v1.8.0

Minor release. 12 PRs since v1.7.0, headlined by 10 new plugins (5 collectors, 4 policies, 1 cataloger). All additive — no breaking changes.

New Collectors

• istio (experimental) — Istio service-mesh collector. Parses Istio custom resources committed to the repo (PeerAuthentication, AuthorizationPolicy, RequestAuthentication, VirtualService, DestinationRule, Gateway, ServiceEntry, Sidecar, EnvoyFilter, Telemetry, IstioOperator) plus namespace/workload sidecar-injection settings, validates offline with istioctl analyze, and writes a normalized .mesh view. A cicd sub-collector records istioctl commands run in CI. Skip-safe on non-mesh repos. (#245)
• argocd (beta) — parses and kubeconform-validates argoproj CRDs (Application / ApplicationSet / AppProject) into a normalized .cd.gitops view. (#218)
• argocd-deployment-tracking (experimental) — correlates each ArgoCD Application to the service it deploys and records that service's deployment posture out-of-band (post-merge system of record). (#218)
• argocd-deployment-gate (experimental) — pulls a service's deployment posture back from the GitOps component for PR-time enforcement; mapping defaults to a cataloger-set meta annotation, with Backstage catalog-info opt-in. Push and pull are mutually exclusive per service. (#218)
• kotlin (beta) — Kotlin language collector. Detects Gradle (Kotlin/Groovy DSL) + Maven, parses Kotlin/Gradle versions, target (jvm/android/multiplatform), dependencies (incl. version-catalog resolution and gradle.lockfile transitives), kotlinc CI commands, and Kover test coverage into .lang.kotlin. (#242)

New Policies

• istio (experimental) — seven checks over .mesh: valid, mtls-strict, authorization-policies-defined, no-permissive-authz, gateway-tls, sidecar-injection, no-envoy-filter. Uniform pend-then-skip gating: PENDING while collectors run, terminal SKIP on non-mesh components. (#245)
• gitops (beta) — tool-agnostic checks over the normalized GitOps deployment posture, independent of the underlying GitOps engine. (#218)
• argocd (beta) — ArgoCD-specific checks: argoproj CRD validation and AppProject hygiene. (#218)
• kotlin (beta) — seven checks: build-tool-manifest-exists, kotlin-version-pinned, min-kotlin-version (configurable, default 1.8), build-tool-wrapper-exists (skips Maven-only), dependencies-locked, test-directory-exists, linter-configured (detekt or ktlint). (#242)

New Catalogers

• backstage-catalog-info-monorepo (beta) — discovers every catalog-info.yaml in a repository (including subdirectories) via one recursive Git Trees API call and creates one Lunar component per file, keyed to the file's directory (monorepo subcomponents). Configurable exclude_paths (defaults to excluding the root file, which the backstage-catalog-info augment cataloger owns), ignore_components (platform hard-control), and gated lunar.io/ignore annotation support (dev-team opt-out). Pairs with backstage-catalog-info and github-org for mixed monorepo + polyrepo fleets. (#243)

Improvements

• backstage cataloger: new AWS SigV4 auth mode (auth_mode=sigv4). Resolves AWS credentials at runtime from the standard chain (IRSA / EKS Pod Identity → ECS task role → EC2 IMDSv2 → static LUNAR_SECRET_AWS_* keys) and re-resolves each run, so short-lived IAM-role creds self-refresh with nothing to rotate. Signs with curl's native --aws-sigv4; zero new dependencies. (#232)
• backstage cataloger: switched to the /catalog/entities/by-query endpoint with cursor pagination, paging through large catalogs instead of a single unpaginated request. (#240)
• backstage policy: required-annotations now validates annotation values, not just presence. A backward-compatible YAML-list form lets each annotation declare a type (string/integer/number/boolean) plus min/max, min_length/max_length, pattern (regex), and enum; malformed constraint specs error instead of silently passing. The legacy comma-separated (presence-only) form is unchanged. (#244)
• backstage-catalog-info cataloger: new meta_annotations input maps selected catalog-info.yaml annotations onto the Lunar component meta field (defaults to pagerduty.com/service-id, so the pagerduty collector and the oncall guardrails behind it resolve a component's service with no per-component config). Also adds ignore_components (platform hard-control) and gated lunar.io/ignore annotation support. (#224, #243)
• trivy + grype collectors: opt-in point-in-time scan history. Each rescan snapshots the current .sca into a bounded .sca.history[] (with a collected_at timestamp) before overwriting, and tracks a monotonic .sca.rescan_count. Two inputs — scan_history_size and max_rescans, both default 0, preserving today's overwrite-only behavior. The SCA policy is unchanged. (#247)

Fixes

• Collector inputs are now read from LUNAR_VAR_<NAME> — the variable the hub actually exposes — instead of LUNAR_INPUT_<NAME>, which was silently ignored, so inputs always fell back to their defaults. Fixed in shell (find_command and shellcheck severity), rust (clippy args), trivy/grype (container-rescan image), and grype (db auto-update). Also cleared pre-existing shellcheck findings in the touched files. (#248)

Other

• backstage cataloger: wired the offline test into CI (earthly +test) and added multi-page cursor-pagination coverage — the fixture no longer matched the by-query response shape, and nothing had exercised paging (follow-up to #240). (#246)
• Changelog housekeeping: reconstructed the [1.6.0] section, added [1.7.0], fixed compare links, and caught up [Unreleased]. (#241)

---

Consumers pin this release with @v1.8.0 in lunar-config.yml. 27 plugin images (base + 24 collectors + 1 cataloger + 1 policy) published to Docker Hub under the *-v1.8.0 tag.

Full diff: v1.7.0...v1.8.0