v0.17.0

What's Changed

• test(release): fail if the action-pin check inspects nothing by @vsolano9 in #432
• test(e2e): cover GrubSetKargs with story 138 by @bferanmi806-sketch in #447
• test(release): remove the dead INSTALL_DIRS derivation and pin the survivor by @kragent66-glitch in #453
• fix(docs): validate ActionSpec claim counts by @tayfuryldz in #452
• docs(hooks): align pre-commit guide with the active gate by @k4its1t in #462
• fix(ci): require every release test to reach a gate by @be-student in #377
• fix(ci): make ShellCheck coverage fail closed by @ITSMERNB in #423
• fix(release): reject unreadable workflows in action pin checks by @mikevillari in #443
• test: isolate release rehearsal output by @armutlutost in #435
• fix(ci): verify pinned action version comments by @QinXi-ai in #454
• fix(release): parse workflow action references as YAML by @mikevillari in #446
• fix(cli): treat empty unanchored audit logs as inconclusive by @LunaMeerkats in #461
• chore(deps): bump the github-actions group with 3 updates by @dependabot[bot] in #439
• chore(deps): bump library/rust from 82150a5 to 9a73a50 by @dependabot[bot] in #437
• chore(deps): bump uuid from 1.26.0 to 1.26.1 in the cargo-minor-patch group by @dependabot[bot] in #438
• fix(setup): require supported Node releases by @LunaMeerkats in #468
• fix(release): allowlist reviewed rehearsal publication lines by @QinXi-ai in #469
• fix(ci): build and smoke-test the shipped container image by @QinXi-ai in #472
• fix(mcp): isolate socket integration tests from process environment by @QinXi-ai in #470

New Contributors

• @tayfuryldz made their first contribution in #452
• @armutlutost made their first contribution in #435

Full Changelog: v0.16.0...v0.17.0