v2.27.0
- Record the git author identity and authored timestamp (not the committer) in
pull_requestattestation commits across all providers (#957). - API key rotation: remove the duplicate key ID on failure and include details when rotation fails (#956).
The new base_ref field is rejected by Kosli servers older than kosli-dev/server#5898 (the attestation model is extra="forbid"). Self-hosted users must upgrade their Kosli server before upgrading this CLI, otherwise pull_request attestations will fail validation. Kosli SaaS (app.kosli.com / app.us.kosli.com) is already updated.