v4.1.0

What's Changed

• Bump @actions/attest from 3.0.0 to 3.1.0 by @bdehamer in #362
• Bump @actions/attest from 3.1.0 to 3.2.0 by @bdehamer in #365
• Add new subject-version input for inclusion in storage record by @bdehamer in #364
• Add storage record content to README by @bdehamer in #366

Full Changelog: v4.0.0...v4.1.0

v4.0.0

All of the capabilities of actions/attest-build-provenance, and actions/attest-sbom have now been folded into actions/attest.

What's Changed

• Bump @actions/core from 2.0.1 to 2.0.2 in the npm-production group by @dependabot[bot] in #323
• Bump tar from 7.4.3 to 7.5.6 by @dependabot[bot] in #333
• Bump @actions/github from 6.0.1 to 7.0.0 by @dependabot[bot] in #324
• Bump @actions/attest from 2.1.0 to 2.2.1 by @dependabot[bot] in #325
• Bump tar from 7.4.3 to 7.5.7 by @dependabot[bot] in #337
• Bump @isaacs/brace-expansion from 5.0.0 to 5.0.1 by @dependabot[bot] in #342
• Consolidate attestation actions by @bdehamer in #346
• ESM Conversion by @bdehamer in #347
• Test suite refactor by @bdehamer in #356
• Bump tar from 7.5.7 to 7.5.9 by @dependabot[bot] in #354
• Bump version in package.json to v4.0.0 by @bdehamer in #360

Full Changelog: v3.2.0...v4.0.0

v3.2.0

What's Changed

• Bump the npm-development group with 3 updates by @dependabot[bot] in #320
• Validate repository org-ownership before storage record creation by @malancas in #328
• Update version to 3.2.0 by @malancas in #334

Full Changelog: v3.1.0...v3.2.0

v3.1.0

What's Changed

• Bump @actions/attest from 1.6.0 to 2.0.0 by @dependabot[bot] in #299
• Bump @actions/core from 1.11.1 to 2.0.1 by @dependabot[bot] in #318
• Create Artifact Metadata Storage Record on registry push by @malancas in #313

New Contributors

• @malancas made their first contribution in #313

Full Changelog: v3...v3.1.0

v3.0.0

What's Changed

• Bump form-data from 4.0.0 to 4.0.4 by @dependabot[bot] in #266
• Bump @sigstore/oci from 0.5.0 to 0.6.0 by @dependabot[bot] in #271
• Upgrade to Node 24 by @salmanmkc / @bdehamer in #276
• Improved checksum parsing by @bdehamer in #280

⚠️ Minimum Compatible Runner Version

v2.327.1
Release Notes

Make sure your runner is updated to this version or newer to use this release.

Full Changelog: v2.4.0...v3.0.0

v2.4.0

What's Changed

• Bump @actions/github from 6.0.0 to 6.0.1 in the npm-production group by @dependabot in #242
• Bump undici from 5.28.5 to 5.29.0 by @dependabot in #246
• Add path to created attestation in a well-known summary file by @kommendorkapten in #252

New Contributors

• @kommendorkapten made their first contribution in #252

Full Changelog: v2...v2.4.0

v2.3.0

What's Changed

• Bump @octokit/request from 8.2.0 to 8.4.1 by @dependabot in #229
• Bump @sigstore/oci from 0.4.0 to 0.5.0 by @bdehamer in #235
  • Adds support for reading the HttpHeaders value from the Docker config file

Full Changelog: v2...v2.3.0

v2.2.1

What's Changed

• Bump undici from 5.28.4 to 5.28.5 by @bdehamer in #208
• Bump @octokit/request-error from 5.0.1 to 5.1.1 by @dependabot in #212
• Bump @octokit/plugin-paginate-rest from 9.1.5 to 9.2.2 by @dependabot in #215
• Bump @actions/attest from 1.5.0 to 1.6.0 by @bdehamer in #217

Full Changelog: v2.2.0...v2.2.1

v2.2.0

What's Changed

• New subject-checksums input param by @bdehamer in #198
• Bump version from 2.1.0 to 2.2.0 by @bdehamer in #201

Full Changelog: v2.1.0...v2.2.0

v2.1.0

What's Changed

• Add attestation-id and attestation-url outputs by @bdehamer in #181
• Update README w/ note about GH plans supporting attestations by @bdehamer in #182

Full Changelog: v2.0.1...v2.1.0