Skip to content

v0.1.2 — GHCR container image

Choose a tag to compare

View all tags
@john-broadway john-broadway released this 14 Jun 05:25
v0.1.2
869446d

Proximo 0.1.2 — the GHCR container image lands.

Distribution + supply-chain hardening; no changes to the MCP / A2A surface or behavior.

Added

  • GHCR image — multi-arch (linux/amd64 + linux/arm64) at ghcr.io/john-broadway/proximo, built and pushed by a release workflow. Runs the stdio MCP server on demand (docker run -i --rm … ghcr.io/john-broadway/proximo) — no daemon, no open port. Ships with an SBOM and a sigstore-signed build-provenance attestation:
    gh attestation verify oci://ghcr.io/john-broadway/proximo:0.1.2 --owner john-broadway

Security

  • CI / supply-chain hardening (independent 3-lens review): read-only workflow permissions by default; the publish + signing actions pinned by commit SHA with a Dependabot keeper; allow-list Docker COPY so a local build can't bake stray secrets into the image.
Assets 2
Loading