v1.104.0

What's Changed

• Bump Helm Chart and Dagger Version => v1.103.1 by @github-actions[bot] in #3259
• fix(ci): align secrets-scan material name with contract by @migmartri in #3262
• fix: harden GitHub Actions workflows against zizmor findings by @migmartri in #3260
• feat: add opencode chainloop-trace plugin by @migmartri in #3267
• ci: bump docker/login-action to v4.4.0 by @matiasinsaurralde in #3261
• fix(controlplane): restrict owner-role invitations to org owners (CP-1) by @migmartri in #3263
• feat: introduce PR mode for attestations by @migmartri in #3268
• docs: fix broken GUAC integration link in README by @tknura in #3272
• fix(cli): correct registered integration add usage string to --opt by @tknura in #3271
• fix: upgrade extras/dagger deps to resolve 4 security advisories by @migmartri in #3277
• fix(crafter): surface auto-discovery validation errors by @waveywaves in #2983
• docs: regenerate CLI reference for registered integration add usage by @matiasinsaurralde in #3279
• fix: upgrade Go toolchain to 1.26.5 for GO-2026-4970-stdlib by @chainloop-platform[bot] in #3278
• feat(cli): explode archive materials in chainloop att add by @javirln in #3254
• fix(materials): do not record container image digest as tag by @tknura in #3281
• fix(cli): accept matching --name and metadata.name in contract commands by @tknura in #3282
• fix(dispatcher): improve fanout delivery timeouts and retry budget by @migmartri in #3270
• refactor: remove the public attribute from workflows by @matiasinsaurralde in #3283
• fix(cli): preserve verbatim contract bytes when splitting apply documents by @javirln in #3233

Full Changelog: v1.103.1...v1.104.0

v1.103.1

Chainloop Attestation

View the attestation of this release

Changelog

• c386baf feat(cli): per-policy scoping for --policy-input-from-file (#3258)

v1.103.0

Chainloop Attestation

View the attestation of this release

Changelog

• 4242056 feat(cli): inject policy inputs from CSV/JSON files at attestation add (#3244)

v1.102.2

Chainloop Attestation

View the attestation of this release

Changelog

• 632bc95 refactor(controlplane): remove regex support in authz middleware (#3246)

v1.102.1

Chainloop Attestation

View the attestation of this release

Changelog

• 4edf9bd feat(policies): add option to ignore CLI compatibility when resolving policies (#3242)

v1.102.0

Chainloop Attestation

View the attestation of this release

Changelog

• c2cc38e feat(contract): support "at least one of" material choke groups (#3235)

v1.101.0

Chainloop Attestation

View the attestation of this release

Changelog

• f4cb19b fix(controlplane): exclude soft-deleted rows when finding a project version by name (#3237)

v1.100.13

Chainloop Attestation

View the attestation of this release

Changelog

• 175338b fix(controlplane): exempt batch-local policy refs in contract apply (#3230)

v1.100.12

Chainloop Attestation

View the attestation of this release

Changelog

• 0dd3c70 fix(cli): surface policy-group materials during attestation (#3223)

v1.100.11

Chainloop Attestation

View the attestation of this release

Changelog

• 64fab8a feat(controlplane): add dry-run and status/revision reporting to contract apply (#3220)