toolkit/packages/attest/RELEASES.md

# @actions/attest Releases

### 1.4.0

- Add new `headers` parameter to the `attest` and `attestProvenance` functions.
- Update `buildSLSAProvenancePredicate`/`attestProvenance` to automatically derive default OIDC issuer URL from current execution context.

### 1.3.1

- Fix bug with proxy support when retrieving JWKS for OIDC issuer

### 1.3.0

- Dynamic construction of Sigstore API URLs
- Switch to new GH provenance build type
- Fetch existing Rekor entry on 409 conflict error
- Bump @sigstore/bundle from 2.3.0 to 2.3.2
- Bump @sigstore/sign from 2.3.0 to 2.3.2

### 1.2.1

- Retry request on attestation persistence failure

### 1.2.0

- Generate attestations using the v0.3 Sigstore bundle format.
- Bump @sigstore/bundle from 2.2.0 to 2.3.0.
- Bump @sigstore/sign from 2.2.3 to 2.3.0.
- Remove dependency on make-fetch-happen

### 1.1.0

- Updates the `attestProvenance` function to retrieve a token from the GitHub OIDC provider and use the token claims to populate the provenance statement.

### 1.0.0

- Initial release
add new @actions/attest package Signed-off-by: Brian DeHamer <bdehamer@github.com> 2024-02-18 03:14:10 +00:00			`# @actions/attest Releases`

support for headers param in attest functions Signed-off-by: Brian DeHamer <bdehamer@github.com> 2024-08-14 18:21:15 +00:00			`### 1.4.0`

			- Add new `headers` parameter to the `attest` and `attestProvenance` functions.
derive default OIDC issuer from current tenant Signed-off-by: Brian DeHamer <bdehamer@github.com> 2024-08-16 17:04:14 +00:00			- Update `buildSLSAProvenancePredicate`/`attestProvenance` to automatically derive default OIDC issuer URL from current execution context.
support for headers param in attest functions Signed-off-by: Brian DeHamer <bdehamer@github.com> 2024-08-14 18:21:15 +00:00
fix proxy support for jwks retrieval Signed-off-by: Brian DeHamer <bdehamer@github.com> 2024-07-26 22:00:43 +00:00			`### 1.3.1`

			`- Fix bug with proxy support when retrieving JWKS for OIDC issuer`

prep 1.3.0 release of @actions/attest Signed-off-by: Brian DeHamer <bdehamer@github.com> 2024-05-21 20:11:37 +00:00			`### 1.3.0`

			`- Dynamic construction of Sigstore API URLs`
new GHA build provenance Signed-off-by: Brian DeHamer <bdehamer@github.com> 2024-06-05 21:36:23 +00:00			`- Switch to new GH provenance build type`
config rekor to fetch on conflict Signed-off-by: Brian DeHamer <bdehamer@github.com> 2024-06-12 18:57:18 +00:00			`- Fetch existing Rekor entry on 409 conflict error`
prep 1.3.0 release of @actions/attest Signed-off-by: Brian DeHamer <bdehamer@github.com> 2024-05-21 20:11:37 +00:00			`- Bump @sigstore/bundle from 2.3.0 to 2.3.2`
			`- Bump @sigstore/sign from 2.3.0 to 2.3.2`

retry request on failure to save attestation Signed-off-by: Brian DeHamer <bdehamer@github.com> 2024-04-24 18:31:11 +00:00			`### 1.2.1`

			`- Retry request on attestation persistence failure`

generate v0.3 bundles in attest package Signed-off-by: Brian DeHamer <bdehamer@github.com> 2024-04-03 19:12:26 +00:00			`### 1.2.0`

			`- Generate attestations using the v0.3 Sigstore bundle format.`
			`- Bump @sigstore/bundle from 2.2.0 to 2.3.0.`
			`- Bump @sigstore/sign from 2.2.3 to 2.3.0.`
remove dep on make-fetch-happen Signed-off-by: Brian DeHamer <bdehamer@github.com> 2024-04-10 23:53:17 +00:00			`- Remove dependency on make-fetch-happen`
generate v0.3 bundles in attest package Signed-off-by: Brian DeHamer <bdehamer@github.com> 2024-04-03 19:12:26 +00:00
build provenance stmt from OIDC claims Signed-off-by: Brian DeHamer <bdehamer@github.com> 2024-03-22 02:25:36 +00:00			`### 1.1.0`

			- Updates the `attestProvenance` function to retrieve a token from the GitHub OIDC provider and use the token claims to populate the provenance statement.

add new @actions/attest package Signed-off-by: Brian DeHamer <bdehamer@github.com> 2024-02-18 03:14:10 +00:00			`### 1.0.0`

			`- Initial release`