v0.17.0

🚀 Features

• feat: support CI/CD login from Forgejo Actions (Codeberg) @Blacks-Army (#580)
• ssh-agent off by default @EthanHeilman (#626)
• feat: add GitLab CI provider support @cgroschupp (#559)
• fix(verify): Rejects unsafe principals in authorized_keys @EthanHeilman (#597)
• Warn when a policy row matches on an unverified email @arpitjain099 (#594)
• Support sshd_session_t SELinux domain in installer @ozan956 (#614)
• login: load certificate into ssh-agent with configurable lifetime @sini (#611)
• policy/plugins: marshal GROUPS and AUD env JSON with encoding/json @SashaMIT (#601)

🐛 Bug Fixes

• fix(verify): Rejects unsafe principals in authorized_keys @EthanHeilman (#597)
• fix: Policy footguns @EthanHeilman (#596)
• fix: Regression test for --private-key-file arg higher precedence over ~/.ssh/opkssh @EthanHeilman (#592)
• Accept a string email_verified claim in the plugin env vars @arpitjain099 (#595)
• Deny malformed oidc policy rows instead of panicking @arpitjain099 (#593)

Chores

• dep: Update to OpenPubkey v0.27.0 @EthanHeilman (#598)
• fix(deps): Update release-drafter/release-drafter action to v7.7.0 @renovate[bot] (#590)
• fix(deps): Update actions/setup-go action to v7 @renovate[bot] (#578)
• fix(deps): Update release-drafter/release-drafter action to v7.6.0 @renovate[bot] (#581)
• [fix] Windows linter errors @EthanHeilman (#577)
• fix(deps): Update zizmorcore/zizmor-action action to v0.6.0 @renovate[bot] (#575)
• fix(deps): Update Docker @renovate[bot] (#568)
• Bump testcontainers-go to 0.43.0 @EthanHeilman (#571)
• Update CLI documentation @github-actions[bot] (#627)
• fix(deps): Update dependency ubuntu to v26 @renovate[bot] (#616)
• chore(deps): bump github.com/moby/go-archive from 0.2.0 to 0.3.0 @dependabot[bot] (#608)
• fix: reject empty identity attributes in policy @SashaMIT (#603)
• fix(deps): Update go toolchain directive to v1.26.6 @renovate[bot] (#605)