v0.3.0

What changed

Added

• Scan failures are now reported with a reason. When syft cannot pull an
  image, the agent classifies the failure — registry authentication
  (401/403/denied), registry rate limiting (429/TOOMANYREQUESTS), or a generic
  scan error — and reports the code and registry host on its 5-minute
  inventory cycle, so the StackRadar coverage card can say why an image has
  no SBOM instead of "generating SBOMs" forever. Only the code and the host
  leave the cluster, never syft's output; retry behaviour is unchanged, and a
  successful upload clears the reported failure. Works against a StackRadar
  control plane that predates the field too — older servers ignore it.

Fixed

• syft's filesystem cache now lives under the /tmp scratch volume
  (SYFT_CACHE_DIR, overridable). It previously defaulted to /.cache/syft,
  which readOnlyRootFilesystem makes unwritable, so every scan logged
  WARN unable to get filesystem cache before doing anything.

Install

helm install stackradar-scanner oci://ghcr.io/lockdep/charts/stackradar-scanner \
  --version 0.3.0 \
  --namespace stackradar --create-namespace

Artifacts

Artifact	Reference	Digest
Image	ghcr.io/lockdep/stackradar-scanner:0.3.0	sha256:dd8a35d50c2d936727b6d4daccda6471d2260c42403711779173c4fc9dd02292
Chart	oci://ghcr.io/lockdep/charts/stackradar-scanner:0.3.0	sha256:8a1096a4a16c0223e7b14bd706261de852fae7fa0e93bd0375ea6a84b6805b2c

Verify

Both artifacts are signed with cosign keyless
signing. No public key to distribute — the signature is bound to this
repository's release workflow at tag v0.3.0.

cosign verify \
  --certificate-identity-regexp "^https://github.com/lockdep/stackradar-scanner/.github/workflows/release.yaml@refs/tags/" \
  --certificate-oidc-issuer "https://token.actions.githubusercontent.com" \
  ghcr.io/lockdep/stackradar-scanner@sha256:dd8a35d50c2d936727b6d4daccda6471d2260c42403711779173c4fc9dd02292

cosign verify \
  --certificate-identity-regexp "^https://github.com/lockdep/stackradar-scanner/.github/workflows/release.yaml@refs/tags/" \
  --certificate-oidc-issuer "https://token.actions.githubusercontent.com" \
  ghcr.io/lockdep/charts/stackradar-scanner@sha256:8a1096a4a16c0223e7b14bd706261de852fae7fa0e93bd0375ea6a84b6805b2c

The image is built for linux/amd64 and linux/arm64, and carries
SLSA provenance and an SBOM attestation in its index (BuildKit
attestations, readable with imagetools):

docker buildx imagetools inspect ghcr.io/lockdep/stackradar-scanner@sha256:dd8a35d50c2d936727b6d4daccda6471d2260c42403711779173c4fc9dd02292 --format '{{json .Provenance}}'
docker buildx imagetools inspect ghcr.io/lockdep/stackradar-scanner@sha256:dd8a35d50c2d936727b6d4daccda6471d2260c42403711779173c4fc9dd02292 --format '{{json .SBOM}}'

Full Changelog: v0.2.0...v0.3.0