Skip to content

v0.2.0

Marketplace
Marketplace

Choose a tag to compare

View all tags
@skil-lock skil-lock released this 08 Jun 09:09
v0.2.0
c7a3b9f
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

v0.2.0 — integrity hardening

Pairs with skil-lock CLI v0.2.0. Closes an integrity gap surfaced by an external security review: a bundled script's body could previously be rewritten without moving the lockfile.

What's new (CLI v0.2.0)

  • Per-bundled-script content digests — a rewritten script body (e.g. scripts/extract.sh) now produces a blocking diff instead of slipping past an unchanged content_hash. Approvals are bound to the new digest, so a stale approval can't be replayed.
  • Signed releases — cosign keyless signatures + SLSA build provenance + SBOMs (verify with cosign verify-blob; see SECURITY.md).
  • Documented detection boundary — the README states exactly what is and isn't gated.
  • Hardening: symlinked/irregular bundle files no longer abort a scan; CI blocks when a skill fails to parse.

Action usage

- uses: skills-lock/skil-lock-action@v0.2.0
  with:
    pin-binary: v0.2.0
    sarif: true   # optional; requires security-events: write

No breaking changes to Action inputs.

Assets 2
Loading