From dd66f216877fe5b8bede245be39f1961c0638ccc Mon Sep 17 00:00:00 2001 From: Binay <150876063+bkd-dotcom@users.noreply.github.com> Date: Tue, 1 Sep 2026 11:14:21 -0400 Subject: [PATCH] release: v0.5.0 (core@v0.8.0, reviewer@v0.3.0) + backfill the missing v0.4.0 changelog entry --- .github/workflows/reviewer.yml | 2 +- CHANGELOG.md | 24 +++++++++++++++++++++++- MARKETPLACE.md | 2 +- action.yml | 2 +- 4 files changed, 26 insertions(+), 4 deletions(-) diff --git a/.github/workflows/reviewer.yml b/.github/workflows/reviewer.yml index 8b8b375..ec4bff1 100644 --- a/.github/workflows/reviewer.yml +++ b/.github/workflows/reviewer.yml @@ -35,7 +35,7 @@ jobs: python-version: "3.12" - name: Install signetry-reviewer # signetry-reviewer is installed from its source repo, not PyPI. - run: pip install "signetry-reviewer @ git+https://github.com/Signetry/reviewer@v0.2.0" + run: pip install "signetry-reviewer @ git+https://github.com/Signetry/reviewer@v0.3.0" - name: Compute the PR diff env: BASE_SHA: ${{ github.event.pull_request.base.sha }} diff --git a/CHANGELOG.md b/CHANGELOG.md index 7616443..b472cce 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -3,7 +3,7 @@ Follows [Keep a Changelog](https://keepachangelog.com/) / [SemVer](https://semver.org/). Pin `@v1` (moving) or an exact `@v0.1.3+` tag. -## [Unreleased] +## [0.5.0] — 2026-09-01 ### Changed — licensing (open core) @@ -28,6 +28,27 @@ Pin `@v1` (moving) or an exact `@v0.1.3+` tag. across all Signetry repositories (bar the engine/integration licence wording) so the legal terms cannot drift per-repo again. See [CLA.md](CLA.md) §2–3. +### Changed + +- Default `signetry-core` install pinned to + `git+https://github.com/Signetry/core@v0.8.0` (was `@v0.6.0` as of `v0.4.0`; an + intermediate bump to `@v0.7.0` landed on `main` and was never recorded here). + `v0.8.0` brings the receipt conformance spec + suite, the policy registry + (`signetry policies`, `signetry init --policy`), and placeholder-provenance + reporting, following the signetry-core v0.8.0 release. +- The advisory reviewer workflow installs `signetry-reviewer@v0.3.0` (was `@v0.2.0`), + following the signetry-reviewer v0.3.0 release. +- `@v1` moved to this release. + +### Fixed + +- **`MARKETPLACE.md` advertised an exact pin that was two releases stale.** The + Marketplace listing told readers to "Pin `@v1` (moving) or `@v0.2.0` (exact)" long + after `v0.3.1` and `v0.4.0` shipped, so anyone following it verbatim pinned an + Action that predates the rename. It now names the current release. + +## [0.4.0] — 2026-08-12 + ### Changed — Signetry naming - The Marketplace listing name is **Signetry Admission** (tagline: "Seal every @@ -46,6 +67,7 @@ Pin `@v1` (moving) or an exact `@v0.1.3+` tag. is `.signetry/admission.yaml`. - Advisory reviewer workflow installs **`signetry-reviewer`** from `git+https://github.com/Signetry/reviewer@v0.1.2`. +- `@v1` moved to this release. ## [0.3.1] — 2026-08-03 diff --git a/MARKETPLACE.md b/MARKETPLACE.md index e2b48ef..beaa8ea 100644 --- a/MARKETPLACE.md +++ b/MARKETPLACE.md @@ -185,7 +185,7 @@ with an optional built-in vulnerability scan. - Posts a verdict comment, uploads the signed receipt, fails the check below the required authority. Never merges. -Pin @v1 (moving) or @v0.2.0 (exact). Requires signetry-core (installed automatically +Pin @v1 (moving) or @v0.5.0 (exact). Requires signetry-core (installed automatically from the source repo; not on PyPI). ``` diff --git a/action.yml b/action.yml index 92b4ece..a51e347 100644 --- a/action.yml +++ b/action.yml @@ -109,7 +109,7 @@ runs: # 0.5.0+ carries the capability graph, G1/G2/G3 gates, the # `signetry comment` renderer, and the SAST detection engine (needed for # `scan: true`). - pip install "signetry-core @ git+https://github.com/Signetry/core@v0.7.0" + pip install "signetry-core @ git+https://github.com/Signetry/core@v0.8.0" fi - name: Detection scan (optional)