v3.1.0

What's Changed

• Prepare v3 release by @bdehamer in #697
• Bump js-yaml from 3.14.1 to 3.14.2 by @dependabot[bot] in #749
• Bump tar from 7.5.1 to 7.5.2 by @dependabot[bot] in #753
• Bump glob from 10.4.5 to 10.5.0 by @dependabot[bot] in #754
• Bump @types/node from 24.10.1 to 25.0.2 by @dependabot[bot] in #774
• Bump @actions/attest from 1.6.0 to 2.0.0 by @dependabot[bot] in #736
• Bump @actions/attest from 2.0.0 to 2.1.0 by @dependabot[bot] in #775
• Add support for creating artifact metadata storage records by @malancas in #779

New Contributors

• @malancas made their first contribution in #779

Full Changelog: v3...v3.1.0

v3.0.0

What's Changed

• Adjust node max-http-header-size setting by @bdehamer in #687
• Bump actions/attest from v2.4.0 to v3.0.0 by @bdehamer in #691
  • Bump to node24 runtime
  • Improved checksum parsing
• Bump attest-build-provenance/predicate to v2.0.0 by @bdehamer in #693
  • Bump to node24 runtime by @bdehamer in #692

⚠️ Minimum Compatible Runner Version

v2.327.1
Release Notes

Make sure your runner is updated to this version or newer to use this release.

Full Changelog: v2.4.0...v3.0.0

v2.4.0

What's Changed

• Bump undici from 5.28.5 to 5.29.0 by @dependabot in #633
• Bump actions/attest from 2.3.0 to 2.4.0 by @bdehamer in #654
  • Includes support for the new well-known summary file which will accumulate paths to all attestations generated in a given workflow run

Full Changelog: v2.3.0...v2.4.0

v2.3.0

What's Changed

• Bump actions/attest from 2.2.1 to 2.3.0 by @bdehamer in #615
  • Updates @sigstore/oci from 0.4.0 to 0.5.0

Full Changelog: v2.2.3...v2.3.0

v2.2.3

What's Changed

• Pin actions/attest reference by commit SHA by @bdehamer in #493

Full Changelog: v2.2.2...v2.2.3

v2.2.2

What's Changed

• Bump predicate action from 1.1.4 to 1.1.5 by @bdehamer in #485
  • Bump @actions/attest from 1.5.0 to 1.6.0 by @bdehamer in #484
    • Update buildSLSAProvenancePredicate to populate workflow.ref field from the ref claim in the OIDC token (actions/toolkit#1969)

Full Changelog: v2.2.1...v2.2.2

v2.2.1

What's Changed

• Bump undici from 5.28.4 to 5.28.5 by @dependabot in #457
• Bump @octokit/request-error from 5.0.1 to 5.1.1 by @dependabot in #469
• Bump @octokit/request from 8.2.0 to 8.4.1 by @dependabot in #478
• Bump actions/attest from 2.2.0 to 2.2.1 by @bdehamer in #481
  • Includes @actions/attest v1.6.0

Full Changelog: v2.2.0...v2.2.1

v2.2.0

What's Changed

• Bump actions/attest from v2.1.0 to v2.2.0 by @bdehamer in #449
  • Includes support for now subject-checksums input parameter

Full Changelog: v2.1.0...v2.2.0

v2.1.0

What's Changed

• Update README w/ note about GH plans supporting attestations by @bdehamer in #414
• Add attestation-id and attestation-url outputs by @bdehamer in #415

Full Changelog: v2.0.1...v2.1.0

v2.0.1

What's Changed

• Bump actions/attest from 2.0.0 to 2.0.1 by @bdehamer in #406
  • Deduplicate subjects before adding to in-toto statement

Full Changelog: v2.0.0...v2.0.1