v1.0.0-rc.0

Changelog

New Features

• b740bcf: feat: add Evidence and Recommendation fields to provider proto API (@jpower432)
• d58c84e: feat: redesign markdown report with summary, controls table, and findings (@jpower432)
• 1574b1a: feat: show passing controls in scan summary table (#438) (@em-redhat)

Bug Fixes

• 4c66d00: fix(bug): updates support for oci refs (#595) (@hbraswelrh)
• 63ddc79: fix(proto): resolve protolint line-length violations (@yvonnedevlinrh)
• 34a307a: fix(proto): wrap remaining long comments in spec contract proto (@yvonnedevlinrh)
• ac0f3c3: fix: adds --version flag as alias (#616) (@hbraswelrh)
• 2dc86f5: fix: migrate @Version policy URLs to :tag syntax (@yvonnedevlinrh)
• 389bb29: fix: prefer plan IDs for provider matching (@sanmaxdev)
• a8dea1a: fix: separate assessment plan and requirement IDs (@sanmaxdev)
• ba4c1b8: fix: set GOTOOLCHAIN=auto in cross-repo integration workflow (@marcusburghardt)
• 6056877: fix: simplify confidence display to only filter Undetermined (@jpower432)
• 97bbdff: fix: track complypack digests in generation state (#583) (#592) (@jpower432)
• c24c747: fix: update Go dependencies to resolve security vulnerabilities (@marcusburghardt)
• 0a92635: fix: updates error reporting and exit code (#618) (@hbraswelrh)
• 72eca21: fix: write format reports to .complytime/scan/ alongside evaluation log (#634) (@yvonnedevlinrh)
• 3841550: refactor!: remove collector export infrastructure (#606) (@trevor-vaughan)

Dependency Updates

• 8f2bb41: chore(deps): bump github.com/gemaraproj/go-gemara from 0.5.0 to 0.7.0 (@dependabot[bot])
• 5a77321: chore(deps): bump oras.land/oras-go/v2 from 2.6.0 to 2.6.1 (@dependabot[bot])

Infrastructure Updates

• 0899428: ci(deps): bump actions/checkout from 6.0.3 to 7.0.0 (@dependabot[bot])
• 7111b6f: ci(deps): bump actions/setup-go from 6.4.0 to 6.5.0 (@dependabot[bot])
• c43dd68: ci(deps): bump actions/setup-go in /.github/actions/setup-complyctl (@dependabot[bot])
• 46b5e50: ci(deps): bump complytime/org-infra/.github/workflows/reusable_ci.yml (#587) (@dependabot[bot])
• 39765df: ci(deps): bump complytime/org-infra/.github/workflows/reusable_ci.yml (#630) (@dependabot[bot])
• 65d06c3: ci(deps): bump complytime/org-infra/.github/workflows/reusable_compliance.yml (#597) (@dependabot[bot])
• 1346d9d: ci(deps): bump complytime/org-infra/.github/workflows/reusable_compliance.yml (#628) (@dependabot[bot])
• 914307d: ci(deps): bump complytime/org-infra/.github/workflows/reusable_crapload_analysis.yml (#588) (@dependabot[bot])
• 5b832d8: ci(deps): bump complytime/org-infra/.github/workflows/reusable_crapload_analysis.yml (#639) (@dependabot[bot])
• daa5815: ci(deps): bump complytime/org-infra/.github/workflows/reusable_dependabot_reviewer.yml (#591) (@dependabot[bot])
• 7707c81: ci(deps): bump complytime/org-infra/.github/workflows/reusable_dependabot_reviewer.yml (#638) (@dependabot[bot])
• 9914f62: ci(deps): bump complytime/org-infra/.github/workflows/reusable_deps_reviewer.yml (#599) (@dependabot[bot])
• 78e01ea: ci(deps): bump complytime/org-infra/.github/workflows/reusable_deps_reviewer.yml (#627) (@dependabot[bot])
• 11f1f10: ci(deps): bump complytime/org-infra/.github/workflows/reusable_scheduled.yml (#596) (@dependabot[bot])
• e8947e3: ci(deps): bump complytime/org-infra/.github/workflows/reusable_scheduled.yml (#637) (@dependabot[bot])
• e8b67f5: ci(deps): bump complytime/org-infra/.github/workflows/reusable_security.yml (#593) (@dependabot[bot])
• 690d53c: ci(deps): bump complytime/org-infra/.github/workflows/reusable_security.yml (#626) (@dependabot[bot])
• 27f4de7: ci(deps): bump complytime/org-infra/.github/workflows/reusable_sonarqube.yml (#590) (@dependabot[bot])
• 21a6796: ci(deps): bump complytime/org-infra/.github/workflows/reusable_sonarqube.yml (#636) (@dependabot[bot])
• 168b8ce: ci(deps): bump complytime/org-infra/.github/workflows/reusable_vuln_scan.yml (#589) (@dependabot[bot])
• d1f339f: ci(deps): bump complytime/org-infra/.github/workflows/reusable_vuln_scan.yml (#629) (@dependabot[bot])
• b6aa594: ci(deps): bump goreleaser/goreleaser-action from 7.2.2 to 7.2.3 (#644) (@dependabot[bot])

Other Work

• 7ea83dc: chore: add preflight validation gate to release workflow (@marcusburghardt)
• 36bc2ff: chore: align PolicyRef with OCI reference (#602) (@hbraswelrh)
• d8957d9: chore: consume complypack from quay.io (@marcusburghardt)
• ea468c6: chore: regenerate crapload baseline after rebase (@jpower432)