0.17.0 - 2026-08-05
Bug Fixes
-
test: COV-90-S22 lint and rebase onto main aa91e54
-
lab: LAB-H10 port-forward changelog and live capture honesty dac95ca
-
lab: Correct scenario-stub ROOT path (LAB-H02) 671b4d1
-
lab: BLOCKED stubs without dry-run; sync CHANGELOG (LAB-H02) 8a9b8b5
-
lab: Tie churn targets to baseline names (LAB-H03) 260dae0
-
collect: Resync Store after informer widen 9986755
-
rbac: Grant core Events for EventRecorder 34d1380
-
demo: Enable allowPrivateSinks for hero Forgejo (#258)25ab9df
-
demo: Use object-form InventorySinkRef in hero samples (#257)72b2451
-
demo: Headless Forgejo 11 bootstrap (INSTALL_LOCK) (#255)97d175f
-
demo: Wait for Forgejo install UI, not version API (#254)d03290d
-
demo: Wait for Forgejo API before hero bootstrap (#253)bcd21b7
-
metrics: Align labeled Collect label values with Desc 20fc539
-
security: Pin PATH for git exec in exec_git and connection 5eead85
-
demo: Compose git-postgres from git-only Kustomization base (DOC-04) 42231f7
-
e2e: Nudge Target reconcile after inventory sink-ref patch 047bf5d
-
demo: Harden DEMO-01 meta-test and gofmt samples helper 834c590
-
pipeline: Clear govet err shadow in init trial tests 4e402c7
-
pipeline: Refuse empty init namespace scope before write aa42687
Features
-
lab: LAB-H10 quick Kind pprof workflow e0d2caf
-
lab: Add resumable schedule runner (LAB-H02) e18975a
-
lab: Add minimal labeled workload helper (LAB-H03) 040afbd
-
lab: Add report generator and redaction gate (LAB-H06) (#268)7f396a3
-
lab: Add DOC-02 evidence collector layout (LAB-H05) (#266)b7c3c57
-
lab: Add cluster-agnostic preflight with offline fixtures 1fe0e04
-
demo: Add hero-git-only GIF and fix state source (#259)499ab9c
-
demo: Make default path credential-free via hero demo 73acfc9
-
demo: Add demo-up/down task aliases a555a7c
-
pipeline: Init completion trial screen + YAML validation (PIPE-INIT-04) 310d48f
-
pipeline: Truthful init namespace-pattern snapshot (PIPE-INIT-03) 892d2eb
-
pipeline: Consented init attribute sampling + sensitive-kind guard (PIPE-INIT-02) 82e5f16
-
pipeline: Add kollect-pipeline init wizard (PIPE-INIT-01) 794498b
Container image (operator)
ghcr.io/platformrelay/kollect:v0.17.0
Multi-arch (linux/amd64, linux/arm64), Debian bookworm-slim nonroot base (includes git and openssh-client for spec.git.engine: cli).
OCI attestations (SBOM + SLSA provenance) are attached in GHCR and on the repository
Attestations page. Verify the signature:
cosign verify \
--certificate-oidc-issuer https://token.actions.githubusercontent.com \
--certificate-identity-regexp '^https://github.com/PlatformRelay/Kollect/.+' \
ghcr.io/platformrelay/kollect@sha256:44d956c48f5675d7c17ef4f681982d4edb9487aa17b1a9dbfaab604480a8e940Container image (kollect-pipeline)
One-shot CI/CD collection CLI (ADR-0801) — collect inventory from a kubeconfig without installing
the operator. See the pipeline CLI guide.
ghcr.io/platformrelay/kollect-pipeline:0.17.0
Multi-arch (linux/amd64, linux/arm64), distroless static nonroot base. The git snapshot sink
uses the pure-Go go-git engine over HTTPS; git.engine: cli and file:// remotes are not supported
in this minimal image.
cosign verify \
--certificate-oidc-issuer https://token.actions.githubusercontent.com \
--certificate-identity-regexp '^https://github.com/PlatformRelay/Kollect/.+' \
ghcr.io/platformrelay/kollect-pipeline@sha256:68b8011741f3ba80f7359903d9431ef98c25b8627e6e93f622d88d1d8b2cfd14Install (Kustomize)
kubectl apply -f install-crds.yaml
kubectl apply -f install.yamlInstall (Helm — OCI)
helm upgrade --install kollect oci://ghcr.io/platformrelay/kollect \
--version 0.17.0 \
--namespace kollect-system \
--create-namespace \
--set image.repository=ghcr.io/platformrelay/kollect \
--set image.tag=v0.17.0Install (Helm — GitHub Release tarball)
helm upgrade --install kollect kollect-0.17.0.tgz \
--namespace kollect-system \
--create-namespace \
--set image.repository=ghcr.io/platformrelay/kollect \
--set image.tag=v0.17.0Verify checksums with sha256sum -c checksums.txt. Each release asset includes a
<file>.sigstore.json Sigstore bundle; release-provenance.intoto.jsonl attests all assets.
See docs/RELEASE.md.