v1.7.9

Added

• ClusterFuzzLite/Atheris mutation fuzzing for configuration validation and
  JSON, HTML, and Prometheus serialization boundaries. Includes a compiled
  standalone target, seed corpus, bounded execution, scheduled/PR checks, and
  deterministic regression tests.
• Deterministic tagged-source watchdog-1.7.9.tar.gz release archives,
  SHA256SUMS, and keyless Cosign/Sigstore signature bundles through GitHub
  OIDC. Signatures are verified against the exact release workflow/tag identity
  and issuer before upload. Reruns preserve valid existing assets and repair
  missing uploads without overwriting files.
• Supply-chain regression checks, offline signature/tampering tests, an
  evidence-based OpenSSF Scorecard audit, and fuzzing/signature verification
  documentation.

Security

• Pinned GitHub Actions and the Bash compatibility image to immutable
  revisions; hash-locked CI Python dependencies and verified yq downloads
  before installation.
• Disabled persisted checkout credentials and narrowed workflow token
  permissions. Signing write permissions are limited to the release-signing
  job.
• Expanded Dependabot coverage to CI Python dependencies and all three
  Dockerfile locations. Updated the security policy to identify the current
  supported release through VERSION.

Fixed

• Escaped uncommon JSON control characters below U+0020, fixing a defect
  exposed by fuzzing while preserving existing serialization behavior.
• Restored published changelog history alongside existing local AI-KIT notes
  so release metadata checks retain their version headings.
• Made the Helm default-image regression test derive its expected tag from
  VERSION instead of a stale hard-coded release.

Changed

• Synchronized CLI release metadata, README archive instructions, deployment
  examples, and Helm chart 0.1.1 (appVersion: 1.7.9) for this release.
• Updated release preparation guidance and verified local project context and
  continuity skill. Signing is enabled for new releases containing the workflow;
  existing tags and assets are not retroactively replaced.
• Verified the freshly built v1.7.9 amd64 runtime in an isolated kind 0.30.0 /
  Kubernetes 1.34.0 cluster before publication: finite CronJob success,
  persistent PVC state, no Docker socket access, and invalid-config exit 2.
  Rechecked strict Helm lint and all six chart contract tests; recorded the
  result in local project context and removed the test cluster.

Python / PyPI distribution

• Added the optional shellharbor-watchdog Python 3.11+ distribution for Linux/WSL, with monitor and discovery console/module entrypoints. It bundles the original Bash engine and preserves literal argv, signals, streams, and exit codes. Native/container deployments still do not require Python.
• Added wheel/sdist builds, explicit package-resource allowlists, hash-locked packaging tools, Python 3.11/3.12 launcher tests, and installed-distribution/reproducible-rebuild checks.
• Published shellharbor-watchdog 1.7.9 on PyPI through environment-approved GitHub OIDC Trusted Publishing. File hashes, publisher identities, and a clean non-root Linux install/runtime smoke were verified. No Python runtime dependencies are added; ordinary Watchdog system dependencies are still required.
• Fixed hosted Cosign installation by pinning the official installer v4.1.2, retaining verified Cosign 3.1.3 and integrity checks.

Install on Linux/WSL with Python 3.11+ and Watchdog's system dependencies:

python3 -m venv .venv
.venv/bin/python -m pip install shellharbor-watchdog==1.7.9
.venv/bin/shellharbor-watchdog --version

Release automation publishes the signed archive/checksums and multi-architecture container images separately. Creating this GitHub release does not repeat the completed PyPI upload.

Full changelog: v1.7.8...v1.7.9