Release v1.13.0 · earthly/lunar-lib

⚠️ Breaking

pagerduty — include: [oncall] now resolves to a code collector (runs on PRs and the default branch); it previously resolved to a cron collector. The daily scheduled refresh moved to include: [oncall-cron]. Same name, different trigger, no error — consumers who want the scheduled refresh must switch to oncall-cron. The .oncall.* Component JSON shape is unchanged, so the oncall policy and every downstream consumer are unaffected; only the trigger behind the name changed. (#283)

package-registries (beta) — parses package-manager configuration already committed to the repo and records which registries each ecosystem resolves dependencies from, under a new .dependencies category. Covers npm, pip, Maven, Gradle, RubyGems and NuGet. Token-free and Python-stdlib only; registry locations only — _authToken lines are skipped and URL userinfo is stripped, so credentials are never emitted. An ecosystem in use that declares no registry is recorded with its public default and is_default: true, rather than omitted. (#286)

Folded into the existing dependencies policy rather than a new plugin, mirroring how SCA scanners reuse the sca policy:

approved-registries — allowlist dependency sources via allowed_registries; raises on an empty list rather than failing every component. (#286)
no-public-registries — zero-config; fails on any well-known public index. (#286)

Both ignore kind: publish (a publish target is not a dependency source) and skip cleanly for repos with no package manager.

docker — writes nothing when a repo has no Dockerfiles, so container policies skip instead of silently passing. (#287)
trivy / grype — container-scan pins get-json to the PR's commit. (#284)

- uses: github://earthly/lunar-lib/collectors/<name>@v1.13.0