0.39.0

Release Summary

Docker adds image build-provenance attestations, pins the installed Docker version, updates BuildKit and Buildx, and supports pull-request image-tag cleanup for user-owned packages.

Helm adds a dedicated chart-signing action and configurable test namespaces, while fixing dependency vulnerabilities in documentation generation.

Internal maintenance refreshes dependencies, development tooling, and documentation, and fixes CI linting and Helm fixture security failures.

Breaking changes

docker-build-images now requires attestations: write, and build-secret GitHub App tokens are restricted to contents: read on the calling repository by default; configure build-secret-github-app-repositories for additional repositories and supply separately scoped credentials through build-secrets for broader permissions.

helm/release-chart now signs charts by default: callers must grant id-token: write or explicitly set sign: "false".

What's Changed

• chore(deps): bump the github-actions-dependencies group across 4 directories with 8 updates by @dependabot[bot] in #866
• chore(deps): bump the npm-dependencies group across 1 directory with 2 updates by @dependabot[bot] in #865
• chore(deps): bump int128/docker-build-cache-config-action from 1.61.0 to 1.62.0 in /actions/docker/build-image in the github-actions-dependencies group across 1 directory by @dependabot[bot] in #868
• chore(deps): bump prettier from 3.9.4 to 3.9.5 in /actions/helm/generate-docs in the npm-dependencies group across 1 directory by @dependabot[bot] in #867
• chore(deps): bump body-parser from 2.2.2 to 2.3.0 in /actions/helm/generate-docs by @dependabot[bot] in #870
• chore(deps): bump fast-uri from 3.1.2 to 3.1.4 in /actions/helm/generate-docs by @dependabot[bot] in #878
• chore(deps): bump linkify-it from 5.0.1 to 5.0.2 in /actions/helm/generate-docs by @dependabot[bot] in #877
• chore(deps): bump hono from 4.12.25 to 4.12.32 in /actions/helm/generate-docs by @dependabot[bot] in #876
• chore(deps): bump markdownlint-cli2 from 0.23.0 to 0.23.1 in /actions/helm/generate-docs in the npm-dependencies group across 1 directory by @dependabot[bot] in #874
• chore(deps): bump brace-expansion from 5.0.6 to 5.0.8 in /actions/helm/generate-docs by @dependabot[bot] in #871
• chore(deps): bump prettier from 3.9.5 to 3.9.6 in /actions/helm/generate-docs in the npm-dependencies group across 1 directory by @dependabot[bot] in #880
• chore(deps): bump the helm-dependencies group across 2 directories with 1 update by @dependabot[bot] in #873
• chore(deps): bump the github-actions-dependencies group across 1 directory with 2 updates by @dependabot[bot] in #879
• chore(deps): bump ip-address from 10.2.0 to 10.4.0 in /actions/helm/generate-docs by @dependabot[bot] in #881
• fix(helm/generate-docs): npm audit issues by @neilime in #883
• feat(helm/test-chart): add namespace input for test releases by @neilime in #882
• chore: improve devx setup by @neilime in #885
• docs: update Helm chart documentation for charts by @hoverkraft-bot[bot] in #886
• chore(deps): bump the github-actions-dependencies group across 5 directories with 5 updates by @dependabot[bot] in #884
• docs: update actions and workflows documentation by @hoverkraft-bot[bot] in #887
• feat(docker/setup): bump version for Buildkit and Buildx by @neilime in #888
• docs: update actions and workflows documentation by @hoverkraft-bot[bot] in #889
• feat(docker)!: add attest-images action for container image build provenance attestation by @neilime with @Copilot in #864
• docs: update actions and workflows documentation by @hoverkraft-bot[bot] in #891
• chore(deps): bump the github-actions-dependencies group across 2 directories with 2 updates by @dependabot[bot] in #892
• docs: update actions and workflows documentation by @hoverkraft-bot[bot] in #893
• chore(deps): bump ghcr.io/devcontainers/features/github-cli from 1.1.0 to 1.1.1 by @dependabot[bot] in #894
• chore(deps): bump int128/docker-build-cache-config-action from 1.64.0 to 1.66.0 in /actions/docker/build-image in the github-actions-dependencies group across 1 directory by @dependabot[bot] in #895
• chore(deps): bump the github-actions-dependencies group across 3 directories with 3 updates by @dependabot[bot] in #897
• docs: update actions and workflows documentation by @hoverkraft-bot[bot] in #898
• chore(deps): bump ghcr.io/devcontainers/features/docker-in-docker from 4.0.0 to 4.1.0 by @dependabot[bot] in #896
• feat(workflows/prune-pull-requests-images-tags): support user-owned p… by @neilime in #899
• feat(docker): pin installed docker version by @neilime in #806
• docs: update actions and workflows documentation by @hoverkraft-bot[bot] in #902
• chore(deps): bump ghcr.io/devcontainers/features/github-cli from 1.1.1 to 1.1.2 by @dependabot[bot] in #901
• chore(deps): bump fast-uri from 3.1.5 to 3.1.7 in /actions/helm/generate-docs by @dependabot[bot] in #903
• chore(deps): bump the helm-dependencies group across 2 directories with 1 update by @dependabot[bot] in #904
• docs: update Helm chart documentation for charts by @hoverkraft-bot[bot] in #905
• chore(deps): bump the github-actions-dependencies group across 4 directories with 6 updates by @dependabot[bot] in #906
• chore(deps): bump yaml from 2.9.0 to 2.9.1 in /actions/helm/release-chart in the npm-dependencies group across 1 directory by @dependabot[bot] in #909
• chore(deps): bump the github-actions-dependencies group across 3 directories with 5 updates by @dependabot[bot] in #912
• chore(deps): bump the devcontainers-dependencies group with 2 updates by @dependabot[bot] in #910
• chore(deps): bump js-yaml from 4.3.1 to 4.3.2 in /actions/helm/generate-docs by @dependabot[bot] in #911
• chore(deps): bump prettier from 3.9.6 to 3.9.8 in /actions/helm/generate-docs in the npm-dependencies group across 1 directory by @dependabot[bot] in #913
• fix(ci): resolve lint and Helm fixture security failures by @neilime in #915
• fix(docker-build-images)!: restrict build-secret GitHub App tokens by @neilime in #914
• docs: update Helm chart documentation for charts by @hoverkraft-bot[bot] in #916
• docs: update actions and workflows documentation by @hoverkraft-bot[bot] in #917
• feat(helm)!: add sign-chart action by @neilime in #918
• docs: update actions and workflows documentation by @hoverkraft-bot[bot] in #919
• chore(deps): bump prettier from 3.9.8 to 3.9.9 in /actions/helm/generate-docs in the npm-dependencies group across 1 directory by @dependabot[bot] in #921
• chore(deps): bump the devcontainers-dependencies group with 3 updates by @dependabot[bot] in #920

Full Changelog: 0.38.0...0.39.0