkit v0.32.0's --proxy-network implementation), confirmed unreachable, and recorded in .trivyignore with the reasoning inline.

Make the README the usage manual (#259)
- docs/reference.md and docs/rules.md are folded into the README, so everything needed to adopt the action — inputs, operation modes, rule syntax, proxy engines, the report action — is on one page instead of split across three. Both files stay behind as stubs pointing at the matching README sections: released dist/ builds name docs/reference.md in a runner-requirement error message, so anyone hitting it on a pinned older version still lands somewhere useful.
- The experimental explicit engine moves to its own docs/explicit-engine.md, which now also spells out that the TLS interception is BuildKit's own --proxy-network feature — Buildcage neither implements nor operates that proxy and never holds the CA key.
- What Buildcage is and why it exists moved to the new landing page at buildcage.github.io, leaving the README to cover only how to use it.

Full Changelog: v3.0.1...v3.0.2