v1.0.2

Security patch release. Remediates: GHSA-hrxh-6v49-42gf (google.golang.org/grpc, high), GO-2026-5942 (golang.org/x/net, low), GO-2026-5970 (golang.org/x/text, low).

v1.0.1

What's Changed

• Separate signing and attestation from image builds by @jonasz-lasut in #34 to achieve stable certificate identity - https://github.com/jonasz-lasut/provider-upjet-harbor/.github/workflows/supplychain.yaml@refs/heads/main

Full Changelog: v1.0.0...v1.0.1

v1.0.0

Highlights

• Upstream Harbor Terraform provider updated v3.12.0 → v3.12.1, adding a new Project field and dropping two fields that can't be represented as Crossplane state.
• Supply-chain hardening: released images are now signed and attested (SBOM + SLSA provenance) via Cosign, and a weekly Grype scan checks the latest release for new CVEs.
• Go toolchain bumped to 1.26.5 and CI dependencies (golangci-lint, GitHub Actions, kind, docker buildx) refreshed via Renovate.

Upstream provider update

• Harbor Terraform provider bumped to v3.12.1 (TERRAFORM_PROVIDER_VERSION).
• Project: added proxyCacheLocalOnNotFound — serve images from the local cache when they've been removed from the upstream registry (requires Harbor v2.15.1+).
• Config (Auth): dropped oidc_client_secret_wo / oidc_client_secret_wo_version from the generated schema. These are Terraform write-only fields with no state to read back, so they can't be represented as a Crossplane resource field.
• internal/clients: updated the buildHarborSetup call site for the new upstream client constructor signature.

Supply chain / release hardening

• Image signing & attestation — publish-provider-package.yml now signs both the GHCR image and the Upbound registry mirror with Cosign, generates an SPDX SBOM with Syft, and attests both the SBOM and SLSA provenance to each image.
• Registry mirroring enabled — provider packages are now also mirrored to xpkg.upbound.io (mirror: true), gated behind new id-token / packages / attestations workflow permissions.
• Marketplace packaging — a new attach-extensions job appends the README, an icon, and the release notes to the published xpkg as Upbound Marketplace extensions.
• Scheduled vulnerability scanning — a new weekly Grype scan (grype-scan.yaml, Mondays 05:00 UTC) scans the latest published release image and uploads results to GitHub code scanning.

CI / tooling maintenance

• Go toolchain: 1.25.9 → 1.26.5.
• golangci-lint: v2.12.1 → v2.12.2.
• GitHub Actions: actions/checkout → v7, actions/setup-go → v7, actions/cache → v6, codecov/codecov-action → v7, plus digest bumps for docker/setup-buildx-action and docker/setup-qemu-action.
• docker/buildx → v0.35.0, kubernetes-sigs/kind → v0.32.0, k8s.io/utils digest bump.
• Removed the ad hoc publish-artifacts job from ci.yml — artifact building/publishing is now handled entirely by the dedicated, signed publish-provider-package.yml workflow.
• Removed the unused backport.yml workflow.

Compatibility / upgrade notes

• Backward compatible — no breaking API changes. proxyCacheLocalOnNotFound is purely additive; the two dropped write-only Auth fields were never populated in Crossplane state, so no existing Config resources reference them.
• Requires Harbor v2.15.1+ to make use of the new proxyCacheLocalOnNotFound field on Project.
• Building from source now requires Go ≥ 1.26.5.

Full Changelog: v0.2.1...v1.0.0

v0.2.1

What's Changed

• CVE mitigation and change of base image by @jonasz-lasut in #4

Full Changelog: v0.2.0...v0.2.1

v0.2.0

Highlights

• Cluster-scoped managed resources are now available. Every Harbor resource can be managed at cluster scope (harbor.crossplane.io) in
  addition to the existing namespaced scope (harbor.m.crossplane.io), bringing the provider in line with the dual-scope layout used by
  official Upjet providers.
• Upstream Harbor Terraform provider updated from v3.11.6 → v3.12.0.

⬆️ Upstream provider update

• Harbor Terraform provider bumped to v3.12.0 (TERRAFORM_PROVIDER_VERSION).
• Corrected the oidcClientSecretSecretRef field documentation on Auth ("secert" → "secret").

⚙️ Compatibility / upgrade notes

• Backward compatible — existing namespaced (harbor.m.crossplane.io) resources are unchanged. The cluster-scoped CRDs are additive.
• After upgrading, apply the new cluster-scoped CRDs and a cluster-scoped ProviderConfig before creating cluster-scoped resources.

✨ Cluster-scoped resources (new)

All 20 managed resources previously available only as namespaced types are now also generated as cluster-scoped CRDs (scope: Cluster), mirroring the namespaced set one-for-one:

API group	Kinds
harbor.crossplane.io	Group, Label, Project, Registry, Replication, Tasks, User
config.harbor.crossplane.io	Auth, Security, System
project.harbor.crossplane.io	MemberGroup, MemberUser, Webhook
garbage.harbor.crossplane.io	Collection
immutable.harbor.crossplane.io	TagRule
interrogation.harbor.crossplane.io	Services
preheat.harbor.crossplane.io	Instance
purge.harbor.crossplane.io	AuditLog
retention.harbor.crossplane.io	Policy
robot.harbor.crossplane.io	Account

• Cross-resource references (e.g. Replication → Registry, project members → Project/Group/User) and the harbor_registry /
  harbor_replication registryId (*int64) handling carry over identically to the cluster scope.

🧱 Internal / structural changes

• Adopted the upstream Upjet dual-scope configuration layout:
  • config/provider.go (cluster) and config/provider_namespaced.go (namespaced) entrypoints.
  • Per-scope configure registries aggregated under config/cluster and config/namespaced (configuration.go + provider.go).
• cmd/provider/main.go now registers the cluster APIs with the manager and resolver schemes and starts the cluster controllers (both
  gated and non-gated paths).
• The generated *int64 registryId resolver patch now applies to both the cluster and namespaced harbor API groups.
• Fixed goimports local-prefixes in .golangci.yml to the provider's module path.

📚 Examples

• Added examples/cluster/ — a full mirror of examples/namespaced/ (21 manifests incl. e2e-full.yaml) adapted for cluster scope:
  harbor.crossplane.io API versions, no metadata.namespace, and an explicit namespace: crossplane-system on every *SecretRef.
• Added examples/cluster/providerconfig/ (cluster-scoped ProviderConfig + secret template).

Full Changelog: v0.1.0...v0.2.0

v0.1.0

What's Changed

• Initial release by @jonasz-lasut in #1
• Add full E2E test for regression testing on terraform provider updates by @jonasz-lasut in #2

New Contributors

• @jonasz-lasut made their first contribution in #1

Full Changelog: https://github.com/jonasz-lasut/provider-upjet-harbor/commits/v0.1.0