ProxmoxMCP-Plus v0.5.12

Release date: 2026-07-29

Immutable Docker Release Actions

This release completes the supply-chain hardening of the GHCR publication workflow by pinning every third-party Docker Action to a reviewed full commit SHA:

• docker/login-action v4.6.0
• docker/metadata-action v6.2.0
• docker/build-push-action v7.3.0
• docker/setup-qemu-action v4.2.0
• docker/setup-buildx-action v4.2.0

The login-action pin was refreshed from v4.4.0 during review to include the v4.5 and v4.6 dependency updates and scoped-config path hardening. All five pinned commits were resolved against their official Docker Action repositories before release.

Thanks to mirkosalvato1-ctrl for opening PR #108 and proposing the original pinning change.

Regression Protection

The release metadata tests now enumerate every docker/* Action reference in the GHCR workflow and require each reference to be a lowercase 40-character commit SHA. Adding a mutable major tag such as @v4 will fail CI.

The Python base image and QEMU helper image remain pinned by OCI digest.

Compatibility

• MCP tools, schemas, ports, transports, and runtime configuration are unchanged.
• The native linux/amd64 and linux/arm64 images introduced in v0.5.11 remain available under the same GHCR tags.
• The native ARM64 post-publication pull and /livez health check remains a required GHCR release gate.
• No migration is required.

Validation

The release quality gate covers Python 3.11 and 3.12 tests with coverage enforcement, Ruff, Mypy, CodeQL, dependency auditing, package builds, Twine metadata validation, runtime-to-manifest parity, actionlint, immutable Action reference checks, multi-architecture publication, and native ARM64 post-publication runtime validation.

Upgrade Notes

• Upgrade normally from PyPI, GHCR, or source.
• No application or Docker configuration changes are required.