Tags

Tags give the ability to mark specific points in history as being important

  • v1.0.2

    5d3213d2 · ci: adopt pipeline/release@v3.3.2 + bump other catalog pins ·
    Release: kaniko v1.0.2 
    **v1.0.2 — catalog adoption.**

Closes the architectural loop on the v1.0.1 release-page backtick bug: kaniko now consumes the fixed `pipeline/release@v3.3.2` catalog component instead of the inline `release-create` job introduced in MR !10. Every other catalog pin gets a uniform bump to v3.3.2.

- **Adopted `pipeline/release@v3.3.2` catalog component.** Replaces the inline `release-create` job that had the shell-eval-on-backticks bug and the `--no-update` re-run failure. The catalog reads the tag annotation directly into a file and passes it to `glab release create --notes-file`, so backtick-delimited content survives intact and force-pushed tags update the release page idempotently.
- **Uniform pin bump to v3.3.2.** Every catalog component (`container-scan-summary`, `compliance`, `vale`, `container`, `container-sbom`, `container-attest`, `verify`) moves from `@v3.2.0` to `@v3.3.2` in one consistent bump. v3.3.2 also fixes the `GOVULNCHECK_VERSION` pin that was silently blocking catalog tag pipelines from reaching the release stage.

Seven variants per release, signed and attested end-to-end. Same shape as [v1.0.0](https://gitlab.com/gitlab-com/public-sector/kaniko/-/releases/v1.0.0), rebuilt against the `refs/tags/v1.0.2` identity.

| Tag                              | Variant   | Crypto                              |
| -------------------------------- | --------- | ----------------------------------- |
| `:v1.0.2`                        | standard  | Go stdlib                           |
| `:v1.0.2-fips`                   | standard  | Go 1.25 FIPS 140-3                  |
| `:v1.0.2-debug`                  | debug     | Go stdlib                           |
| `:v1.0.2-fips-debug`             | debug     | Go 1.25 FIPS 140-3                  |
| `:v1.0.2-fips-strict-debug`      | debug     | FIPS 140-3 + P-curve patch          |
| `:v1.0.2-warmer`                 | warmer    | Go stdlib                           |
| `:v1.0.2-fips-warmer`            | warmer    | Go 1.25 FIPS 140-3                  |

- **Docs:** <https://gitlab-com.gitlab.io/public-sector/kaniko/>
- **Source:** <https://gitlab.com/gitlab-com/public-sector/kaniko>
- **Catalog adoption MR:** [!13](https://gitlab.com/gitlab-com/public-sector/kaniko/-/merge_requests/13)
- **Previous release:** [v1.0.1](https://gitlab.com/gitlab-com/public-sector/kaniko/-/releases/v1.0.1)

  • v1.0.1

    c94554e6 · ci: release-create job for tag pipelines ·
    Release: v1.0.1 
    **release-create CI now wired.** The empty `release` stage from v1.0.0 is filled in; future tag pipelines auto-create their GitLab Release page from the annotated tag body.

- New `release-create` job in the `release` stage. Fires on tag pipelines matching `v\d+\.\d+\.\d+`. Uses GitLab's built-in `release:` keyword (release-cli image). Description sourced from `CI_COMMIT_TAG_MESSAGE` — the annotated tag body verbatim, which means **the tag IS the source of truth** for release notes. Updating notes means re-tagging.
- CHANGELOG: closed `Unreleased` into `[v1.0.0] - 2026-05-21`; new `Unreleased` describes the release-create work that ships in this tag.

Same shape as [v1.0.0](https://gitlab.com/gitlab-com/public-sector/kaniko/-/releases/v1.0.0), rebuilt against the `refs/tags/v1.0.1` identity. Seven variants, signed and attested end-to-end.

| Tag                              | Variant   | Crypto                              |
| -------------------------------- | --------- | ----------------------------------- |
| `:v1.0.1`                        | standard  | Go stdlib                           |
| `:v1.0.1-fips`                   | standard  | Go 1.25 FIPS 140-3                  |
| `:v1.0.1-debug`                  | debug     | Go stdlib                           |
| `:v1.0.1-fips-debug`             | debug     | Go 1.25 FIPS 140-3                  |
| `:v1.0.1-fips-strict-debug`      | debug     | FIPS 140-3 + P-curve patch          |
| `:v1.0.1-warmer`                 | warmer    | Go stdlib                           |
| `:v1.0.1-fips-warmer`            | warmer    | Go 1.25 FIPS 140-3                  |

- **Docs:** <https://gitlab-com.gitlab.io/public-sector/kaniko/>
- **Source:** <https://gitlab.com/gitlab-com/public-sector/kaniko>
- **Previous release:** [v1.0.0](https://gitlab.com/gitlab-com/public-sector/kaniko/-/releases/v1.0.0)

  • v1.0.0

    0b6e63a7 · feat: brand assets + Pages site against the docs chrome ·
    Release: v1.0.0 
    v1.0.0 -- first public release.

Initial public flip of the kaniko build pipeline. Seven image variants
per release, each signed and attested end-to-end:

  :v1.0.0                       standard, Go stdlib
  :v1.0.0-fips                  standard, Go 1.25 FIPS 140-3
  :v1.0.0-debug                 debug, Go stdlib, bash
  :v1.0.0-fips-debug            debug, FIPS 140-3, bash
  :v1.0.0-fips-strict-debug     debug, FIPS 140-3 + P-curve patch, bash
  :v1.0.0-warmer                warmer, Go stdlib
  :v1.0.0-fips-warmer           warmer, Go 1.25 FIPS 140-3

cosign keyless signatures (GitLab OIDC), CycloneDX SBOM, SLSA v1.0
provenance per variant. Architectures linux/amd64 and linux/arm64.

Docs:   https://gitlab-com.gitlab.io/public-sector/kaniko/
Source: https://gitlab.com/gitlab-com/public-sector/kaniko