v0.2.0

Frontend image: ghcr.io/emirb/kernelbuild-buildkit:0.2.0

Pin it in a Kernelfile with:

#syntax=ghcr.io/emirb/kernelbuild-buildkit@sha256:dc8413037049ea824387cbb8461ed9272b1cc18bfaaecf3c427d2293a359580d

Verify with gh attestation verify oci://ghcr.io/emirb/kernelbuild-buildkit:0.2.0 --repo emirb/kernelbuild-buildkit.

Assets: kbuildctl for linux and darwin (amd64, arm64), kbuild-step for linux/amd64 (client mode), and checksums.txt.
Each archive carries build provenance (gh attestation verify <file> --repo emirb/kernelbuild-buildkit, or provenance.intoto.jsonl) and a keyless signature (cosign verify-blob --bundle <file>.sigstore.json <file>).

What's Changed

Changes

• Build(deps): bump codecov/codecov-action from 5 to 7 by @dependabot[bot] in #12
• README: say exactly where the kernel config goes and what it is called by @emirb in #19
• Go 1.27.1 by @emirb in #20
• Build(deps): bump actions/attest-build-provenance from 3 to 4 by @dependabot[bot] in #6
• CI: never cancel a push to main by @emirb in #21
• README: read the Scorecard badge from the current API by @emirb in #22
• Bump golang.org/x/crypto past GO-2026-6303, -6354 and -6355 by @emirb in #24
• Tests for the opt layer, the gateway build path, tree preparation, configure, extraction writes, and base resolution by @emirb in #23
• Release: attach a Sigstore bundle per asset and the provenance statements by @emirb in #25
• Pin every action to a commit SHA by @emirb in #27

Full Changelog: v0.1.1...v0.2.0