v0.20.0

What's Changed

• fix: validate all transitive dependencies for cached packages by @WVerlaek in #332

Full Changelog: v0.19.0...v0.20.0

v0.19.0

What's Changed

• Add root trace span for build command and fix S3 cache timeout by @WVerlaek in #326

Full Changelog: v0.18.0...v0.19.0

v0.18.0

What's Changed

• Graceful otel shutdown on build failure by @WVerlaek in #320
• Add GITHUB_HEAD_REF to OTEL tracing attributes by @WVerlaek in #322
• Add OpenTelemetry tracing for individual Go tests by @WVerlaek in #321
• feat: add nested phase spans for OpenTelemetry tracing by @WVerlaek in #323

Full Changelog: v0.17.0...v0.18.0

v0.17.0

What's Changed

• fix: update grype to v0.91.0 to resolve nil pointer panic by @kylos101 in #316
• Track SBOM generation time in build output by @WVerlaek in #318
• Fix flaky S3 batch optimization test by @kylos101 in #319

New Contributors

• @kylos101 made their first contribution in #316

Full Changelog: v0.16.0...v0.17.0

v0.10.8

Changelog

• 238435e feat(cache): add immediate upload mode for external interruption resilience

v0.10.7

Changelog

• 37bc783 fix(cache): upload successfully built packages even when build fails

v0.16.0

What's Changed

• fix: correct build summary counts for packages built after verification failure by @leodido in #295
• feat: add OpenTelemetry tracing with build and package spans by @corneliusludmann in #288
• fix: OCI extraction and SBOM export mode detection by @leodido in #296
• fix: skip vulnerability scanning for packages that failed to build by @leodido in #299
• feat: optimize S3 cache performance with batch operations and increased workers by @leodido in #278
• feat: implement dependency-aware download scheduling by @leodido in #279
• fix(yarn): add --frozen-lockfile to default install command by @leodido in #301
• docs: add security note about ignore-scripts for yarn packages by @leodido in #302
• fix: validate dependencies after download to prevent cache inconsistency by @leodido in #300
• fix(yarn): patch yarn.lock for link: dependencies and fix extraction path by @leodido in #303
• Fix typos in comments, docs, and tests by @leodido in #304
• fix!: correct typo in vet check name by @leodido in #305
• fix(cache): require dependencies in local cache for cached packages by @leodido in #306
• perf(cache): return detailed download results for smarter cache decisions by @leodido in #307
• perf(cache): add environment variables for S3 cache tuning by @leodido in #308
• fix: make GetTransitiveDependencies return deterministic order by @leodido in #309
• fix: add --sort=name to tar command for deterministic archives by @leodido in #310
• feat: store SBOM files outside tar.gz artifacts by @leodido in #311
• fix: add -trimpath to default Go build command by @leodido in #312
• fix: skip packages without SBOM during vulnerability scanning by @leodido in #313
• fix: resolve builtin variables in PackageInternal (prep, env) by @leodido in #314
• fix: upload (external) SBOM files alongside artifacts by @leodido in #315

Full Changelog: v0.15.0...v0.16.0

v0.16.0-rc13

Changelog

• 7e41168 fix: upload SBOM files even when artifact already exists
• 5e90928 fix: upload SBOM files in sign-cache command
• 7b5ffb0 refactor: consolidate SBOM extension constants in cache package

v0.16.0-rc9

Changelog

• 740a63f feat: store SBOM files outside tar.gz artifacts
• fcdb2ec fix!: correct typo in vet check name
• 28c3ea6 fix(cache): require dependencies in local cache for cached packages
• 1aa988a fix: add --sort=name to tar command for deterministic archives
• eb5e08c fix: add -trimpath to default Go build command for reproducible builds
• 0e85232 fix: correct typos in comments and documentation
• a81e7da fix: correct typos in filename and error message
• 098444f fix: correct typos in test case names
• f8679f7 fix: make GetTransitiveDependencies return deterministic order
• 992b32f perf(cache): add environment variables for S3 cache tuning
• 32d3e47 perf(cache): return detailed download results for smarter cache decisions
• 96bae24 test(cache): use Go packages in integration test for transitive deps

v0.16.0-rc12

Changelog

• c53da73 fix: resolve builtin variables in PackageInternal (prep, env)
• d4094a2 fix: skip SBOM scan for downloaded packages without SBOM