Tags give the ability to mark specific points in history as being important
-
v0.36.3
9b67e6f6 · ·v0.36.3 — reject unpublishable OCI package shapes The MCP registry refuses an OCI package that carries registryBaseUrl, and wants the registry host inside identifier. Both are checkable against the file, and both previously surfaced as a 400 after the image push, the GitHub Release and any ClawHub publish had already succeeded.
-
v0.36.2
15c125e3 · ·v0.36.2 — guard server.json description length The MCP registry caps description at 100 characters and reports it as a 422 from the publish call, which runs after the image push, the GitHub Release and any ClawHub publish have already succeeded. The job now fails on the length up front, reading the field straight out of server.json.
-
v0.36.1
29786cf6 · ·v0.36.1 — fix issue-pull's stderr capture The call sites merged stderr into the captured payload, so the helper's retrying-anonymously warning was prepended to the JSON and jq died with 'parse error: Expected string key before ':' at line 1, column 1'. Every caller whose authenticated read was refused -- 63 of 64 -- failed on every scheduled run since the workflow shipped. read_issues now also validates that the payload is a JSON array, so a mirror returning an HTML error page or an empty body skips that platform for the run instead of aborting the job.
-
v0.36.0
c094895a · ·v0.36.0 — make-checks.yml Lint and test for repos whose toolchain lives in their container, with no setup-go / setup-python step installing something nothing uses. Inputs: lint_command, test_command, dep_command, coverage_file, coverage_artifact, runs_on; the command inputs take '-' or '' to skip a step. Lint and test run as steps in one job, not two parallel jobs, because parallel jobs would each rebuild the repo's dev image from scratch. dep_command is off by default: a container-built dependency env cannot be handed to a host step. New workflow only. No existing workflow changes behaviour.
-
v0.35.2
77dc0445 · ·v0.35.2 — state the Docker Hub token scope dockerhub_token needs Read, Write AND Delete. Pushing an image only needs Write, but writing repository metadata sits behind the same scope Docker Hub uses for Delete and there is no tier between them, so a Read/Write token pushes fine and then fails every metadata call with 'access denied: insufficient scope'. Nothing here ever issues a DELETE. Docs only; no behaviour change.
-
v0.35.1
4e84849e · ·v0.35.1 — keep the Docker Hub credentials out of process argv The visibility step shipped in v0.35.0 passed the access token to jq as --arg and the session token to curl as -H. Both land in a process argument list, which /proc exposes to anything else on the machine. jq now reads the credentials from the environment, and the session token goes in a 0600 file passed as curl --config and removed on exit. No input or behaviour change. Anyone already on v0.35.0 should take this.
-
v0.35.0
99521b2a · ·v0.35.0 — keep the Docker Hub page in step with the GitHub one dockerhub_private (default false) is read back after every push and corrected when it differs. Pushing to a repository that does not exist creates it with whatever visibility the account default says, so the result used to depend on a setting nobody looks at -- and a private one still gave a green run with a successful push nobody else could pull. sync_description sets the Docker Hub short description from the GitHub repository description, cut to Docker Hub's 100-character cap and counted in codepoints rather than bytes. readme_url_header prepends a source link, and the project page when one is set, to the long description -- Docker Hub has no field for either. Topics are not synced: Docker Hub's categories are a fixed taxonomy rather than free-form tags.
-
v0.34.0
d0cea5eb · ·v0.34.0 — pass an OpenVEX document to the image scanner New scan_vex_file input on docker-image-workflow.yml takes a path in the repo to an OpenVEX document, passed to Grype as --vex, for a CVE the maintainer has assessed as not affecting the image. Unlike an ignore list it records why: a machine-readable justification plus a human impact statement, in a reviewable file. New scan_only_fixed reports only vulnerabilities with a published fix. Both were already supported by the pinned scan-action and simply never wired. Defaults preserve the previous behaviour exactly. A VEX-suppressed finding also leaves the Security tab, so a wrong assertion hides a real vulnerability -- documented at the input and in the README. The scan jobs check the repo out only when a VEX path is set, since otherwise it resolved to nothing on a runner that had never cloned the repo.
-
v0.33.1
72c0e0d9 · ·v0.33.1 — halve the daily new-item ceiling on archive.org The ceiling is per day, but what it guards against is a burst: creating roughly a dozen items inside an hour is what answers 503 SlowDown with 'appears to be spam'. Ten a day can still be ten inside ten minutes when several repositories' schedules land together. It is also counted by querying archive.org rather than by keeping a tally, and that search index lags by minutes, so the number in flight can exceed the ceiling before the count catches up. Five leaves margin for both. Nothing is lost by going slower. An item created a day later is the same item, and a repository whose tree has not changed uploads nothing at all.
-
v0.33.0
78704200 · ·v0.33.0 — mirrors stop pretending to accept contributions Breaking: archive.yml's secrets are renamed wayback_access_key -> archiveorg_access_key and wayback_secret_key -> archiveorg_secret_key. The pair is an account credential signing Save Page Now, the S3 upload API and the metadata API alike; naming it after one caller made every other use look like it needed its own key. Callers passing the old names fail at startup. New issue-pull.yml copies issues opened on the Codeberg and GitLab mirrors into GitHub and closes the copy when the original closes, noting where it was closed, how many comments it drew and how long it was open. It only reads the mirrors and writes here, so no GitHub credential leaves the runner. git-mirror.yml now turns pull requests off on the mirrors by default. A mirror is force-pushed from its source, so anything merged on one is destroyed by the next sync, and unlike GitHub neither platform can refuse a PR -- so the button comes off instead. Issues and forking stay on. Its description prefix also defaults to empty now. archive.yml uploads the repository to archive.org as a browsable item with real metadata, skipping when the recorded source revision already matches HEAD and capping new-item creation per day. Save Page Now handling is fixed in three places: a 404 under load is retryable, hitting the per-URL daily cap counts as archived, and the retry budget now outlasts the queue instead of racing it. Also: docker-image-workflow.yml's target_platforms is no longer both required and defaulted, five workflows gained a top-level permissions block, and the README is rewritten against the code.
-
v0.32.2
7fe4508d · ·Drop pip-audit --strict so releases stop failing on their own unpublished version
-
-
-
-
-
-
-
-
-