release: v0.5.0 — Apache-2.0, core@v0.8.0, reviewer@v0.3.0

.github/workflows/reviewer.yml

@@ -35,7 +35,7 @@ jobs:
           python-version: "3.12"
       - name: Install signetry-reviewer
         # signetry-reviewer is installed from its source repo, not PyPI.
-        run: pip install "signetry-reviewer @ git+https://github.com/Signetry/reviewer@v0.2.0"
+        run: pip install "signetry-reviewer @ git+https://github.com/Signetry/reviewer@v0.3.0"
       - name: Compute the PR diff
         env:
           BASE_SHA: ${{ github.event.pull_request.base.sha }}

CHANGELOG.md

@@ -3,7 +3,7 @@
 Follows [Keep a Changelog](https://keepachangelog.com/) / [SemVer](https://semver.org/).
 Pin `@v1` (moving) or an exact `@v0.1.3+` tag.
 
-## [Unreleased]
+## [0.5.0] — 2026-09-01
 
 ### Changed — licensing (open core)
 
@@ -28,6 +28,27 @@ Pin `@v1` (moving) or an exact `@v0.1.3+` tag.
   across all Signetry repositories (bar the engine/integration licence wording) so the
   legal terms cannot drift per-repo again. See [CLA.md](CLA.md) §2–3.
 
+### Changed
+
+- Default `signetry-core` install pinned to
+  `git+https://github.com/Signetry/core@v0.8.0` (was `@v0.6.0` as of `v0.4.0`; an
+  intermediate bump to `@v0.7.0` landed on `main` and was never recorded here).
+  `v0.8.0` brings the receipt conformance spec + suite, the policy registry
+  (`signetry policies`, `signetry init --policy`), and placeholder-provenance
+  reporting, following the signetry-core v0.8.0 release.
+- The advisory reviewer workflow installs `signetry-reviewer@v0.3.0` (was `@v0.2.0`),
+  following the signetry-reviewer v0.3.0 release.
+- `@v1` moved to this release.
+
+### Fixed
+
+- **`MARKETPLACE.md` advertised an exact pin that was two releases stale.** The
+  Marketplace listing told readers to "Pin `@v1` (moving) or `@v0.2.0` (exact)" long
+  after `v0.3.1` and `v0.4.0` shipped, so anyone following it verbatim pinned an
+  Action that predates the rename. It now names the current release.
+
+## [0.4.0] — 2026-08-12
+
 ### Changed — Signetry naming
 
 - The Marketplace listing name is **Signetry Admission** (tagline: "Seal every
@@ -46,6 +67,7 @@ Pin `@v1` (moving) or an exact `@v0.1.3+` tag.
   is `.signetry/admission.yaml`.
  - Advisory reviewer workflow installs **`signetry-reviewer`** from
    `git+https://github.com/Signetry/reviewer@v0.1.2`.
+- `@v1` moved to this release.
 
 ## [0.3.1] — 2026-08-03
 

MARKETPLACE.md

@@ -185,7 +185,7 @@ with an optional built-in vulnerability scan.
 - Posts a verdict comment, uploads the signed receipt, fails the check below the
   required authority. Never merges.
 
-Pin @v1 (moving) or @v0.2.0 (exact). Requires signetry-core (installed automatically
+Pin @v1 (moving) or @v0.5.0 (exact). Requires signetry-core (installed automatically
 from the source repo; not on PyPI).
 ```
 

action.yml

@@ -109,7 +109,7 @@ runs:
           # 0.5.0+ carries the capability graph, G1/G2/G3 gates, the
           # `signetry comment` renderer, and the SAST detection engine (needed for
           # `scan: true`).
-          pip install "signetry-core @ git+https://github.com/Signetry/core@v0.7.0"
+          pip install "signetry-core @ git+https://github.com/Signetry/core@v0.8.0"
         fi
 
     - name: Detection scan (optional)