v1.2.0

The rendered diff now covers Kustomizations too, not only HelmReleases. It shows what the git diff hides: remote resources, other Flux sources, shared bases and components, and edited kustomization files.

• helm-diff is renamed flux-diff. helm-diff stays as an identical alias until v2, and existing comments keep updating
• Plain manifest edits are only counted, so Renovate image and chart bumps stay quiet
• CRDs are summarized (served versions, fields added or removed), and the raw diff goes to the run summary
• Secret values are never shown
• New kustomizations input: auto (default), all, none, or a list like remote,source
• New kustomization-skip-kinds input (default Secret)
• A Kustomization that fails to render only raises a warning

No breaking change: existing workflows keep working as they are. The comment is now titled "Rendered Flux diff".

- uses: mydoomfr/gitops-actions/flux-diff@<sha of v1.2.0> # v1.2.0
  with:
    path: clusters/my-cluster
    kustomizations: auto   # or all, none, remote,source

Full Changelog: v1.1.0...v1.2.0

v1.1.0

cve-report can now list severities other than High/Critical, and an added CVE can no longer get lost in a long list.

• New severities input (default Critical,High): the severities listed in detail and counted as fixable
• 🆕 CVEs come first in every table, so max-rows never hides one
• The comment still stops at max-rows, but …and N more now links to the run summary, which has the full list
• README preview: a pinned traefik upgrade

No breaking change: with the default settings, the report stays the same, apart from the 🆕 ordering and the full list in the run summary. The severity label now reads Critical/High.

Full Changelog: v1.0.0...v1.1.0

v1.0.0

First release! 🚀

Composite GitHub Actions that preview what a Flux pull request changes, right in CI, with no cluster:

• helm-diff: real render of every changed HelmRelease, chart n-1 with the old values against chart n with the new values
• flux-images + cve-scan + cve-report: CVE diff of every container image the pull request changes, scanned by grype
• cve-scan + cve-report also work in any repository that builds images
• SOPS-encrypted Helm values rendered with placeholders, no private key needed

See the README to get started.