v1.3.4

Release v1.3.4 of the Ghostwire Helm chart.

The chart archive is signed with Sigstore keyless signing (cosign sign-blob). The signature bundle is the .tgz.sigstore.json asset. SLSA provenance for the archive is attached as ghostwire.intoto.jsonl.

Security fixes recorded in CHANGELOG.md:

• Pin mkdocs-material to 9.7.7, fixing PYSEC-2026-3864 (CVE-2026-73295), a DOM XSS in the documentation theme's search.suggest feature
• Pin idna to 3.20, fixing PYSEC-2026-215 (CVE-2026-45409), a denial of service in idna.encode pulled in by the documentation requirements
• Pin the devcontainer base image, Playwright installs, and the k3d browser-test image by digest or lockfile
• Sign GitHub release archives with Sigstore keyless signing and attach SLSA provenance (ghostwire.intoto.jsonl). The release stays a draft until that provenance file is uploaded, because published releases are immutable. v1.3.2 was published before provenance existed, so it keeps its .tgz.sigstore.json bundle and cannot gain ghostwire.intoto.jsonl

Changes since the previous tag:

• fix(release): verify provenance with the tag flag (#330)
• fix(release): call the SLSA generator by its release tag (#329)
• fix(release): publish only after SLSA provenance is attached (#328)
• fix(release): sign the OCI chart with a registry login (#327)
• chore(security): raise OpenSSF Scorecard coverage (#326)
• chore(deps): Update ossf/scorecard-action action to v2.5.0 (#325)
• chore(deps): Update cgr.dev/chainguard/wolfi-base:latest Docker digest to 256c88b (#324)
• chore(deps): Update cgr.dev/chainguard/wolfi-base:latest Docker digest to 1c451d4 (#323)
• chore(deps): Update cgr.dev/chainguard/wolfi-base:latest Docker digest to c08875f (#322)
• chore(deps): Update cgr.dev/chainguard/wolfi-base:latest Docker digest to 05d2416 (#321)
• chore(deps): Update github/codeql-action action to v4.38.3 (#319)
• chore(deps): Update trufflesecurity/trufflehog action to v3.99.2 (#320)
• chore(deps): Update trufflesecurity/trufflehog action to v3.99.1 (#318)
• chore(deps): Update step-security/harden-runner action to v2.22.1 (#317)
• chore(deps): Update cgr.dev/chainguard/wolfi-base:latest Docker digest to 238642d (#316)
• chore(deps): Update trufflesecurity/trufflehog action to v3.99.0 (#315)
• chore(deps): Update cgr.dev/chainguard/wolfi-base:latest Docker digest to 6f6d440 (#314)
• chore(deps): Update trufflesecurity/trufflehog action to v3.98.1 (#313)
• chore(deps): Update step-security/harden-runner action to v2.22.0 (#312)
• chore(deps): Update cgr.dev/chainguard/wolfi-base:latest Docker digest to 00fd4e9 (#311)
• chore(deps): Update trufflesecurity/trufflehog action to v3.98.0 (#310)
• chore(deps): Update cgr.dev/chainguard/wolfi-base:latest Docker digest to 9c2092b (#309)
• chore(deps): Update cgr.dev/chainguard/wolfi-base:latest Docker digest to 824f77d (#308)
• chore(deps): Update cgr.dev/chainguard/wolfi-base:latest Docker digest to 6d63d8f (#307)
• chore(deps): Update cgr.dev/chainguard/wolfi-base:latest Docker digest to bef0f4d (#306)
• chore(deps): Update cgr.dev/chainguard/wolfi-base:latest Docker digest to 08df598 (#305)
• chore(deps): Update cgr.dev/chainguard/wolfi-base:latest Docker digest to fac38d1 (#304)
• chore(deps): Update github/codeql-action action to v4.38.2 (#302)
• chore(deps): Update trufflesecurity/trufflehog action to v3.97.9 (#303)
• chore(deps): Update trufflesecurity/trufflehog action to v3.97.8 (#301)
• chore(deps): Update dependency kubectl to v1.37.1 (#300)
• chore(deps): Update trufflesecurity/trufflehog action to v3.97.6 (#299)
• chore(deps): Update github/codeql-action action to v4.38.1 (#298)
• chore(deps): Update cgr.dev/chainguard/wolfi-base:latest Docker digest to 1d95114 (#297)
• chore(deps): Update trufflesecurity/trufflehog action to v3.97.5 (#296)
• chore(deps): Update dependency kubectl to v1.37.0 (#294)
• chore(deps): Update ghcr.io/renovatebot/renovate Docker tag to v41.173.1 (#295)
• chore(deps): Update cgr.dev/chainguard/wolfi-base:latest Docker digest to 3754b6d (#293)
• chore(deps): Update cgr.dev/chainguard/wolfi-base:latest Docker digest to 9a8d954 (#292)
• chore(deps): Update cgr.dev/chainguard/wolfi-base:latest Docker digest to 65e1acb (#291)
• chore(deps): Update dependency helm to v3.22.0 (#290)
• chore(deps): Update cgr.dev/chainguard/wolfi-base:latest Docker digest to 150a90c (#289)
• chore(deps): Update github/codeql-action action to v4.38.0 (#288)
• chore(deps): Update cgr.dev/chainguard/wolfi-base:latest Docker digest to 918a593 (#287)
• chore(deps): Update trufflesecurity/trufflehog action to v3.97.4 (#286)
• chore(deps): Update cgr.dev/chainguard/wolfi-base:latest Docker digest to 103eb3f (#285)
• chore(deps): Update trufflesecurity/trufflehog action to v3.97.2 (#284)
• chore(deps): Update cgr.dev/chainguard/wolfi-base:latest Docker digest to 7e62cec (#283)
• chore(deps): Update step-security/harden-runner action to v2.21.1 (#282)
• chore(deps): Update cgr.dev/chainguard/wolfi-base:latest Docker digest to e624c5d (#281)
• chore(deps): Update cgr.dev/chainguard/wolfi-base:latest Docker digest to 03c6561 (#280)
• chore(deps): Update cgr.dev/chainguard/wolfi-base:latest Docker digest to 19f7a7b (#279)
• chore(deps): Update github/codeql-action action to v4.37.9 (#278)
• chore(deps): Update trufflesecurity/trufflehog action to v3.97.1 (#277)
• chore(deps): Update cgr.dev/chainguard/wolfi-base:latest Docker digest to a31344a (#276)
• chore(deps): Update github/codeql-action action to v4.37.8 (#275)
• chore(deps): Update cgr.dev/chainguard/wolfi-base:latest Docker digest to bfcffaf (#274)
• chore(deps): Update cgr.dev/chainguard/wolfi-base:latest Docker digest to fdcd31a (#273)
• chore(deps): Update cgr.dev/chainguard/wolfi-base:latest Docker digest to 8e8fe4b (#272)
• chore(deps): Update step-security/harden-runner action to v2.21.0 (#271)
• chore(deps): Update dependency helm to v3.21.4 (#269)
• chore(deps): Update trufflesecurity/trufflehog action to v3.97.0 (#270)
• chore(deps): Update cgr.dev/chainguard/wolfi-base:latest Docker digest to 0a8fd42 (#268)
• chore(deps): Update github/codeql-action action to v4.37.7 (#267)
• chore(deps): Update cgr.dev/chainguard/wolfi-base:latest Docker digest to 30f0334 (#266)
• chore(deps): Update cgr.dev/chainguard/wolfi-base:latest Docker digest to 1454fe5 (#265)
• chore(deps): Update cgr.dev/chainguard/wolfi-base:latest Docker digest to c0534ee (#264)
• chore(deps): Update cgr.dev/chainguard/wolfi-base:latest Docker digest to ca263a0 (#263)
• chore(deps): Update step-security/harden-runner action to v2.20.1 (#262)
• chore(deps): Update github/codeql-action action to v4.37.6 (#261)
• chore(deps): Update github/codeql-action action to v4.37.5 (#260)
• chore(deps): Update github/codeql-action action to v4.37.4 (#259)
• chore(deps): Update cgr.dev/chainguard/wolfi-base:latest Docker digest to 003627d (#258)
• chore(deps): Update trufflesecurity/trufflehog action to v3.96.0 (#257)
• chore(deps): Update ossf/scorecard-action action to v2.4.4 (#256)
• chore(deps): Update github/codeql-action action to v4.37.3 (#255)
• chore(deps): Update github/codeql-action action to v4.37.2 (#254)
• chore(deps): Update actions/checkout action to v6.1.0 (#253)
• chore(deps): Update github/codeql-action action to v4.37.1 (#252)
• chore(deps): Update trufflesecurity/trufflehog action to v3.95.9 (#251)
• chore(deps): Update dependency helm to v3.21.3 (#250)
• chore(deps): Update github/codeql-action action to v4.37.0 (#249)
• chore(deps): Update astral-sh/setup-uv action to v8.3.2 (#246)
• chore(deps): Update step-security/harden-runner action to v2.20.0 (#247)
• chore(deps): Update cgr.dev/chainguard/wolfi-base:latest Docker digest to 02dab76 (#245)
• chore(deps): Update astral-sh/setup-uv action to v8.3.1 (#244)
• chore(deps): Update astral-sh/setup-uv action to v8.3.0 (#228)
• chore(deps): Update trufflesecurity/trufflehog action to v3.95.8 (#243)
• chore(deps): Update github/codeql-action action to v4.36.3 (#242)
• chore(deps): Update trufflesecurity/trufflehog action to v3.95.7 (#241)
• chore(deps): Update cgr.dev/chainguard/wolfi-base:latest Docker digest to 2f7a5c1 (#240)
• chore(deps): Update cgr.dev/chainguard/wolfi-base:latest Docker digest to 0b613d8 (#239)
• chore(deps): Update cgr.dev/chainguard/wolfi-base:latest Docker digest to c61ac69 (#238)
• chore(deps): Update dependency helm to v3.21.2 (#237)
• chore(deps): Update cgr.dev/chainguard/wolfi-base:latest Docker digest to e161445 (#236)
• chore(deps): Update trufflesecurity/trufflehog action to v3.95.6 (#235)
• chore(deps): Update dependency helm to v3.21.1 (#234)
• chore(deps): Update cgr.dev/chainguard/wolfi-base:latest Docker digest to 34977aa (#233)
• chore(deps): Update dependency helm to v3.21.0 (#232)
• chore(deps): Update cgr.dev/chainguard/wolfi-base:latest Docker digest to 8652670 (#231)
• chore(deps): Update cgr.dev/chainguard/wolfi-base:latest Docker digest to b78bb98 (#230)
• chore(deps): Update github/codeql-action action to v4.36.2 (#229)
• chore(deps): Update astral-sh/setup-uv action to v8.2.0 (#198)
• chore(deps): Update cgr.dev/chainguard/wolfi-base:latest Docker digest to cb2fc9d (#227)
• chore(deps): Update trufflesecurity/trufflehog action to v3.95.5 (#226)
• chore(deps): Update actions/checkout action to v6.0.3 (#225)
• chore(deps): Update github/codeql-action action to v4.36.1 (#223)
• chore(deps): Update trufflesecurity/trufflehog action to v3.95.4 (#224)
• chore(deps): Update cgr.dev/chainguard/wolfi-base:latest Docker digest to 441d670 (#222)
• chore(deps): Update cgr.dev/chainguard/wolfi-base:latest Docker digest to 5743937 (#221)
• chore(deps): Update github/codeql-action action to v4.36.0 (#220)
• chore(deps): Update cgr.dev/chainguard/wolfi-base:latest Docker digest to b2ce5ae (#219)
• chore(deps): Update cgr.dev/chainguard/wolfi-base:latest Docker digest to 4798357 (#218)
• chore(deps): Update step-security/harden-runner action to v2.19.4 (#217)
• chore(deps): Update cgr.dev/chainguard/wolfi-base:latest Docker digest to 315732e (#216)
• chore(deps): Update github/codeql-action action to v4.35.5 (#215)
• chore(deps): Update cgr.dev/chainguard/wolfi-base:latest Docker digest to 0cff4df (#214)
• chore(deps): Update step-security/harden-runner action to v2.19.3 (#213)
• chore(deps): Update cgr.dev/chainguard/wolfi-base:latest Docker digest to af366da (#212)
• chore(deps): Update step-security/harden-runner action to v2.19.2 (#211)
• chore(deps): Update trufflesecurity/trufflehog action to v3.95.3 (#210)
• chore(deps): Update cgr.dev/chainguard/wolfi-base:latest Docker digest to 4ac37af (#209)
• chore(deps): Update github/codeql-action action to v4.35.4 (#208)
• chore(deps): Update sigstore/cosign-installer action to v4.1.2 (#207)
• chore(deps): Update cgr.dev/chainguard/wolfi-base:latest Docker digest to 31da656 (#206)
• chore(deps): Update step-security/harden-runner action to v2.19.1 (#205)
• chore(deps): Update cgr.dev/chainguard/wolfi-base:latest Docker digest to 3258be4 (#204)
• chore(deps): Update github/codeql-action action to v4.35.3 (#203)
• chore(deps): Update cgr.dev/chainguard/wolfi-base:latest Docker digest to d6e31fc (#202)
• chore(deps): Update aquasecurity/trivy-action action to v0.36.0 (#201)
• chore(deps): Update trufflesecurity/trufflehog action to v3.95.2 (#200)
• chore(deps): Update step-security/harden-runner action to v2.19.0 (#199)
• chore(deps): Replace astral-sh/setup-uv action with astral-sh/setup-uv v8.0.0 (#197)
• chore(deps): Update astral-sh/setup-uv action to v8.1.0 (#196)
• chore(deps): Replace astral-sh/setup-uv action with astral-sh/setup-uv (#195)
• chore(deps): Update cgr.dev/chainguard/wolfi-base:latest Docker digest to 70750df (#194)
• chore(deps): Update github/codeql-action action to v4.35.2 (#193)
• chore(deps): Update step-security/harden-runner action to v2.18.0 (#192)
• chore(deps): Update cgr.dev/chainguard/wolfi-base:latest Docker digest to 1af610c (#191)
• chore(deps): Update cgr.dev/chainguard/wolfi-base:latest Docker digest to 9a74366 (#190)
• chore(deps): Update step-security/harden-runner action to v2.17.0 (#189)
• chore(deps): Update trufflesecurity/trufflehog action to v3.94.3 (#188)
• chore(deps): Update cgr.dev/chainguard/wolfi-base:latest Docker digest to 52e71f6 (#187)
• chore(deps): Update cgr.dev/chainguard/wolfi-base:latest Docker digest to 36afa78 (#180)
• chore(deps): Update trufflesecurity/trufflehog action to v3.94.2 (#186)
• chore(deps): Update step-security/harden-runner action to v2.16.1 (#185)
• chore(deps): Update github/codeql-action action to v4.35.1 (#184)
• chore(deps): Update github/codeql-action action to v4.35.0 (#183)
• chore(deps): Update sigstore/cosign-installer action to v4.1.1 (#182)
• chore(deps): Update trufflesecurity/trufflehog action to v3.94.1 (#181)
• chore(deps): Update cgr.dev/chainguard/wolfi-base:latest Docker digest to 237a457 (#179)
• chore(deps): Update github/codeql-action action to v4.34.1 (#178)
• chore(deps): Update trufflesecurity/trufflehog action to v3.94.0 (#177)
• chore(deps): Update github/codeql-action action to v4.34.0 (#176)
• chore(deps): Update cgr.dev/chainguard/wolfi-base:latest Docker digest to 73de6aa (#175)
• chore(deps): Update cgr.dev/chainguard/wolfi-base:latest Docker digest to 550e0d6 (#174)
• chore(deps): Update astral-sh/setup-uv action to v7.6.0 (#173)
• chore(deps): Update github/codeql-action action to v4.33.0 (#171)
• chore(deps): Update step-security/harden-runner action to v2.16.0 (#172)
• chore(deps): Update cgr.dev/chainguard/wolfi-base:latest Docker digest to 2a43204 (#169)
• chore(deps): Update astral-sh/setup-uv action to v7.5.0 (#170)
• chore(deps): Update cgr.dev/chainguard/wolfi-base:latest Docker digest to 8f4bb89 (#168)
• chore(deps): Update astral-sh/setup-uv action to v7.4.0 (#167)
• chore(deps): Update cgr.dev/chainguard/wolfi-base:latest Docker digest to 08420c1 (#166)
• chore(deps): Update sigstore/cosign-installer action to v4.1.0 (#165)
• chore(deps): Update trufflesecurity/trufflehog action to v3.93.8 (#164)
• chore(deps): Update aquasecurity/trivy-action action to v0.35.0 (#163)
• chore(deps): Update step-security/harden-runner action to v2.15.1 (#162)
• chore(deps): Update github/codeql-action action to v4.32.6 (#161)
• chore(deps): Update aquasecurity/trivy-action action to v0.34.2 (#155)
• chore(deps): Update cgr.dev/chainguard/wolfi-base:latest Docker digest to 00f9662 (#160)
• chore(deps): Update trufflesecurity/trufflehog action to v3.93.7 (#159)
• chore(deps): Update cgr.dev/chainguard/wolfi-base:latest Docker digest to 74cc431 (#158)
• chore(deps): Update actions/dependency-review-action action to v4.9.0 (#157)
• chore(deps): Update cgr.dev/chainguard/wolfi-base:latest Docker digest to c11fcfc (#156)
• chore(deps): Update github/codeql-action action to v4.32.5 (#154)
• chore(deps): Update astral-sh/setup-uv action to v7.3.1 (#153)
• chore(deps): Update trufflesecurity/trufflehog action to v3.93.6 (#152)
• chore(deps): Update trufflesecurity/trufflehog action to v3.93.5 (#151)
• chore(deps): Update step-security/harden-runner action to v2.15.0 (#150)
• chore(deps): Update aquasecurity/trivy-action action to v0.34.1 (#149)
• chore(deps): Update github/codeql-action action to v4.32.4 (#148)
• chore(deps): Update actions/dependency-review-action action to v4.8.3 (#147)
• chore(deps): Update trufflesecurity/trufflehog action to v3.93.4 (#146)
• chore(deps): Update cgr.dev/chainguard/wolfi-base:latest Docker digest to 9925d30 (#145)
• chore(deps): Update cgr.dev/chainguard/wolfi-base:latest Docker digest to c9a27ee (#144)
• chore(deps): Update cgr.dev/chainguard/wolfi-base:latest Docker digest to b5f4a33 (#143)
• chore(deps): Update github/codeql-action action to v4.32.3 (#142)
• chore(deps): Update aquasecurity/trivy-action action to v0.34.0 (#141)
• chore(deps): Update renovatebot/github-action action to v44.2.6 (#124)
• chore(deps): Update actions/attest-build-provenance action to v3.2.0 (#126)
• chore(deps): Update docker/build-push-action action to v6.19.2 (#140)
• chore(deps): Update docker/build-push-action action to v6.19.1 (#138)
• chore(deps): Update trufflesecurity/trufflehog action to v3.93.3 (#139)
• chore(deps): Update docker/build-push-action action to v6.19.0 (#137)
• chore(deps): Update trufflesecurity/trufflehog action to v3.93.2 (#136)
• chore(deps): Update cgr.dev/chainguard/wolfi-base:latest Docker digest to 1c56f3c (#135)
• chore(deps): Update step-security/harden-runner action to v2.14.2 (#125)
• chore(deps): Update trufflesecurity/trufflehog action to v3.93.1 (#133)
• chore(deps): Update astral-sh/setup-uv action to v7.3.0 (#134)
• chore(deps): Update github/codeql-action action to v4.32.2 (#127)
• chore(deps): Update cgr.dev/chainguard/wolfi-base:latest Docker digest to 417d791 (#132)
• chore(deps): Update trufflesecurity/trufflehog action to v3.93.0 (#131)
• chore(deps): Update cgr.dev/chainguard/wolfi-base:latest Docker digest to 5ef2010 (#128)
• chore(deps): Update astral-sh/setup-uv action to v7.2.1 (#130)
• chore(deps): Update docker/login-action action to v3.7.0 (#129)
• chore(deps): Update cgr.dev/chainguard/wolfi-base:latest Docker digest to 9d9881f (#123)
• chore(deps): Update github/codeql-action action to v4.31.11 (#122)
• chore(deps): Update actions/checkout action to v6.0.2 (#121)
• chore(deps): Update cgr.dev/chainguard/wolfi-base:latest Docker digest to 0c79f2e (#120)
• chore(deps): Update renovatebot/github-action action to v44.2.5 (#119)
• chore(deps): Update cgr.dev/chainguard/wolfi-base:latest Docker digest to 5cb6b2e (#118)
• chore(deps): Update trufflesecurity/trufflehog action to v3.92.5 (#117)
• chore(deps): Update cgr.dev/chainguard/wolfi-base:latest Docker digest to e735a9b (#116)
• chore(deps): Update github/codeql-action action to v4.31.10 (#115)
• chore(deps): Update renovatebot/github-action action to v44.2.4 (#114)
• chore(deps): Update cgr.dev/chainguard/wolfi-base:latest Docker digest to caa431d (#113)
• chore(deps): Update astral-sh/setup-uv action to v7.2.0 (#112)
• chore(deps): Update renovatebot/github-action action to v44.2.3 (#111)
• chore(deps): Update renovatebot/github-action action to v44.2.2 (#110)
• chore(deps): Update renovatebot/github-action action to v44.2.1 (#109)
• chore(deps): Update trufflesecurity/trufflehog action to v3.92.4 (#108)
• chore(deps): Update docker/setup-buildx-action action to v3.12.0 (#107)
• chore(deps): Update actions/attest-build-provenance action to v3.1.0 (#106)
• chore(deps): Update github/codeql-action action to v4.31.9 (#105)
• chore(deps): Update renovatebot/github-action action to v44.2.0 (#104)
• chore(deps): Update astral-sh/setup-uv action to v7.1.6 (#103)
• chore(deps): Update renovatebot/github-action action to v44.1.0 (#102)
• chore(deps): Update github/codeql-action action to v4.31.8 (#101)
• chore(deps): Update trufflesecurity/trufflehog action to v3.92.3 (#100)
• chore(deps): Update trufflesecurity/trufflehog action to v3.92.2 (#99)
• chore(deps): Update cgr.dev/chainguard/wolfi-base:latest Docker digest to 0d8efc7 (#98)
• chore(deps): Update trufflesecurity/trufflehog action to v3.92.1 (#97)
• chore(deps): Update step-security/harden-runner action to v2.14.0 (#96)
• chore(deps): Update cgr.dev/chainguard/wolfi-base:latest Docker digest to c0ead40 (#95)
• chore(deps): Update astral-sh/setup-uv action to v7.1.5 (#94)
• chore(deps): Update github/codeql-action action to v4.31.7 (#93)
• fix(docs): replace placeholder contact method in CODE_OF_CONDUCT.md
• docs: maximize SEO with meta tags, descriptions, and robots.txt
• fix(docs): remove custom_dir override causing RTD build failure
• docs: align theme with brand identity
• docs: redesign theme and add mermaid diagrams
• chore: remove site build artifacts and add to gitignore
• chore: remove GitHub Pages workflow in favor of Read the Docs
• docs: enhance documentation accuracy and completeness
• chore(deps): Pin dependency python to 3.14.1 (#89)
• chore(deps): Update actions/checkout action to v4.3.1 (#91)
• chore(deps): Update dependency python to 3.14 (#92)
• chore(deps): Update actions/cache action to v4.3.0 (#90)
• docs: add Read the Docs configuration
• docs: add MkDocs site with Material theme for GitHub Pages (#88)
• fix(ci): resolve workflow failures and Scorecard security alerts (#87)
• feat(ci): streamline dependency automation and add redeploy script (#86)
• chore(deps): Update trufflesecurity/trufflehog action to v3.91.2 (#85)
• chore(deps): Update actions/checkout action to v6.0.1 (#84)
• chore(deps): Update step-security/harden-runner action to v2.13.3 (#83)
• chore(deps): Update renovatebot/github-action action to v44.0.5 (#82)
• chore(deps): Update github/codeql-action action to v4.31.6 (#81)
• docs: update quick start with k3d installation and port-forwarding instructions (#80)
• chore(deps): Update actions/download-artifact action to v6 (#73)
• chore(deps): Update actions/checkout action to v6 (#72)
• chore(deps): migrate config renovate.json (#74)
• chore(deps)(deps): bump actions/checkout from 5.0.1 to 6.0.0 (#76)
• chore(deps)(deps): bump actions/download-artifact from 5.0.0 to 6.0.0 (#77)
• chore(deps)(deps): bump anchore/sbom-action from 0.20.9 to 0.20.10 (#78)
• chore(deps): Update github/codeql-action action to v4.31.5 (#79)
• chore(deps): Update renovatebot/github-action action to v44.0.4 (#75)
• chore(deps): Update mcr.microsoft.com/devcontainers/go Docker tag to v2 (#60)
• chore(deps): Update actions/download-artifact digest to 634f93c (#71)
• feat: Add Zarf packaging support for air-gapped deployments (#70)
• fix(security): resolve all Trivy HIGH severity findings
• feat(security): add Trivy configuration files and fix deprecations
• chore(deps): Update astral-sh/setup-uv action to v7.1.4 (#69)
• chore(deps): Update trufflesecurity/trufflehog action to v3.91.1 (#68)
• fix(renovate): correct helm-values manager configuration
• fix(ci): resolve workflow failures in PR checks
• fix(renovate): remove @ prefix from username assignments
• chore(deps): Update github/codeql-action action to v4.31.4 (#67)
• chore(deps): Update actions/checkout action to v5.0.1 (#66)
• chore(deps): Update renovatebot/github-action action to v44.0.3 (#65)
• chore(deps): Update cgr.dev/chainguard/wolfi-base:latest Docker digest to 42012fa (#64)
• chore(deps): Update cgr.dev/chainguard/wolfi-base:latest Docker digest to 5c39331 (#62)
• chore(deps): Update github/codeql-action action to v4.31.3 (#61)
• chore(deps)(deps): bump renovatebot/github-action from 43.0.20 to 44.0.2 (#55)
• chore(deps): Update trufflesecurity/trufflehog action to v3.91.0 (#59)
• chore(deps): Update astral-sh/setup-uv action to v7.1.3 (#58)
• chore(deps): Update actions/dependency-review-action action to v4.8.2 (#57)
• chore(deps): Update cgr.dev/chainguard/wolfi-base:latest Docker digest to 77891a1 (#56)
• chore(deps): Update cgr.dev/chainguard/wolfi-base:latest Docker digest to 24ac910 (#54)
• chore(deps): Update cgr.dev/chainguard/wolfi-base:latest Docker digest to 1c37319 (#53)
• chore(deps)(deps): bump anchore/sbom-action from 0.20.8 to 0.20.9 (#41)
• chore(deps)(deps): bump actions/upload-artifact from 4.6.2 to 5.0.0 (#40)
• chore(deps): Update mcr.microsoft.com/devcontainers/go Docker tag to v1.25 (#32)
• chore: add missing dependabot labels and update jq version
• chore(deps): Update cgr.dev/chainguard/wolfi-base:latest Docker digest to 521076e (#52)
• chore(deps): Update trufflesecurity/trufflehog action to v3.90.13 (#51)
• chore(deps): Update step-security/harden-runner action to v2.13.2 (#50)
• chore(deps): Update cgr.dev/chainguard/wolfi-base:latest Docker digest to 9b359e5 (#49)
• chore(deps): Update cgr.dev/chainguard/wolfi-base:latest Docker digest to 2579b5f (#48)
• chore(deps): Update renovatebot/github-action action to v43.0.20 (#47)
• chore(deps): Update cgr.dev/chainguard/wolfi-base:latest Docker digest to ae238a1 (#46)
• chore(deps): Update github/codeql-action action to v4.31.2 (#45)
• chore(deps): Update github/codeql-action action to v4.31.1 (#44)
• chore(deps): Update cgr.dev/chainguard/wolfi-base:latest Docker digest to 318af6f (#43)
• chore(deps): Update trufflesecurity/trufflehog action to v3.90.12 (#42)
• chore(deps): Update renovatebot/github-action action to v43.0.19 (#39)
• chore(deps): Update astral-sh/setup-uv action to v7.1.2 (#38)
• chore(deps): Update cgr.dev/chainguard/wolfi-base:latest Docker digest to 0d1673d (#37)
• chore(deps): Update github/codeql-action action to v4.31.0 (#36)
• chore(deps): Update cgr.dev/chainguard/wolfi-base:latest Docker digest to c47abf9 (#35)
• chore(deps): Update cgr.dev/chainguard/wolfi-base:latest Docker digest to be19869 (#34)
• chore(deps): Update cgr.dev/chainguard/wolfi-base:latest Docker digest to bda46ad (#33)
• fix(devcontainer): install kubectl/helm in Dockerfile and update to latest versions
• ci(scorecard): suppress npm command pinning warning for devcontainer
• security(devcontainer): pin all dependencies to fix Scorecard alerts
• refactor(ci): align devcontainer workflow with tools image pattern
• ci(devcontainer): prebuild and publish devcontainer image to GHCR
• feat(dev): add devcontainer with k3d, playwright, and caching
• chore(deps): Update actions/checkout action to v5 (#28)
• chore(deps): Update ludeeus/action-shellcheck digest to 00cae50 (#27)
• ci: add merge_group trigger to workflows for merge queue support
• chore(deps): revert to manual approval for major updates
• chore(deps): enable full automation including major updates
• chore(deps): optimize renovate config for maximum safe automation
• chore(deps): enable automerge for patch, minor, and digest updates
• fix(ci): run Lint and Test on all PRs to satisfy required checks
• fix(deps): remove invalid vulnerabilitySeverity config option
• fix(security): auto-merge only CRITICAL CVEs (9.0+), manual review for HIGH
• feat(security): auto-merge critical (9.0+) and high (8.0+) CVEs
• fix(ci): remove --delete-branch flag (incompatible with merge queue)
• refactor(ci): simplify bot PR automation to use GitHub native auto-merge
• fix(ci): update renovate validator to use renovate.json and add token
• chore: remove redundant renovate.json5
• chore: remove duplicate renovate config (keep root renovate.json)
• chore(deps): enable github-actions manager in renovate config
• ci: trigger k3d test after lint/static analysis completes
• chore: remove unused playwright-test.js (now embedded in bash script)
• fix(lint): remove trailing spaces and fix comment indentation in k3d workflow
• fix(ci): use heredoc for Playwright test script inline
• fix(ci): test -latest after push, latest-stable after manual release
• feat(ci): add k3d integration test before release and after
• feat(ci): publish bleeding edge -latest on push, latest-stable on manual release
• fix(ci): use simpler npm install without init to avoid tracker error
• ci: run k3d test only after successful release workflow
• fix(ci): use writable working dir for npm install in Playwright container
• fix(ci): remove container config and Docker caching for k3d test
• ci: use Playwright container with recommended Docker options
• ci: run k3d integration test on main pushes to validate published chart
• fix(ci): install playwright package in Docker and use recommended flags
• fix(ci): k3d test now uses OCI registry to test actual user install path
• docs: update README to use latest-stable chart version