v2.0.0-alpha.2

💥 Breaking Changes

• feat!: suppport scoped executors by @binbin-li in #2302
• feat!: add v2alpha1 CRD by @binbin-li in #2310
• feat!: support providing inline certificate in CR by @binbin-li in #2312
• feat!: add keyless cosign verifier by @binbin-li in #2339
• fix!: override store scopes only when it is a single store by @binbin-li in #2388

🚀 Features

• feat: support reloading executors by CRs by @binbin-li in #2311
• feat: add native ACR auth by @binbin-li in #2323
• feat: support fetching certs from AKV by @binbin-li in #2325
• feat: add cache to registry token by @binbin-li in #2329
• feat: support private registry over TLS by @binbin-li in #2355
• feat: support concurrent executor by @binbin-li in #2420
• feat: support key-based cosign verifier by @binbin-li in #2425
• feat: add akv key provider by @binbin-li in #2432
• feat: add benchmark regression gate and executor benchmarks for Perf test by @charleswool in #2566
• feat: add stores[].plainHttp for HTTP registries by @fseldow in #2582

🐛 Bug Fixes

• fix: fix parsing policy error by @binbin-li in #2337
• fix: fix parsing numeric value from json by @binbin-li in #2338
• fix(logger): default plugin logger to stdout for info/debug/warn by @charleswool in #2521
• fix: executor template inline cert must use {certs: PEM} format by @fseldow in #2670
• fix: strip namespace prefix from artifact in executor scope matching by @fseldow in #2671

🔐 Security

• chore: bump sigstore-go to resolve vulnerability by @akashsinghal in #2448
• chore(ci): resolve scan-vulns CI failures by updating Go, deps, and Trivy by @YitongFeng-git in #2522
• chore: update signing certificate by @fseldow in #2694
• chore: bump golang.org/x/text to solve CVE-2026-56852 by @fseldow in #2740

🎉 New Contributors

• @shizhMSFT made their first contribution in #2331
• @oglok made their first contribution in #2493

Full Changelog: v2.0.0-alpha.1...v2.0.0-alpha.2