Skip to content

v5.0.0

Choose a tag to compare

View all tags
@felddy felddy released this 21 Oct 17:07
Immutable release. Only release title and notes can be modified.
v5.0.0
c37b510
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

5.0.0 (2026-10-21)

⚠ BREAKING CHANGES

  • branch protection now requires the single aggregate 'CI Gate / Gate' check produced by ci-gate.yml rather than individual test-job checks whose names changed with the pipeline restructure. Apply with 'make apply-ruleset'.
  • publish: the manifest is pushed under a mutable staging tag and final tags are applied individually. Semver tags (configurable via immutable-tag-pattern) are never repointed to a different digest: identical digests are a no-op so re-runs stay idempotent, and anything else fails unless force-tag-overwrite is set. GHCR has no native tag immutability, so the guard lives here; it complements the version-tag ruleset and immutable releases.
  • the primary caller API is now container-pipeline.yml. It computes metadata and platform/runner matrices once per flavor, detects fork pull requests (build-only, no caller conditionals), gates secret forwarding on the private/pass-build-secrets inputs, and chains build, test, publish, and the opt-in DockerHub release jobs.
  • container-build.yml takes build-matrix, image-labels, image-annotations, and source-date-epoch inputs instead of computing them (its platforms input and metadata-derived outputs are gone); container-test.yml takes test-matrix instead of platforms; container-publish-manifest.yml takes image-tags and no longer runs its own metadata job (image-tags/tag-names/is-latest outputs removed).
  • container-mirror.yml inputs are now image-name, image-tag-names, source-registry, target-registry; dockerhub-description.yml takes image-name, file-path, and docker-hub-username/docker-hub-password (matching container-build's fallback credentials); container-test.yml's registry-token becomes private-package-token with an optional private-package-username, matching build and publish.

Features

  • automate releases with release-please (12ece42)
  • automate releases with release-please (6e573a9)
  • build, test, and publish consume shared state as inputs (16ed24b)
  • build: accept an OpenVEX document for scan suppression (fb00449)
  • build: retry platform builds once on transient failures (71b80d6)
  • build: support authenticated Docker Hub fallback pulls (177994a)
  • container-pipeline orchestrates one flavor end to end (972d07b)
  • deps: add 7-day cooldown to Dependabot version updates (47a55b1)
  • kebab-case inputs and one private-token name everywhere (bf81a03)
  • lint: add actionlint and zizmor pre-commit hooks (8203cee)
  • manage repository rulesets as code (a4e3e36)
  • pipeline: record image digests in release notes (c62af9e)
  • project-config and ci-gate reusable workflows (813e5e7)
  • publish: immutable-tag guard via staged manifest tagging (5c83130)
  • publish: index-level SBOM attestations and verification gate (eb7667c)
  • reconcile floating tags on release edits without rebuilding (ed7c991)
  • require the CI Gate check instead of per-platform tests (c89bfcb)
  • scheduled SBOM rescan replaces daily rebuilds (08a98e7)
  • track workflow-pinned tool versions with Renovate (471f274)
  • track workflow-pinned tool versions with Renovate (00c96a8)

Bug Fixes

  • build: add Trivy vulnerability DB fallback repositories (7075f0f)
  • build: log in to Docker Hub before QEMU and Buildx setup (695cdb2)
  • build: migrate SBOM attestation to actions/attest (2752a5d)
  • build: route docker.io pulls through mirror.gcr.io (96b706f)
  • build: scope write permissions to the jobs that need them (b77d9b3)
  • build: valid presence check for Docker Hub credentials (ae2d88a)
  • compute the next release from the last stable version (f89510b)
  • compute the next release from the last stable version (f2a1d26)
  • deps: upgrade certifi past the emSign root CA advisory (3a91b66)
  • deps: upgrade certifi past the emSign root CA advisory (73c6245)
  • extract SBOM statements from Sigstore bundle attestations (a745419)
  • let admins merge release PRs past the signature rule (cc2ddb8)
  • let admins merge release PRs past the signature rule (7dc82e6)
  • lint: exempt the generated changelog from markdown formatting (5825e75)
  • lint: exempt the generated changelog from markdown formatting (9c8c1a1)
  • map file-path to the action's readme-filepath input (d122e8d)
  • mirror: require referrer parity before skipping or tolerating (10c4f69)
  • pipeline: preserve release-note formatting and survive update races (c2bcbdf)
  • publish: count SBOM attestations against the platform count (3e0db1a)
  • publish: fail closed on tag existence lookup errors (cb32bed)
  • publish: pin signature verification to the publishing workflow (595fb9e)
  • publish: run-unique staging tag; final tags applied from digest (4f88130)
  • publish: verify attestations against the reusable-workflow signer (f6750a7)
  • publish: verify attestations against the reusable-workflow signer (9fe3127)
  • renovate: grant the token issues write for the dashboard (707b2a6)
  • renovate: grant the token issues write for the dashboard (e3bfe47)
  • renovate: grant the token vulnerability-alerts read (ef7e54d)
  • renovate: grant the token vulnerability-alerts read (51228d4)
  • rescan: always check out the caller's scan-policy files (d471dac)
  • rescan: always check out the caller's scan-policy files (1f2a5e1)
  • rescan: fail tag resolution on any manifest fetch error (3bd066b)
  • rescan: include the image in SARIF categories (f274ad7)
  • retag: reconcile channels to their rightful owners (03e9857)
  • workflows: hoist template expressions out of run scripts (5981eec)
  • workflows: stop persisting checkout credentials (ec1e408)

Miscellaneous Chores

  • pin the next release version (f4df5ce)

Container image ghcr.io/felddy/reusable-workflow

ghcr.io/felddy/reusable-workflow@sha256:720f27d228382bcdbe29853e164c8a209ad41daae3f2e7ee096e8ac530bd8520

Verify: gh attestation verify oci://ghcr.io/felddy/reusable-workflow@sha256:720f27d228382bcdbe29853e164c8a209ad41daae3f2e7ee096e8ac530bd8520 --repo felddy/reusable-workflows --signer-repo felddy/reusable-workflows

Container image ghcr.io/felddy/reusable-workflow-hid

ghcr.io/felddy/reusable-workflow-hid@sha256:bbf1c42dc2f57134056f0613e53b07bb65c068ef110afe238dbe5f6679ba60de

Verify: gh attestation verify oci://ghcr.io/felddy/reusable-workflow-hid@sha256:bbf1c42dc2f57134056f0613e53b07bb65c068ef110afe238dbe5f6679ba60de --repo felddy/reusable-workflows --signer-repo felddy/reusable-workflows

Assets 3
Loading