Skip to content

TeslaSync v2.0.20

Choose a tag to compare

View all tags
@github-actions github-actions released this 14 Sep 02:17
· 24 commits to main since this release
v2.0.20
0e62303
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

🚀 TeslaSync v2.0.20

📦 Docker Images

# Backend API
docker pull ghcr.io/ev-dev-labs/teslasync-api:2.0.20

# Web Frontend
docker pull ghcr.io/ev-dev-labs/teslasync-web:2.0.20

# Notification Worker
docker pull ghcr.io/ev-dev-labs/teslasync-notification-worker:2.0.20

# Export Worker
docker pull ghcr.io/ev-dev-labs/teslasync-export-worker:2.0.20

# Automation Worker
docker pull ghcr.io/ev-dev-labs/teslasync-automation-worker:2.0.20

# Fleet Telemetry (event-time preserving)
docker pull ghcr.io/ev-dev-labs/teslasync-fleet-telemetry:2.0.20

⎈ Helm Chart

helm install teslasync oci://ghcr.io/ev-dev-labs/charts/teslasync --version 2.0.20

🔐 Image Verification

All images are signed with cosign (keyless, via GitHub OIDC), ship a CycloneDX SBOM attestation, and carry SLSA build provenance:

# Verify image signature
cosign verify ghcr.io/ev-dev-labs/teslasync-api:2.0.20 \
  --certificate-identity-regexp="github.com/ev-dev-labs/teslasync" \
  --certificate-oidc-issuer="https://token.actions.githubusercontent.com"

# Verify + extract SBOM attestation
cosign verify-attestation \
  --type cyclonedx \
  --certificate-identity-regexp="github.com/ev-dev-labs/teslasync" \
  --certificate-oidc-issuer="https://token.actions.githubusercontent.com" \
  ghcr.io/ev-dev-labs/teslasync-api:2.0.20 \
  | jq -r '.payload' | base64 -d | jq '.predicate' > sbom.cdx.json

# Verify SLSA build provenance (proves WHICH workflow built these bytes)
gh attestation verify \
  oci://ghcr.io/ev-dev-labs/teslasync-api:2.0.20 \
  --repo ev-dev-labs/teslasync

See docs/operations/release-verification.md for the full verification procedure.

🛡️ Vulnerability status

Scanned with Trivy at build time (fixable findings only; policy in ops/release/supply-chain.yaml). A release is blocked on any fixable CRITICAL.

Image Critical High Medium
api 0 0 2
web 0 9 17
notification-worker 0 0 2
export-worker 0 0 2
fleet-telemetry 0 2 3
automation-worker 0 0 2

📝 Changes

Full Changelog: v2.0.19...v2.0.20

📋 Assets

Asset Tag
Backend Image ghcr.io/ev-dev-labs/teslasync-api:2.0.20
Web Image ghcr.io/ev-dev-labs/teslasync-web:2.0.20
Notification Worker ghcr.io/ev-dev-labs/teslasync-notification-worker:2.0.20
Export Worker ghcr.io/ev-dev-labs/teslasync-export-worker:2.0.20
Automation Worker ghcr.io/ev-dev-labs/teslasync-automation-worker:2.0.20
Fleet Telemetry ghcr.io/ev-dev-labs/teslasync-fleet-telemetry:2.0.20
Helm Chart oci://ghcr.io/ev-dev-labs/charts/teslasync:2.0.20

Contributors

atul
Assets 2
Loading