Changelog
Bug fixes
- 0dca768 fix(artifacts): quote rejected request fields in the debug log
- 6646c2e fix(cmd): do not follow project file symlinks out of the workdir
- a97c016 fix(git): anchor and escape hostnames in remote URL patterns
- 703e9d4 fix(cmd): treat ./.actrc as untrusted project config
- 0c0446b fix(runner): strip terminal control sequences from step output
- 63b3922 fix(runner): refuse NODE_OPTIONS from GITHUB_ENV and set-env
- 8fc492b fix(artifactcache): serve cache blobs through os.Root
- 3d37545 fix(artifacts): contain storage, bound signed URLs, drop empty-key parsing
- 53ab38f fix(container): restrict workflow container options and host volumes
- 4105885 fix(runner): keep remote action paths inside the action repository
- 8ec74ee fix(container): keep host-mode file writes inside the destination
- 1dc092d fix: report module pseudo and dirty versions instead of the VERSION fallback
Documentation updates
- b962e1e docs: add security audit findings and triage
- 770ad71 docs: host the act logo and repair broken README images
- 020ca09 docs: pin attestation verification to the release workflow and tag
- d68ab16 docs: add security policy
Other
- cba121f refactor(runner): split action reading and volume checks out of long functions
- ec60045 ci: publish the release only after provenance is attested
- fe5c98b ci: run the host-test skip message under bash on every OS
- c5f5a42 ci: release by pushing only the tag
- 37c5aa9 chore(deps): bump golang.org/x/net to v0.62.0
- e1f4d7a ci: add Dependabot cooldown and Docker updates
- 54bdd4e ci: pin Dockerfile base images by digest
- 27f467a ci: verify Chocolatey build inputs
- 2e7e440 ci: attest release provenance and pin GoReleaser
- 8859a7e ci: drop unused write scopes from checks
- d9255cf ci: scope workflow token permissions to jobs