v4.5.0

4.5.0 (2026-04-09)

Miscellaneous

• deps: update dependency open-turo/renovate-config to v1.17.1 (f919dca)
• deps: update docker/build-push-action action to v7 (fcce982)
• deps: update docker/login-action action to v4 (ee0f363)
• deps: update docker/metadata-action action to v6 (6ba9e08)
• deps: update docker/setup-buildx-action action to v4 (e2fc096)
• deps: update docker/setup-qemu-action action to v4 (b9923c7)
• deps: update node.js to v24.13.1 (ddce560)
• deps: update node.js to v24.14.1 (360be26)
• deps: update pre-commit hook rhysd/actionlint to v1.7.12 (9fd9d58)

Features

• container-scan: expand trigger patterns and skip draft PRs (bf871dc)
• implementing conditional scans for container scan (40a7dbc)

Bug Fixes

• container-scan: accurate skip reason notice and suppress error annotation when scan skipped (045824b)
• container-scan: use fetch-depth: 2 so git diff can resolve base and head SHAs (8d93e2f)
• container-scan: use GitHub PR API for changed files to avoid base-branch divergence (6fcde63)

Code Refactoring

• container-scan: pass step outputs as env vars in check-changes step (1380638)
• container-scan: rename scan_override output to check_mode (1392b8e)
• container-scan: replace custom bash change detection with dorny/paths-filter (37e801f)

v4.4.0

4.4.0 (2026-02-19)

Features

• wizcliv1 migration (b4d9911)

Bug Fixes

• debug conditional (379aad4)

Miscellaneous

• deps: update dependency open-turo/renovate-config to v1.17.0 (61441a6)
• deps: update node.js to v24.13.0 (725ee24)
• deps: update pre-commit hook alessandrojcm/commitlint-pre-commit-hook to v9.24.0 (8c5bec5)
• deps: update pre-commit hook rhysd/actionlint to v1.7.11 (9047f2b)

v4.3.0

4.3.0 (2026-01-13)

Features

• upgrade Semgrep to v1.144.0 with configurable version (4ed7371)

Miscellaneous

• removing iac scan as it is handled in tfe (9e72f0f)
• deps: update actions/checkout action to v6 (f1e58c4)
• deps: update actions/upload-artifact action to v5 (e3a13ca)
• deps: update dependency open-turo/renovate-config to v1.16.1 (f97d12c)
• deps: update node.js to v24.11.1 (e1534ef)
• deps: update node.js to v24 (a21087b)
• deps: update pre-commit hook rhysd/actionlint to v1.7.10 (aac0df3)
• deps: update pre-commit hook rhysd/actionlint to v1.7.9 (12b53df)
• upgrade Semgrep version from 1.144.0 to 1.147.0 (latest) (6bb0cea)

v4.2.2

4.2.2 (2025-10-21)

Bug Fixes

• resolve shell injection vulnerabilities in GitHub Actions (ffc8433)

v4.2.1

4.2.1 (2025-10-21)

Bug Fixes

• prevent shell injection in GitHub Actions workflows - SEC-4316 (7a0271c)

v4.2.0

4.2.0 (2025-10-17)

Features

• adding iac scan (61f7845)

Bug Fixes

• checkout ver (f251a8a)
• consolidating (43ad63d)
• linting (c77ab96)

Miscellaneous

• readme (ba8abff)
• deps: update pre-commit hook rhysd/actionlint to v1.7.8 (f7c0644)

v4.1.0

4.1.0 (2025-10-09)

Features

• static-analysis: add checkout ref for PR context (f32dc6c)

v4.0.6

4.0.6 (2025-10-07)

Bug Fixes

• fixing new findings: fixing additional findings (e6cf3e5)

Miscellaneous

• deps: update actions/checkout action to v5 (22ceb43)
• deps: update node.js to v22.20.0 (3bbbcaa)

v4.0.5

4.0.5 (2025-10-06)

Bug Fixes

• fixing semgrep finding: fixing semgrep finding (fbb0938)

v4.0.4

4.0.4 (2025-10-06)

Bug Fixes

• using heredoc to pass script as single block (4c09e73)