v2.1.0

Added

• OpenSSF Scorecard analysis workflow (.github/workflows/scorecard.yml).
  Runs weekly on Tuesdays at 06:00 UTC (after the Monday rebuild and cleanup
  workflows), on every push to main, and on branch-protection-rule changes.
  Publishes results to the public OpenSSF API (scorecard.dev viewer) and
  uploads SARIF to the GitHub Security tab. README badge added next to the
  license badge; the badge populates automatically after the first run
  completes on main.
• Weekly Docker Hub Tag Cleanup GitHub Actions workflow
  (.github/workflows/dockerhub-tag-cleanup.yml). Deletes sha-* image tags
  older than 90 days on Mondays at 07:00 UTC (one hour after the publish
  rebuild), preventing unbounded tag accumulation on Docker Hub. Scheduled
  runs auto-delete; manual workflow_dispatch defaults to dry-run for safety.
• scripts/cleanup-legacy-tags.sh: one-shot local cleanup for legacy
  long-SHA (40-char hex) tags from the pre-Phase-1 CI era. Dry-run by default;
  --execute requires typed DELETE confirmation. The 19 target tags are
  hardcoded in the script so the operation is auditable in version control.
• Cosign Verified badge in README linking to the attestations page.

Changed

• README restructured for evaluator-first audience: added "Why this image?"
  comparison table (vs. amazon/aws-cli, bitnami/kubectl, Alpine+scripts),
  added "Getting started" quickstart with three concrete invocations, moved
  "Tag management" up to position 6, moved "Breaking Changes in v2.0" down
  to position 7 (after established context), collapsed the Quick Verification
  one-liner wall under <details>, reordered badges (security before legal),
  added a Table of Contents, and renamed "Prerequisites" to "Mounting
  credentials" for clarity.
• Badge row reordered: usage → size → CI → security → supply-chain → legal.
• Obsolete "Tagging / Versioning Policy" section removed, superseded by the
  newer "Tag management" section, which reflects current tag categories and
  the 90-day sha-* retention policy.
• ABOUT section in README trimmed to a compact maintainer footer (YouTube · Blog · LinkedIn). The Docker CEO recognition video and Scott Johnston quote live in the profile README at github.com/heyvaldemar/heyvaldemar, not duplicated into individual repos.

Removed

• 19 legacy long-SHA image tags from Docker Hub (ranging from ~5 months to
  ~2 years old, all from the pre-Phase-1 CI era). These were never documented
  as stable pins and carried accumulated CVE noise. Current-generation
  consumers use semver tags (:2.0.0, :2.0, :2), floating channels
  (:latest, :edge, :v1-maintenance), the kube-vX.Y.Z pin, or short
  sha-* tags for the last 90 days of builds. Cosign .sig tags were
  preserved.

Fixed

• README: corrected stale claim about actions/attest-build-provenance registry push behavior. The line was introduced in PR #16 when registry push was attempted, but was never updated after PR #20 hotfix flipped push-to-registry: false due to Docker Hub OCI referrer credential handoff issues. README now correctly describes attestations as stored in GitHub Attestations only.
• CI workflow: Install cosign step now skipped on PR builds, mirroring the existing PR-skip pattern on Login to Docker Hub, Attest build provenance, and Sign image with cosign. Removes ~30s of wasted work per PR build and eliminates GitHub releases CDN as a PR-build flake surface (hit a transient 502 on PR #32 requiring a re-run).
• CI workflow: kube-v* tag now only generated on semver tag releases (was
  previously generated on every push, causing Docker Hub immutability conflicts
  after the immutability policy was enabled). Main pushes no longer fail at
  the publish step. The cosign signing step now runs reliably for :latest,
  restoring signatures on floating tags.
• CI workflow: cosign signing step now uses set -euo pipefail and explicit
  per-tag error handling, preventing silent partial signing failures.
• OpenSSF Scorecard publication to api.scorecard.dev, corrected the
  ossf/scorecard-action pin from the annotated tag object SHA (99c09fe)
  to the actual commit SHA (4eaacf0). The previous pin used the tag object
  SHA returned by GitHub's git/refs/tags/... API; Scorecard's
  imposter-commit verification rejected it and refused to publish results,
  blocking README badge activation. v2.4.3 itself is unchanged.
• CI workflow: sha-* tag emission scoped to push and pull_request
  events only. Same root cause as the prior kube-v* and :latest fixes:
  the weekly scheduled rebuild and workflow_dispatch reuse the source SHA
  but produce a fresh image manifest digest (newer base layers), and pushing
  to sha-<X> is rejected by Docker Hub's tag-immutability policy with
  HTTP 403. Surfaced by the 2026-05-04 cron run, which collided with the
  sha-0546ce8 tag pushed earlier the same day by the Dependabot
  github/codeql-action bump (PR #36). Fix mirrors the kube-v* pattern:
  enable=${{ github.event_name == 'push' || github.event_name == 'pull_request' }}.
  PR builds keep emitting the tag for label completeness; push: false keeps
  it out of the registry. Schedule and manual dispatch now only re-tag the
  mutable :latest and :edge channels with fresh base layers, preserving
  the "first push owns the immutable sha-* tag" semantic that downstream
  consumers depend on.

Upgrading

Pull the new tag. Everything above has been on main since it landed and reached nobody following releases — this is the tag it should have had.

Full history in CHANGELOG.md.

v2.0.0 — non-root by default

Breaking change

Container now runs as non-root user (UID 10001, GID 0) by default.

Users mounting volumes or depending on root behavior need to adjust invocations. See the README Breaking Changes section for the full migration guide.

What changed

• Default USER: root (implicit) → 10001:0 (explicit)
• Default WORKDIR: / → /home/app
• Documented mount paths: /root/.aws, /root/.kube → /home/app/.aws, /home/app/.kube
• HOME=/home/app set explicitly so kubectl and AWS CLI caches resolve correctly
• /home/app owned 10001:0 with chmod g=u for OpenShift SCC restricted-v2 compatibility

Why UID 10001, GID 0?

• UID 10001 sits outside the standard user range (1000-9999) to avoid collisions with developer-machine UIDs.
• Primary GID 0 is the OpenShift SCC restricted-v2 pattern — OpenShift assigns random UIDs at runtime but uses GID 0 for file ownership. Works unchanged on vanilla Kubernetes, Docker Desktop, and CI runners.

Migration

CI workflows running one-shot aws or kubectl commands without volume mounts: no change needed.

Docker with volume mounts:

docker run --rm \
  -v ~/.aws:/home/app/.aws \
  -v ~/.kube:/home/app/.kube \
  --user "$(id -u):0" \
  heyvaldemar/aws-kubectl:2.0.0 \
  aws s3 ls

Kubernetes:

spec:
  securityContext:
    runAsUser: 10001
    runAsGroup: 0
    fsGroup: 0

Staying on v1.x

Users who can't migrate immediately can pin to the v1-maintenance floating tag:

docker pull heyvaldemar/aws-kubectl:v1-maintenance

v1-maintenance receives security updates through 2026-07-20 (90 days from release). After that date, the tag is frozen.

Supply-chain verification

Every v2.0 image is signed (Sigstore/Cosign keyless) with SBOM and SLSA provenance attestations.

cosign verify heyvaldemar/aws-kubectl:2.0.0 \
  --certificate-identity-regexp "https://github.com/heyvaldemar/aws-kubectl-docker/.*" \
  --certificate-oidc-issuer "https://token.actions.githubusercontent.com"

Inspect SBOM:

docker buildx imagetools inspect heyvaldemar/aws-kubectl:2.0.0 --format '{{json .SBOM}}'

Pull the image

docker pull heyvaldemar/aws-kubectl:2.0.0

Pinning granularities available: :2.0.0, :2.0, :2, :v2.0.0, or :latest (currently v2.0).

Full changelog

See CHANGELOG.md § 2.0.0 for the complete list of changes across Phases 1, 2, and 3.