v4.0.0

First tagged release of Hive on the v4 line.

Hive has shipped continuously to GHCR since the v4 line opened — via the moving stable, candidate, edge, and v4-latest tags, plus immutable short-SHA tags. This release does not change that. It establishes a semantic version baseline so that future releases are cut, tagged, and published automatically.

What this release marks

v4.0.0 is the starting point for automated versioning, not a feature boundary. It pins the version the release workflow derives from: every subsequent content-carrying merge to v4 now infers its own bump from the ## Unreleased section of CHANGELOG.md and cuts a release without human involvement.

The major version matches the release line, so a reader can tell at a glance which line a release belongs to.

What ships from here

• Automatic tagging and releases. No maintainer pushes a tag again. release.yml runs after a successful docker.yml build on v4, derives the version, tags, publishes immutable version-tagged images, and cuts the release.
• An SBOM per release. Generated with Syft in SPDX JSON and attached as a downloadable artifact. It is deliberately not an in-image attestation — attaching one changes the image manifest to an OCI index, which previously produced a non-executable binary path under containerd and rootless podman. A CI guard now prevents that from being re-enabled by accident.
• Immutable version tags on ghcr.io/kubestellar/hive, hive-contributor, and hive-hub, retagged from the exact digest the build already verified.

Notes

Channel tags (stable / candidate / edge) are not moved by a release. Channel promotion remains a separate, deliberate policy.

Full documentation: src/docs/releases.md