v0.6.0

Added

• Every tag gets a GitHub release whose notes are the version's CHANGELOG.md section, the engine level and the fleetlint version it needs, the digest pin and the commands that verify the signature, SBOM and provenance (scripts/release-notes.sh). The signed OCI artifact stays the only asset. Releases for v0.1.0 to v0.5.0 were created after the fact with the same notes.

Changed

• A publish step counts in any workflow not run from a pull request. Every artifact kind is detected in tag-triggered workflows and in workflows run on push, release, schedule, by hand (workflow_dispatch), on create, workflow_run, workflow_call or repository_dispatch; if: guards on the step are not evaluated, since a step that is there publishes eventually. Before, ten kinds (release-files, npm, pypi, crate, gem, maven, nuget, pub, android-app, apple-app) only looked at tag-triggered workflows and missed release-please, semantic-release and changesets, which publish from a push to main. Rehearsals still do not count: --dry-run (and -n for cargo and pub), GoReleaser build, check and --snapshot, and Apple builds (xcodebuild -exportArchive, fastlane gym, flutter build ipa) outside a tag-triggered workflow.
• CI installs fleetlint v0.8.1 (0.8.0 is a source tag without binaries).

---

Engine level 7: needs fleetlint 0.8.0 or newer.

Pin this version in .fleetlint.yaml, by digest from the registry:

catalog: { oci: ghcr.io/fleetlint/catalog@sha256:07014623de14509a2f6257b02f3f215ad6f7431e6a29ea0f1eae682b5a7e83c0 }

or by tag from git: catalog: { version: v0.6.0 }.

As a Go module: go get github.com/fleetlint/catalog@v0.6.0.

Verify the signature of the published artifact:

cosign verify ghcr.io/fleetlint/catalog@sha256:07014623de14509a2f6257b02f3f215ad6f7431e6a29ea0f1eae682b5a7e83c0 \
  --certificate-identity-regexp '^https://github\.com/fleetlint/catalog/\.github/workflows/publish\.yml@refs/tags/v' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com
gh attestation verify oci://ghcr.io/fleetlint/catalog@sha256:07014623de14509a2f6257b02f3f215ad6f7431e6a29ea0f1eae682b5a7e83c0 --repo fleetlint/catalog   # SLSA build provenance

The SPDX SBOM of the tree is attested to the same digest (cosign verify-attestation --type spdxjson).