v1.2.40

Verifying artifacts

Checksums: sha256sum -c SHA256SUMS.txt

Signatures (sigstore keyless): every artifact ships a <name>.sig + <name>.bundle pair. Verify with:

cosign verify-blob \
  --bundle <artifact>.bundle \
  --certificate-identity-regexp "https://github\.com/intel-agency/inference-engine-lib/" \
  --certificate-oidc-issuer "https://token\.actions\.githubusercontent\.com" \
  <artifact>

Build provenance (SLSA): gh attestation verify <artifact> -R intel-agency/inference-engine-lib

What's Changed

• ci(publish): OIDC-only push — drop classic-key fallback (MEDIUM-3) by @nam20485 in #68
• ci: wire Codecov — public badge + coverage-API data by @nam20485 in #69
• ci: add least-privilege workflow permissions by @nam20485 in #70
• ci: replace weekly Default Setup with push/PR CodeQL workflow by @nam20485 in #71
• Sync main into development by @nam20485 in #73
• Create scorecard.yml by @nam20485 in #72
• Add OpenSSF Scorecard badge to README by @nam20485 in #74
• Plan: OpenSSF scorecard improvements (6.9 → ~8.7) by @nam20485 in #75
• ci: scorecard batch 1 — CODEOWNERS, SECURITY.md links, CodeQL perms/coverage, signed releases by @nam20485 in #80
• build: Central Package Management (Pinned-Dependencies 6→10) by @nam20485 in #81
• Bump coverlet.collector from 6.0.4 to 10.1.0 by @dependabot[bot] in #61
• build(deps): bump actions/attest-build-provenance from 2.4.0 to 4.2.2 by @dependabot[bot] in #55
• build(deps): bump actions/cache from 4.3.0 to 6.1.0 by @dependabot[bot] in #57
• build(deps): bump actions/upload-artifact from 4.6.1 to 7.0.2 by @dependabot[bot] in #56
• ci: env-map publish version computation; reconcile the remediation log by @nam20485 in #82
• ci: shorten artifact retention (nuget-package, rocm-gpu-test-results: 30d -> 7d) by @nam20485 in #84
• Sync main into development by @nam20485 in #85
• ci: remove NuGet actions/cache steps (org storage quota) by @nam20485 in #86
• security: add secret-scan stack (gitleaks gate + pre-commit + trufflehog weekly sweep) by @nam20485 in #87
• Promote development to main (env-map publish version, OIDC-only, Codecov) by @nam20485 in #83
• build(security): pin NuGet transitive graph via per-rid lock files + locked-mode restore by @nam20485 in #89
• Promote main to release (attested publish path, hardening wave) by @nam20485 in #88
• build(deps): bump peter-evans/find-comment from 3.1.0 to 4.0.0 by @dependabot[bot] in #59
• build(deps): bump peter-evans/create-or-update-comment from 4.0.0 to 5.0.0 by @dependabot[bot] in #58
• ci: install cosign before the release signing step by @nam20485 in #90
• Bump the nuget-minor-patch group with 10 updates by @dependabot[bot] in #60
• ci: scope dependabot to the github-actions ecosystem by @nam20485 in #98
• Promote main to release (cosign install, dependabot scope, locks) by @nam20485 in #99

Full Changelog: v1.2.25...v1.2.40