Skip to content

Releases: github-community-projects/ospo-reusable-workflows

Release list

v2.3.1

v2.3.1 Latest
Latest

Choose a tag to compare

View all tags
@github-actions github-actions released this 16 Oct 05:09
v2.3.1
ee8277b
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Note

Callers still on pull_request_target: releases now target the merge commit. Release notes and version bumps stop at the pull request's merge commit, which closes a race when another pull request merges first. A release targeting a commit SHA cannot use filter-by-commitish: true, on this trigger or on push. Callers that set it get wrong notes and versions, so remove the input.

Changelog

🐛 Bug Fixes

  • fix(release): release from the merge commit on pull_request_target @jmeridth (#218)

🧰 Maintenance

  • docs: add SHA pinning guidance with version comment @jmeridth (#221)
  • ci: move remaining workflows off pull_request_target @jmeridth (#217)
  • chore(deps): bump goreleaser/goreleaser-action from 7.2.3 to 7.3.0 in the dependencies group @dependabot[bot] (#219)

See details of all code changes since previous release

Contributors

jmeridth
Assets 2
Loading

v2.3.0

v2.3.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 13 Oct 06:34
v2.3.0
3e055d5
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Note

Optional: release on push instead of pull_request_target. Updating the pinned SHA alone changes nothing. To drop pull_request_target, which the OSPS Baseline scanner flags under OSPS-BR-01.03, change your release workflow's trigger:

on:
  workflow_dispatch:
  push:
    branches: [main]
concurrency:
  group: release
  cancel-in-progress: false

Push runs release only from the default branch. If you switch, don't set filter-by-commitish: true in your release-drafter config. For the auto-labeler, use pull_request and skip fork PRs; see Auto-labeler: Triggering. Full details: Triggering a release.

Changelog

🚀 Features

  • feat(release): support releasing on push so callers can drop pull_request_target @jmeridth (#213)

🧰 Maintenance

  • chore(deps): bump the dependencies group with 5 updates @dependabot[bot] (#211)
  • chore(deps): bump step-security/harden-runner from 2.21.1 to 2.22.0 in the dependencies group @dependabot[bot] (#210)
  • chore(deps): bump anchore/sbom-action/download-syft from 0.24.2 to 0.24.3 in the dependencies group @dependabot[bot] (#209)

See details of all code changes since previous release

Contributors

jmeridth
Loading

v2.2.0

v2.2.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 03 Oct 02:26
v2.2.0
690dbbe
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Changelog

🚀 Features

  • feat(release): list every pull request on a repository's first release @jmeridth (#206)

🧰 Maintenance

  • chore(deps): bump mikefarah/yq from 4.53.6 to 4.54.1 in the dependencies group @dependabot[bot] (#207)

See details of all code changes since previous release

Contributors

jmeridth
Loading

v2.1.1

v2.1.1

Choose a tag to compare

View all tags
@github-actions github-actions released this 01 Oct 16:03
v2.1.1
038160c
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Changelog

🐛 Bug Fixes

  • fix(release): check the release tag before creating a draft @jmeridth (#204)

🧰 Maintenance

See details of all code changes since previous release

Contributors

jmeridth
Loading

v2.1.0

v2.1.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 22 Sep 17:49
v2.1.0
a48c75f
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Changelog

🚀 Features

  • feat(release): add version-file input to read the release version from a file @jmeridth (#200)

🧰 Maintenance

  • chore(deps): bump the dependencies group with 2 updates @dependabot[bot] (#199)
  • chore(deps): bump step-security/harden-runner from 2.21.0 to 2.21.1 in the dependencies group @dependabot[bot] (#198)
  • chore(deps): bump anchore/sbom-action/download-syft from 0.24.0 to 0.24.2 in the dependencies group @dependabot[bot] (#197)
  • chore(deps): bump mikefarah/yq from 4.53.4 to 4.53.6 in the dependencies group @dependabot[bot] (#196)
  • chore(deps): bump mikefarah/yq from 4.53.3 to 4.53.4 in the dependencies group @dependabot[bot] (#195)
  • chore(deps): bump docker/setup-buildx-action from 4.2.0 to 4.3.0 in the dependencies group @dependabot[bot] (#194)

See details of all code changes since previous release

Contributors

jmeridth
Loading

v2.0.0

v2.0.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 19 Aug 01:22
v2.0.0
4bf2f30
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Changelog

ðŸ’Ĩ Breaking Changes

  • feat(ci)!: require issues:write in auto-labeler to auto-create missing labels @jmeridth (#192)

🚀 Features

  • feat(ci)!: require issues:write in auto-labeler to auto-create missing labels @jmeridth (#192)

🧰 Maintenance

  • chore(deps): bump step-security/harden-runner from 2.20.1 to 2.21.0 in the dependencies group @dependabot[bot] (#191)

See details of all code changes since previous release

Contributors

jmeridth
Loading

v1.5.1

v1.5.1

Choose a tag to compare

View all tags
@github-actions github-actions released this 16 Aug 06:55
v1.5.1
c444c51
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Changelog

🐛 Bug Fixes

  • fix(ci): grant contents read to the auto-labeler job @jmeridth (#189)

See details of all code changes since previous release

Contributors

jmeridth
Loading

v1.5.0

v1.5.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 16 Aug 06:06
v1.5.0
05fdfee
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Changelog

🚀 Features

  • feat(release): add image-dockerfile and image-build-args to container variants @jmeridth (#187)

See details of all code changes since previous release

Contributors

jmeridth
Loading

v1.4.0

v1.4.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 16 Aug 05:58
v1.4.0
be6740b
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Changelog

🚀 Features

  • feat(release): image-dockerfile and image-build-args inputs @jmeridth (#183)

See details of all code changes since previous release

Contributors

jmeridth
Loading

v1.3.0

v1.3.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 16 Aug 05:50
v1.3.0
e09faf5
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Changelog

🚀 Features

  • feat(release): split release workflow into least-privilege variants @jmeridth (#180)

🧰 Maintenance

  • chore(deps): bump toshimaru/auto-author-assign from 3.0.3 to 3.1.0 in the dependencies group @dependabot[bot] (#182)
  • chore(deps): bump actions/attest-build-provenance from 4.1.1 to 4.2.2 in the dependencies group @dependabot[bot] (#181)
  • chore(deps): bump step-security/harden-runner from 2.20.0 to 2.20.1 in the dependencies group @dependabot[bot] (#179)
  • chore(deps): bump the dependencies group with 3 updates @dependabot[bot] (#178)

See details of all code changes since previous release

Contributors

jmeridth
Loading