What's Changed

• fix: split checksums on any line ending so LF files parse on Windows by @bdehamer in #443
• Bump @actions/glob from 0.6.1 to 0.7.0 in the npm-production group across 1 directory by @dependabot[bot] in #435
• Bump csv-parse from 6.2.1 to 7.0.1 by @dependabot[bot] in #437
• Read subjects from GITHUB_ARTIFACTS_LIST by @bdehamer in #447
• Support SHA-2 subject digests by @bdehamer in #446

Full Changelog: v4.1.1...v4.2.0

What's Changed

• Bump tar from 7.5.9 to 7.5.10 by @dependabot[bot] in #371
• Bump tar from 7.5.10 to 7.5.11 by @dependabot[bot] in #375
• Bump the npm-production group across 1 directory with 2 updates by @dependabot[bot] in #404
• Bump minimatch by @dependabot[bot] in #399
• Bump brace-expansion from 1.1.12 to 1.1.14 by @dependabot[bot] in #397
• Bump undici from 6.23.0 to 6.24.1 by @dependabot[bot] in #381
• Bump ip-address from 10.1.0 to 10.2.0 by @dependabot[bot] in #411
• Bump undici from 7.25.0 to 8.2.0 by @dependabot[bot] in #409
• Bump tar from 7.5.11 to 7.5.17 by @dependabot[bot] in #429
• Bump csv-parse from 5.6.0 to 6.2.1 by @dependabot[bot] in #414
• Bump @sigstore/oci from 0.6.1 to 0.7.1 by @bdehamer in #432

Full Changelog: v4.1.0...v4.1.1

What's Changed

• Bump @actions/attest from 3.0.0 to 3.1.0 by @bdehamer in #362
• Bump @actions/attest from 3.1.0 to 3.2.0 by @bdehamer in #365
• Add new subject-version input for inclusion in storage record by @bdehamer in #364
• Add storage record content to README by @bdehamer in #366

Full Changelog: v4.0.0...v4.1.0

All of the capabilities of actions/attest-build-provenance, and actions/attest-sbom have now been folded into actions/attest.

What's Changed

• Bump @actions/core from 2.0.1 to 2.0.2 in the npm-production group by @dependabot[bot] in #323
• Bump tar from 7.4.3 to 7.5.6 by @dependabot[bot] in #333
• Bump @actions/github from 6.0.1 to 7.0.0 by @dependabot[bot] in #324
• Bump @actions/attest from 2.1.0 to 2.2.1 by @dependabot[bot] in #325
• Bump tar from 7.4.3 to 7.5.7 by @dependabot[bot] in #337
• Bump @isaacs/brace-expansion from 5.0.0 to 5.0.1 by @dependabot[bot] in #342
• Consolidate attestation actions by @bdehamer in #346
• ESM Conversion by @bdehamer in #347
• Test suite refactor by @bdehamer in #356
• Bump tar from 7.5.7 to 7.5.9 by @dependabot[bot] in #354
• Bump version in package.json to v4.0.0 by @bdehamer in #360

Full Changelog: v3.2.0...v4.0.0

What's Changed

• Bump the npm-development group with 3 updates by @dependabot[bot] in #320
• Validate repository org-ownership before storage record creation by @malancas in #328
• Update version to 3.2.0 by @malancas in #334

Full Changelog: v3.1.0...v3.2.0

What's Changed

• Bump @actions/attest from 1.6.0 to 2.0.0 by @dependabot[bot] in #299
• Bump @actions/core from 1.11.1 to 2.0.1 by @dependabot[bot] in #318
• Create Artifact Metadata Storage Record on registry push by @malancas in #313

New Contributors

• @malancas made their first contribution in #313

Full Changelog: v3...v3.1.0

What's Changed

• Bump form-data from 4.0.0 to 4.0.4 by @dependabot[bot] in #266
• Bump @sigstore/oci from 0.5.0 to 0.6.0 by @dependabot[bot] in #271
• Upgrade to Node 24 by @salmanmkc / @bdehamer in #276
• Improved checksum parsing by @bdehamer in #280

⚠️ Minimum Compatible Runner Version

v2.327.1
Release Notes

Make sure your runner is updated to this version or newer to use this release.

Full Changelog: v2.4.0...v3.0.0

What's Changed

• Bump @actions/github from 6.0.0 to 6.0.1 in the npm-production group by @dependabot in #242
• Bump undici from 5.28.5 to 5.29.0 by @dependabot in #246
• Add path to created attestation in a well-known summary file by @kommendorkapten in #252

New Contributors

• @kommendorkapten made their first contribution in #252

Full Changelog: v2...v2.4.0

What's Changed

• Bump @octokit/request from 8.2.0 to 8.4.1 by @dependabot in #229
• Bump @sigstore/oci from 0.4.0 to 0.5.0 by @bdehamer in #235
  • Adds support for reading the HttpHeaders value from the Docker config file

Full Changelog: v2...v2.3.0

What's Changed

• Bump undici from 5.28.4 to 5.28.5 by @bdehamer in #208
• Bump @octokit/request-error from 5.0.1 to 5.1.1 by @dependabot in #212
• Bump @octokit/plugin-paginate-rest from 9.1.5 to 9.2.2 by @dependabot in #215
• Bump @actions/attest from 1.5.0 to 1.6.0 by @bdehamer in #217

Full Changelog: v2.2.0...v2.2.1