v0.40.0

0.40.0 (2026-07-21)

Features

• build: include Trivy commit hash in scanner metadata (#35) (5e93741)
• Scan pre-existing SBOM accessory instead of image layers (#38) (7d97d36)

Bug Fixes

• docker: derive HEALTHCHECK port and scheme from server config (#34) (55d74dc)

---

Container Image

Multi-arch image (linux/amd64, linux/arm64) signed with cosign.

Image	Reference
harbor-scanner-trivy	8gears.container-registry.com/8gcr/harbor-scanner-trivy:v0.40.0

Verify the image signature:

cosign verify \
  --certificate-identity "https://github.com/container-registry/harbor-scanner-trivy/.github/workflows/publish-image.yml@refs/heads/main" \
  --certificate-oidc-issuer "https://token.actions.githubusercontent.com" \
  8gears.container-registry.com/8gcr/harbor-scanner-trivy:v0.40.0

Verify the SBOM attestation:

cosign verify-attestation \
  --certificate-identity "https://github.com/container-registry/harbor-scanner-trivy/.github/workflows/publish-image.yml@refs/heads/main" \
  --certificate-oidc-issuer "https://token.actions.githubusercontent.com" \
  --type spdxjson \
  8gears.container-registry.com/8gcr/harbor-scanner-trivy@sha256:1d4c14935a17fbffd854dd72aa746d1d61a0dae6f4959760de8b18961c1a1c8c

Helm Chart

helm install harbor-scanner-trivy \
  oci://8gears.container-registry.com/8gcr/charts/harbor-scanner-trivy \
  --version 0.40.0

Binaries

Static linux/amd64 and linux/arm64 binaries are attached to this release
(checksums.txt has the SHA256 sums):

Asset	Contents
scanner-trivy_linux-<arch>.tar.gz	Harbor scanner adapter v0.40.0
trivy_linux-<arch>.tar.gz	Trivy CLI v0.72.0, built from source

v0.39.1

0.39.1 (2026-07-12)

Bug Fixes

• Add lprobe and align image user with harbor-next trivy-adapter (#33) (78eb9d3)
• ci: bump Go to 1.26.5 to resolve GO-2026-5856 (#32) (344d2e4)

Performance Improvements

• add benchmark tests for trivy and scan packages (#12) (e053ae4)
• redis: gzip-compress stored scan job values (#31) (df82d98)

---

Container Image

Multi-arch image (linux/amd64, linux/arm64) signed with cosign.

Image	Reference
harbor-scanner-trivy	8gears.container-registry.com/8gcr/harbor-scanner-trivy:v0.39.1

Verify the image signature:

cosign verify \
  --certificate-identity "https://github.com/container-registry/harbor-scanner-trivy/.github/workflows/publish-image.yml@refs/heads/main" \
  --certificate-oidc-issuer "https://token.actions.githubusercontent.com" \
  8gears.container-registry.com/8gcr/harbor-scanner-trivy:v0.39.1

Verify the SBOM attestation:

cosign verify-attestation \
  --certificate-identity "https://github.com/container-registry/harbor-scanner-trivy/.github/workflows/publish-image.yml@refs/heads/main" \
  --certificate-oidc-issuer "https://token.actions.githubusercontent.com" \
  --type spdxjson \
  8gears.container-registry.com/8gcr/harbor-scanner-trivy@sha256:29fac3e342b0dd4e1974868e01bb22b7f7a33cf52138ccb7de6705451ddd7c68

Helm Chart

helm install harbor-scanner-trivy \
  oci://8gears.container-registry.com/8gcr/charts/harbor-scanner-trivy \
  --version 0.39.1

Binaries

Static linux/amd64 and linux/arm64 binaries are attached to this release
(checksums.txt has the SHA256 sums):

Asset	Contents
scanner-trivy_linux-<arch>.tar.gz	Harbor scanner adapter v0.39.1
trivy_linux-<arch>.tar.gz	Trivy CLI v0.72.0, built from source

v0.39.0

0.38.1 (2026-07-03)

Bug Fixes

• validate layer media types and return structured scan errors (4fd69a4)

Code Refactoring

• rename Go module to github.com/container-registry/harbor-scanner-trivy (#20) (3aecb90)

---

This PR was generated with Release Please. See documentation.

---

Container Image

Multi-arch image (linux/amd64, linux/arm64) signed with cosign.

Image	Reference
harbor-scanner-trivy	8gears.container-registry.com/8gcr/harbor-scanner-trivy:v0.39.0

Verify the image signature:

cosign verify \
  --certificate-identity "https://github.com/container-registry/harbor-scanner-trivy/.github/workflows/publish-image.yml@refs/heads/main" \
  --certificate-oidc-issuer "https://token.actions.githubusercontent.com" \
  8gears.container-registry.com/8gcr/harbor-scanner-trivy:v0.39.0

Verify the SBOM attestation:

cosign verify-attestation \
  --certificate-identity "https://github.com/container-registry/harbor-scanner-trivy/.github/workflows/publish-image.yml@refs/heads/main" \
  --certificate-oidc-issuer "https://token.actions.githubusercontent.com" \
  --type spdxjson \
  8gears.container-registry.com/8gcr/harbor-scanner-trivy@sha256:74a0c990e7bb007ba461f0860bd69b51d07a956ae96ae1aeac9afde89374ed1c

Helm Chart

helm install harbor-scanner-trivy \
  oci://8gears.container-registry.com/8gcr/charts/harbor-scanner-trivy \
  --version 0.39.0

Binaries

Static linux/amd64 and linux/arm64 binaries are attached to this release
(checksums.txt has the SHA256 sums):

Asset	Contents
scanner-trivy_linux-<arch>.tar.gz	Harbor scanner adapter v0.39.0
trivy_linux-<arch>.tar.gz	Trivy CLI v0.72.0, built from source

v0.38.1

0.38.1 (2026-07-03)

Bug Fixes

• validate layer media types and return structured scan errors (4fd69a4)

Code Refactoring

• rename Go module to github.com/container-registry/harbor-scanner-trivy (#20) (3aecb90)

---

Container Image

Multi-arch image (linux/amd64, linux/arm64) signed with cosign.

Image	Reference
harbor-scanner-trivy	8gears.container-registry.com/8gcr/harbor-scanner-trivy:v0.38.1

Verify the image signature:

cosign verify \
  --certificate-identity "https://github.com/container-registry/harbor-scanner-trivy/.github/workflows/publish-image.yml@refs/heads/main" \
  --certificate-oidc-issuer "https://token.actions.githubusercontent.com" \
  8gears.container-registry.com/8gcr/harbor-scanner-trivy:v0.38.1

Verify the SBOM attestation:

cosign verify-attestation \
  --certificate-identity "https://github.com/container-registry/harbor-scanner-trivy/.github/workflows/publish-image.yml@refs/heads/main" \
  --certificate-oidc-issuer "https://token.actions.githubusercontent.com" \
  --type spdxjson \
  8gears.container-registry.com/8gcr/harbor-scanner-trivy@sha256:f154cfcf09497e48a93656b6ad3392fd1638147ade576d1dd54454fa638ee2a4

Helm Chart

helm install harbor-scanner-trivy \
  oci://8gears.container-registry.com/8gcr/charts/harbor-scanner-trivy \
  --version 0.38.1

v0.37.1

Release v0.37.1 with the local main updates, including harbor-scanner-trivy v0.37.1 / Trivy v0.71.1 and structured scan errors for unsupported layer media types.