v0.5.0

Changelog

• 6fefb76 Add Authors section to README, before Contributing (#6)
• 9767d44 Add Cosign keyless signing, SBOMs, and CHANGELOG.md to the release pipeline (#9)
• 360cf83 Add PR-comment and Code Scanning screenshots to README (#8)
• 351ac67 Add Zenodo concept DOI to CITATION.cff and README badge (#5)
• 8f634a1 Add blocked-merge screenshot
• 46c4258 Add blocked-merge screenshot reference to README
• a26a81a Add demo GIF reference to README and its provenance note (#7)
• 5d2d473 Bump action pins, CITATION.cff, and CHANGELOG.md to v0.5.0 (#10)
• 5df16a9 Fix cosign-installer pin: v4 moving tag doesn't exist, pin v4.1.2 (#11)

v0.4.4

Changelog

• cc8b0d3 Add CITATION.cff and gate its version/date-released in release.yml (#2)
• 948c014 Add MG-004 and SARIF rows to PERFORMANCE.md
• 601027e Annotate old spec as historical, point CLAUDE.md to DESIGN.md
• f0ae2f2 Bump action pins and CITATION.cff to v0.4.4 (#4)
• 841a962 Loosen CITATION.cff date-released check to "not in the future" (#3)
• 34e028e Update CLAUDE.md from build plan to current-state reference

v0.4.3

Changelog

• a4aaee6 Bump README pins to v0.4.3
• 3ffdebf Bump stale v0.4.0 pins to v0.4.2, automate the check that would've caught it

v0.4.2

Changelog

• 54bb66a Bump Node 20-flagged actions in release.yml and ci.yml

v0.4.1

Changelog

• c534711 Bump action.yml's Node-based action pins off deprecated Node 20
• 0b69612 Document MG-005–MG-009 as considered and deferred, not a gap
• 6417a3f Fix stale v0.1.0 refs, rule count, and Go version in docs
• 7717dfa Update SECURITY.md
• c19873c Update SECURITY.md

v0.4.0

Changelog

• cb7e736 Add Homebrew tap and multi-arch Docker distribution
• c29731d Create SECURITY.md (#1)

v0.3.0

Changelog

• 809d5f4 Add -version flag, flag dev builds explicitly
• 6fb396d Add golangci-lint (default 5 + gosec) to CI, pinned version
• 12d0e74 Document MG-004 service+provider blocking investigation and rejection
• 5c8a8c1 Split README into README + DESIGN.md; rewrite MG-004 rationale
• 67ea3eb Update README.md

v0.2.0

Changelog

• a8abb3e Add MG-004 (exported components), wired at warning-tier
• 9d0df85 Add SARIF 2.1.0 output for GitHub Code Scanning
• aa78dd1 README: surface the GitHub Action near the top, document workflow scope

v0.1.0

Changelog

• ea13b76 Add GitHub Action wrapper, goreleaser release pipeline, CI
• a2f687e Add README, LICENSE, CONTRIBUTING; repo hygiene for public release
• 58ef531 Add pkg/parser/nsc for network_security_config.xml (MG-002 groundwork)
• 606b3f9 Build MG-002 engine: manifest + network_security_config signals
• c966c05 Build MG-003 (backup exposure) and MG-010 (debug build artifact), wire into CLI
• 8a4ef0a Build baseline mode: gate on regressions, not pre-existing debt
• 377e345 Build-order step 3: scoring, gate decision, finding_hash, output contract
• d60822c Close AndroidManifest.xml recall gap in MG-001; document native-lib scope
• 71a11d9 Close MG-001 fixture gap, add MG-002 acceptance-gate fixtures
• a199f09 Close resources.arsc recall gap in MG-001
• 10602da De-fang non-MG-001 test fixtures; document push-protection policy
• 69b5d71 Fix MG-002 manifest/NSC precedence bug
• 0e82ee6 Fix MG-003 targetSdk tiering and drop deliberate-opt-in framing
• 3f155b0 Pin MG-001 corpus batch 1: 10 varied F-Droid APKs
• f7e3908 Step 1: verified APK/manifest/DEX parsers with oracle tests
• 0183ec9 Step 2: MG-001 hardcoded-secret rule with multi-signal evidence
• 906b97b Tighten private-key-header to require an actual key body
• 801fd91 Verify MG-003's backup-override suppression instead of blindly trusting it
• f82027e Wire .mobilegate.yml policy (mode, baseline path, suppression) + Markdown formatter
• a930a75 Wire MG-002 into the CLI, run against the 10-app corpus