v2.0.0

2.0.0 (2026-04-10)

⚠ BREAKING CHANGES

• Caller workflows that set explicit permissions must add artifact-metadata: write to their permissions block. Without it, GitHub will reject the workflow with a validation error.

Features

• require artifact-metadata:write permission for attestations (#144) (e7be9b5)

v1.12.2

1.12.2 (2026-04-10)

Bug Fixes

• remove artifact-metadata:write from reusable workflows (#142) (88588eb)

v1.12.1

1.12.1 (2026-04-10)

Bug Fixes

• add artifact-metadata:write permission and bump composite action (44df134)
• deps: bump the all-github-actions group across 1 directory with 5 updates (#139) (875c617)
• resolve Docker build workflow warnings (#141) (44df134)

v1.12.0

1.12.0 (2026-03-27)

Features

• add Infisical secrets composite action and example workflows (#134) (2f0ac6f)
• implement get_infisical_secrets composite action with examples and documentation (2f0ac6f)

Bug Fixes

• address all code scanning alerts (#136) (def5c61)
• harden all reusable workflows against code scanning alerts (3e49533)
• harden all reusable workflows against code scanning alerts (def5c61)

v1.11.6

1.11.6 (2026-03-24)

Bug Fixes

• bump trivy version to the latest and update the comment (#131) (497acc5)

v1.11.5

1.11.5 (2026-03-24)

Bug Fixes

• deps: bump aquasecurity/trivy-action (b33ea8f)
• deps: bump aquasecurity/trivy-action from e368e328979b113139d6f9068e03accaed98a518 to 57a97c7e7821a5776cebc9bb87c984fa69cba8f1 (#128) (b33ea8f)
• deps: bump azure/setup-helm from 4.3.1 to 5.0.0 (#127) (46b6c1f)
• deps: bump docker/login-action from 3.7.0 to 4.0.0 (#123) (8fdf229)
• deps: bump marocchino/sticky-pull-request-comment from 2 to 3 (#125) (5b0e3f6)
• update composite action to remediate Trivy supply chain attack (#126) (619371e)

v1.11.4

1.11.4 (2026-03-02)

Bug Fixes

• dependabot: include scope in commit messages (6037327)
• trivy: specify version for Trivy vulnerability scanner (6261c98)
• workflows: update github-action-image-build-and-push version for Docker builds (096391d)

v1.11.3

1.11.3 (2026-03-02)

Bug Fixes

• dependabot: use fix prefix for commit messages (#118) (5884540)

v1.11.2

1.11.2 (2025-11-25)

Bug Fixes

• update jfrog setup cli steps to use oidc auth instead of artifactory token (3b1f8d7)

v1.11.1

1.11.1 (2025-11-12)

Bug Fixes

• update Docker Hub credentials in workflows (f6a84c2)