Release v2.0.2

Changes since v2.0.1

• Merge pull request #3 from middt/main (f10e96d)
• Merge pull request #2 from middt/f/test-branch (fb2638c)
• Update readme file (f20eebd)
• Added sign image (c5bd2dd)
• Merge pull request #1 from middt/auto-update-test (3530d55)
• Auto merge from main [skip ci] (57137a3)
• Auto merge from main [skip ci] (aea24d0)
• Auto merge from main [skip ci] (addca8d)
• Create auto-update.md (54be035)

Docker Images

Immutable digest (preferred for trust)

Tags can move; this digest cannot. Signatures and provenance refer to this reference.

• ghcr.io/middt/test@sha256:89a2144a4be4cd394dba0c093f4387308fc8437bf4b98e1bc8f4b273939c745f

Tags (convenience)

• ghcr.io/middt/test:v2.0.2
• ghcr.io/middt/test:v2.0-latest

Supply chain

• OCI provenance & SBOM: pushed with the image (BuildKit provenance: mode=max, sbom: true).
• GitHub build provenance: artifact attestation for this workflow run (identity, repo, workflow ref).
• Cosign signature: image signed by digest with keyless OIDC (see verify below).

Usage

docker pull ghcr.io/middt/test:v2.0.2
docker run -p 8080:8080 ghcr.io/middt/test:v2.0.2

Verify Cosign signature (digest)

cosign verify \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  ghcr.io/middt/test@sha256:89a2144a4be4cd394dba0c093f4387308fc8437bf4b98e1bc8f4b273939c745f

Tighten --certificate-identity-regexp to your workflow path if you pin policy to this repository.

What's Changed

• Create auto-update.md by @middt in #1
• Update readme file by @middt in #2
• test by @middt in #3

New Contributors

• @middt made their first contribution in #1

Full Changelog: v2.0.1...v2.0.2