v0.2.0

What's Changed

• feat(release): attest SBOM + vulnerability scan to the source release by @zircote in #464

Full Changelog: v0.1.0...v0.2.0

v0.1.0

What's Changed

• chore: update GitHub Actions to December 2025 latest by @zircote in #1
• chore(deps): bump actions/checkout from 4.2.2 to 6.0.2 by @dependabot[bot] in #14
• chore(deps): bump streetsidesoftware/cspell-action from 6.8.1 to 8.3.0 by @dependabot[bot] in #11
• chore(deps): bump actions/download-artifact from 4.1.8 to 8.0.0 by @dependabot[bot] in #12
• chore(deps): bump actions/upload-artifact from 6.0.0 to 7.0.0 by @dependabot[bot] in #13
• chore(deps): bump the github-actions group with 5 updates by @dependabot[bot] in #10
• ci: bump actions/checkout from 4.2.2 to 6.0.2 by @dependabot[bot] in #21
• ci: bump github/gh-aw from 0.50.7 to 0.51.2 by @dependabot[bot] in #22
• ci: bump github/codeql-action from 3.28.0 to 4.32.4 by @dependabot[bot] in #23
• ci: bump actions/setup-python from 5.6.0 to 6.2.0 by @dependabot[bot] in #24
• ci: bump github/gh-aw from 0.51.4 to 0.51.5 by @dependabot[bot] in #66
• ci: bump actions/setup-node from 4.4.0 to 6.2.0 by @dependabot[bot] in #67
• ci: bump github/gh-aw from 0.51.5 to 0.56.2 by @dependabot[bot] in #182
• ci: bump github/codeql-action from 4.32.4 to 4.32.6 by @dependabot[bot] in #183
• ci: bump astral-sh/setup-uv from 7.3.1 to 7.5.0 by @dependabot[bot] in #296
• ci: bump github/codeql-action from 4.32.6 to 4.33.0 by @dependabot[bot] in #298
• ci: bump softprops/action-gh-release from 2.5.0 to 2.6.1 by @dependabot[bot] in #303
• ci: bump github/gh-aw from 0.56.2 to 0.58.3 by @dependabot[bot] in #306
• ci: bump pnpm/action-setup from 4.2.0 to 5.0.0 by @dependabot[bot] in #414
• ci: bump github/codeql-action from 4.33.0 to 4.34.1 by @dependabot[bot] in #415
• ci: bump actions/setup-node from 6.2.0 to 6.3.0 by @dependabot[bot] in #184
• ci: bump github/gh-aw from 0.58.3 to 0.62.5 by @dependabot[bot] in #421
• ci: bump actions/download-artifact from 8.0.0 to 8.0.1 by @dependabot[bot] in #302
• ci: bump actions/create-github-app-token from 3.0.0.pre.beta.2 to 3 by @dependabot[bot] in #309
• ci: bump astral-sh/setup-uv from 7.5.0 to 7.6.0 by @dependabot[bot] in #416
• ci: bump actions/cache from 5.0.3 to 5.0.4 by @dependabot[bot] in #422
• ci: bump codecov/codecov-action from 5.5.2 to 5.5.3 by @dependabot[bot] in #423
• ci: bump actions/github-script from 8.0.0 to 9.0.0 by @dependabot[bot] in #428
• ci: bump softprops/action-gh-release from 2.6.1 to 3.0.0 by @dependabot[bot] in #429
• ci: bump actions/deploy-pages from 4.0.5 to 5.0.0 by @dependabot[bot] in #431
• ci: bump streetsidesoftware/cspell-action from 8.3.0 to 8.4.0 by @dependabot[bot] in #434
• ci: bump actions/setup-go from 6.3.0 to 6.4.0 by @dependabot[bot] in #435
• feat: constitute attested delivery architecture (Mode B) by @zircote in #438
• ci: add pin-check gate; align workflows with generic templates by @zircote in #439
• ci: bump actions/upload-artifact from 7.0.0 to 7.0.1 by @dependabot[bot] in #430
• ci: bump astral-sh/setup-uv from 7.6.0 to 8.0.0 by @dependabot[bot] in #432
• ci: bump github/gh-aw from 0.62.5 to 0.68.1 by @dependabot[bot] in #436
• ci: bump pnpm/action-setup from 5.0.0 to 6.0.0 by @dependabot[bot] in #433
• ci: bump codecov/codecov-action from 5.5.3 to 6.0.0 by @dependabot[bot] in #437
• docs: remediate all documentation review findings by @zircote in #440
• docs(profile): update activity highlights by @zircote-org-monitor[bot] in #441
• docs: add Diátaxis attested-delivery documentation tree by @zircote in #442
• feat: GitHub-native change-record gate for promote-prod; address bypassed #442 review feedback by @zircote in #444
• docs(profile): refresh profile README; drop swagger-php from profile by @zircote in #445
• docs(skills): bake attested-release learnings into skill definitions by @zircote in #446
• docs(profile): update activity highlights by @zircote-org-monitor[bot] in #447
• ci: bump actions/upload-pages-artifact from 4.0.0 to 5.0.0 by @dependabot[bot] in #448
• ci: bump actions/create-github-app-token from 3.0.0.pre.beta.2 to 3.2.0 by @dependabot[bot] in #449
• ci: bump dependabot/fetch-metadata from 2.5.0 to 3.1.0 by @dependabot[bot] in #452
• ci: bump gitleaks/gitleaks-action from 2.3.9 to 3.0.0 by @dependabot[bot] in #453
• ci: bump aws-actions/amazon-ecr-login from 2.1.5 to 2.1.6 by @dependabot[bot] in #454
• ci: bump codecov/codecov-action from 6.0.0 to 7.0.0 by @dependabot[bot] in #456
• ci: bump github/gh-aw from 0.68.1 to 0.79.9 by @dependabot[bot] in #450
• ci: bump actions/setup-node from 6.3.0 to 6.4.0 by @dependabot[bot] in #451
• ci: bump actions/cache from 5.0.4 to 5.0.5 by @dependabot[bot] in #455
• ci: bump github/codeql-action from 4.34.1 to 4.36.2 by @dependabot[bot] in #457
• ci: bump actions/checkout from 6.0.2 to 6.0.3 by @dependabot[bot] in #458
• feat: gh-attested skill + attested quality-gate workflows by @zircote in #459
• fix(scripts): escape backslashes before pipes (CodeQL alert #1) by @zircote in #460
• fix(gh-attested): expose gate SARIF as artifacts so the attestation seam connects by @zircote in #461
• fix(gh-attested): caller template grants packages:read for sast/trivy by @zircote in #462
• feat: attested quality-gate seam wiring, release process, and Diátaxis docs by @zircote in #463

New Contributors

• @zircote made their first contribution in #1
• @dependabot[bot] made their first contribution in #14
• @zircote-org-monitor[bot] made their first contribution in #441

Full Changelog: https://github.com/zircote/.github/commits/v0.1.0