v1.78.2

sluis v1.78.2

Image	ghcr.io/truvity/sluis/sluis:1.78.2
Sidecar image	ghcr.io/truvity/sluis/resource-proxy:1.78.2
Module images	ghcr.io/truvity/sluis/sluis-{issuer,github,slack,google,cloudflare,backup}:1.78.2
Chart	oci://ghcr.io/truvity/charts/sluis:1.78.2
TypeScript	@truvity/sluis@1.78.2 on GitHub Packages
Go	go get github.com/truvity/sluis@v1.78.2

The TypeScript package is published to GitHub Packages at this
version; installing it needs a token that can read packages
(docs/sdk/typescript/sluis.md). The Go module at
this tag is the policy engine, identity and tokens; authz and
directory are not built yet, and docs/sdk/go/sluis.md says
so.

The Lambda zips are one per module, each holding bootstrap built for that module and
refusing to run as another: sluis-issuer_1.78.2_linux_arm64.zip (the issuer, the
signer and the console),
sluis-github_1.78.2_linux_arm64.zip,
sluis-slack_1.78.2_linux_arm64.zip, sluis-google_1.78.2_linux_arm64.zip,
sluis-cloudflare_1.78.2_linux_arm64.zip and
sluis-backup_1.78.2_linux_arm64.zip (deployed as the backup and the restore
function). The single sluis-lambda zip is no longer published
(docs/reference/sluis/lambda.md). The telemetry layer is
otlp-lambda-layer_<version>_linux_<arch>.zip from truvity/observability;
sluis ships none.

sluisctl is its own archive, because it is the one thing here that
runs on somebody's own laptop.

Changelog

Bug Fixes

• 75f0747: fix(console): Re-check finds a GitHub App installed directly on GitHub (@excavador)
• 1d5a58d: fix(chart): SluisTickStale ignores series that stopped reporting (@excavador)
• 181a3d6: fix(deploy): hold a key's aliases to its administrators (@excavador)
• c8491c1: fix(audit): report an existing archive bucket without the lock guard (@excavador)
• 7859adf: fix(issuer): check the Google sign-in's nonce and pin an address to its sub (@excavador)
• 23beb83: fix(issuer,github): name the fields of an auth request error; warn once on unconsumed groups (@excavador)
• d3a01ea: fix(issuer): sanitise a request's values in the auth request line (@excavador)
• 74bc21b: fix(issuer): log the auth request error as sanitised fields, not as a value (@excavador)
• 5e39ce5: fix(issuer): sanitise the auth request error code too (@excavador)
• e221ac1: fix(telemetry): token route, zero-primed counters, Lambda init and AWS call panels (@excavador)
• 9de752e: fix(deps): update module github.com/truvity/cnpg/v2 to v2.35.0 (@truvity-renovate-public-roster[bot])

Other

• fe97e4f: style(console): shorten the re-check test lines and lowercase the log message (@excavador)
• 204fee6: ci: ci-workflows v5.4.0; Go build and module caches on the hosted runners (@excavador)
• 06ce157: ci(release): publish only a commit on master whose CI passed (@excavador)
• 54d7097: test(issuer): keep the auth request level cases under the line limit (@excavador)