From 432e47e6c11f5f14be7fe5c69923d16ce146559a Mon Sep 17 00:00:00 2001 From: rldyourmnd Date: Mon, 24 Aug 2026 23:40:55 +0500 Subject: [PATCH] chore(release): prepare 0.1.7 --- CHANGELOG.md | 15 +++++++++++++++ VERSION | 2 +- 2 files changed, 16 insertions(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 0df4cef..d6148ed 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -7,11 +7,26 @@ The project follows Semantic Versioning. ## [Unreleased] +## [0.1.7] - 2026-08-24 + - Added a trusted default-branch Dependabot catalog synchronizer. Failed same-repository Dependabot action bumps are updated in place from a `workflow_run` job that never executes candidate code; hardening and Scorecard validators now derive action identities from the catalog instead of carrying additional hardcoded SHA copies. +- Made the synchronizer update the exact bound pull request through GitHub's + native branch API, approve only `action_required` runs for its exact derived + SHA, and keep candidate trees data-only. Transitive Docker-action image + declarations now converge with action pin updates as well. +- Added the machine-enforced cache trust contract v2: provider ref scopes, + exact-first key dimensions, persistent-runner residue rules, retention and + rate limits, hosted/fleet equivalence, and real cold/warm telemetry. +- Added successful runtime harnesses for the real cargo-fuzz and + ClusterFuzzLite reusable workflows, including a complete C++ libFuzzer + builder integration and fail-closed evidence aggregation. +- Isolated owner-only side-effect runtime fixtures from Dependabot pull + requests so real bot commits and repository labels are never mistaken for + disposable commitlint or label-mutation evidence. ## [0.1.6] - 2026-08-24 diff --git a/VERSION b/VERSION index c946ee6..1180819 100644 --- a/VERSION +++ b/VERSION @@ -1 +1 @@ -0.1.6 +0.1.7