v2.39.0

New features

• attest sonar: added --sonar-branch flag to support attesting scans that ran on a non-main SonarQube branch; --sonar-branch and --pull-request are mutually exclusive.
• attest jira: Jira project keys specified with --jira-project-key are now trimmed of surrounding whitespace, so comma-separated lists like "ABC, DEF" are accepted without error.
• attest jira: When Jira returns a response indicating credentials were not accepted (e.g. an expired API token), a warning naming the username is printed and the affected issues are reported as "not confirmed" rather than silently as missing. The --assert failure message distinguishes between missing, unconfirmed, and mixed cases.

Improvements

• Added kosliIgnoreDesc to the long descriptions of allow artifact, assert artifact, and all attest subcommands (custom, decision, generic, jira, junit, override, pr-azure, pr-bitbucket, pr-github, pr-gitlab, snyk, sonar).
• attest sonar: improved error message when a scan revision is not found to indicate that only the main branch was searched and suggest passing --sonar-branch if the scan ran on another branch.
• attest jira: invalid project keys are now quoted in the error message for clarity (e.g. ["1AB" "AB-44"]).

What's Changed

• chore: bump Claude review model by @mbevc1 in #1108
• fix: formatting adjustments for docs and Makefile by @mbevc1 in #1107
• test(validation): expect schema-pattern wording for illegal names by @ToreMerkely in #1110
• chore(deps): bump github.com/stretchr/testify from 1.12.0 to 1.12.1 in the go-dependencies group by @dependabot[bot] in #1112
• chore(deps): bump anthropics/claude-code-action from 1.0.193 to 1.0.194 in the github-actions-dependencies group by @dependabot[bot] in #1113
• refactor(ci): make docker image smoke tests table-driven by @sami-alajrami in #1111
• perf: optimise regex patterns compilation by @mbevc1 in #1114
• fix(attest jira): accept --jira-project-key lists written with spaces by @mbevc1 in #1118
• fix(sonar): add --sonar-branch so attest sonar finds scans on non-main branches by @AlexKantor87 in #1119
• chore(deps): bump anthropics/claude-code-action from 1.0.194 to 1.0.195 in the github-actions-dependencies group by @dependabot[bot] in #1121
• chore(deps): bump github.com/open-policy-agent/opa from 1.19.0 to 1.19.1 in the go-dependencies group by @dependabot[bot] in #1120
• chore: add PR labelling by @mbevc1 in #1122
• chore(deps): bump github.com/aws/aws-sdk-go-v2/feature/s3/transfermanager from 0.3.13 to 0.3.14 in the go-dependencies group by @dependabot[bot] in #1124
• chore(deps): bump anthropics/claude-code-action from 1.0.195 to 1.0.196 in the github-actions-dependencies group by @dependabot[bot] in #1126
• chore(deps): bump anthropics/claude-code-action from 1.0.196 to 1.0.199 in the github-actions-dependencies group by @dependabot[bot] in #1128
• chore(deps): bump the go-dependencies group with 9 updates by @dependabot[bot] in #1129
• fix(jira): differentiate rejected token from a missing issue by @mbevc1 in #1125
• chore(deps): bump anthropics/claude-code-action from 1.0.199 to 1.0.200 in the github-actions-dependencies group by @dependabot[bot] in #1131
• chore(deps): bump github.com/aws/smithy-go from 1.27.8 to 1.27.9 in the go-dependencies group by @dependabot[bot] in #1130
• docs: document .kosli_ignore support across commands that fingerprint directories by @sami-alajrami in #1134
• chore(deps): bump anthropics/claude-code-action from 1.0.200 to 1.0.206 in the github-actions-dependencies group by @dependabot[bot] in #1135
• fix(docker): report the real version and tree state in published images by @mbevc1 in #1137
• chore: bump Go version by @mbevc1 in #1136
• chore(deps): bump the go-dependencies group with 9 updates by @dependabot[bot] in #1138

Full Changelog: v2.38.0...v2.39.0